Vulnetix
Try Vulnetix Request Demo
Apple Security Advisories · August 2010 — Apple Security Advisories
19 advisories 19 CVEs 2 EXPLOITED

Apple-vendor CVEs for 2010-08. Mirrored into Vulnetix VDB.

Every advisory below is enriched with the Vulnetix VDB exploit-intelligence chip (hover a CVE ID in the interactive page to see CVSS, EPSS, KEV status, and PoC maturity). 2 are already weaponised in the wild — see the Exploited section.

Back to archive Open Console

What would you fix first?

The advisories below are ordered by the Vulnetix risk prioritization strategy: exploitation evidence first, scores second. On the interactive page you can switch to three other lenses.

How Vulnetix ranks risk Get a free API key

Advisories

CVE-2010-1799

OtherExploitedCISA KEV listedHIGH2010-08-16

Stack-based buffer overflow in the error-logging functionality in Apple QuickTime before 7.6.7 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file.

CVEs:CVE-2010-1799

Affected products

ProductStatusVendorPackageEcosystem
quicktime affected apple — —
Upstream advisory

CVE-2010-1797

iOSExploitedVulnCheck KEV listedHIGH2010-08-02

Multiple stack-based buffer overflows in the cff_decoder_parse_charstrings function in the CFF Type2 CharStrings interpreter in cff/cffgload.c in FreeType before 2.4.2, as used in Apple iOS before 4.0.2 on the iPhone and iPod touch and before 3.2.2 on ...

CVEs:CVE-2010-1797

Affected products

ProductStatusVendorPackageEcosystem
iphone_os affected apple — —
Upstream advisory

CVE-2010-1801

macOSPoC exploitCRITICAL2010-08-25

Heap-based buffer overflow in CoreGraphics in Apple Mac OS X 10.5.8 and 10.6.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PDF file.

CVEs:CVE-2010-1801

Affected products

ProductStatusVendorPackageEcosystem
coregraphics affected apple — —
mac_os_x affected apple — —
mac_os_x_server affected apple — —
Upstream advisory

CVE-2010-1808

macOSPoC exploitCRITICAL2010-08-25

Stack-based buffer overflow in Apple Type Services (ATS) in Apple Mac OS X 10.5.8 and 10.6.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted embedded font in a document.

CVEs:CVE-2010-1808

Affected products

ProductStatusVendorPackageEcosystem
apple_type_services affected apple — —
mac_os_x affected apple — —
mac_os_x_server affected apple — —
Upstream advisory

CVE-2010-1800

macOSPoC exploitHIGH2010-08-25

CFNetwork in Apple Mac OS X 10.6.3 and 10.6.4 supports anonymous SSL and TLS connections, which allows man-in-the-middle attackers to redirect a connection and obtain sensitive information via crafted responses.

CVEs:CVE-2010-1800

Affected products

ProductStatusVendorPackageEcosystem
cfnetwork affected apple — —
mac_os_x affected apple — —
mac_os_x_server affected apple — —
Upstream advisory

CVE-2010-1802

macOSPoC exploitMEDIUM2010-08-25

libsecurity in Apple Mac OS X 10.5.8 and 10.6.4 does not properly perform comparisons to domain-name strings in X.509 certificates, which allows man-in-the-middle attackers to spoof SSL servers via a certificate associated with a similar domain name, a...

CVEs:CVE-2010-1802

Affected products

ProductStatusVendorPackageEcosystem
libsecurity affected apple — —
mac_os_x affected apple — —
mac_os_x_server affected apple — —
Upstream advisory

CVE-2010-1818

OtherEPSS <= 49%HIGH2010-08-31

The IPersistPropertyBag2::Read function in QTPlugin.ocx in Apple QuickTime 6.x, 7.x before 7.6.8, and other versions allows remote attackers to execute arbitrary code via the _Marshaled_pUnk attribute, which triggers unmarshalling of an untrusted pointer.

CVEs:CVE-2010-1818

Affected products

ProductStatusVendorPackageEcosystem
quicktime affected apple — —
Upstream advisory

CVE-2010-3190

OtherEPSS <= 49%HIGH2010-08-25

Untrusted search path vulnerability in the Microsoft Foundation Class (MFC) Library in Microsoft Visual Studio .NET 2003 SP1; Visual Studio 2005 SP1, 2008 SP1, and 2010; Visual C++ 2005 SP1, 2008 SP1, and 2010; and Exchange Server 2010 Service Pack 3, ...

CVEs:CVE-2010-3190

Affected products

ProductStatusVendorPackageEcosystem
itunes affected apple — —
Upstream advisory

CVE-2010-2806

OtherEPSS <= 49%CRITICAL2010-08-06

Array index error in the t42_parse_sfnts function in type42/t42parse.c in FreeType before 2.4.2 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via negative size values for certain strings in ...

CVEs:CVE-2010-2806

Affected products

ProductStatusVendorPackageEcosystem
iphone_os affected apple — —
mac_os_x affected apple — —
tvos affected apple — —
Upstream advisory

CVE-2010-2805

OtherEPSS <= 49%CRITICAL2010-08-09

The FT_Stream_EnterFrame function in base/ftstream.c in FreeType before 2.4.2 does not properly validate certain position values, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a cr...

CVEs:CVE-2010-2805

Affected products

ProductStatusVendorPackageEcosystem
iphone_os affected apple — —
mac_os_x affected apple — —
tvos affected apple — —
Upstream advisory

CVE-2010-2808

OtherEPSS <= 49%CRITICAL2010-08-06

Buffer overflow in the Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.4.2 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a crafted Adobe Type ...

CVEs:CVE-2010-2808

Affected products

ProductStatusVendorPackageEcosystem
iphone_os affected apple — —
mac_os_x affected apple — —
tvos affected apple — —
Upstream advisory

CVE-2010-2807

OtherEPSS <= 49%CRITICAL2010-08-09

FreeType before 2.4.2 uses incorrect integer data types during bounds checking, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file.

CVEs:CVE-2010-2807

Affected products

ProductStatusVendorPackageEcosystem
iphone_os affected apple — —
mac_os_x affected apple — —
tvos affected apple — —
Upstream advisory

CVE-2010-3116

SafariEPSS <= 49%HIGH2010-08-24

Multiple use-after-free vulnerabilities in WebKit, as used in Apple Safari before 4.1.3 and 5.0.x before 5.0.3, Google Chrome before 5.0.375.127, and webkitgtk before 1.2.6, allow remote attackers to execute arbitrary code or cause a denial of service ...

CVEs:CVE-2010-3116

Affected products

ProductStatusVendorPackageEcosystem
iphone_os affected apple — —
safari affected apple — —
Upstream advisory

CVE-2010-1795

OtherEPSS <= 49%HIGH2010-08-20

Untrusted search path vulnerability in Apple iTunes before 9.1, when running on Windows 7, Vista, and XP, allows local users and possibly remote attackers to gain privileges via a Trojan horse DLL in the current working directory.

CVEs:CVE-2010-1795

Affected products

ProductStatusVendorPackageEcosystem
itunes affected apple — —
Upstream advisory

CVE-2010-1760

SafariEPSS <= 49%HIGH2010-08-19

loader/DocumentThreadableLoader.cpp in the XMLHttpRequest implementation in WebCore in WebKit before r58409 does not properly handle credentials during a cross-origin synchronous request, which has unspecified impact and remote attack vectors, aka rdar...

CVEs:CVE-2010-1760

Affected products

ProductStatusVendorPackageEcosystem
webkit affected apple — —
Upstream advisory

CVE-2010-1386

SafariEPSS <= 49%HIGH2010-08-19

page/Geolocation.cpp in WebCore in WebKit before r56188 and before 1.2.5 does not properly restrict access to the lastPosition function, which has unspecified impact and remote attack vectors, aka rdar problem 7746357.

CVEs:CVE-2010-1386

Affected products

ProductStatusVendorPackageEcosystem
webkit affected apple — —
Upstream advisory

CVE-2010-2973

iOSEPSS <= 49%HIGH2010-08-04

Integer overflow in IOSurface in Apple iOS before 4.0.2 on the iPhone and iPod touch, and before 3.2.2 on the iPad, allows local users to gain privileges via vectors involving IOSurface properties, as demonstrated by JailbreakMe.

CVEs:CVE-2010-2973

Affected products

ProductStatusVendorPackageEcosystem
iphone_os affected apple — —
Upstream advisory

CVE-2010-1768

iOSEPSS <= 49%MEDIUM2010-08-20

Unspecified vulnerability in Apple iTunes before 9.1 allows local users to gain console privileges via vectors related to log files, "insecure file operation," and syncing an iPhone, iPad, or iPod touch.

CVEs:CVE-2010-1768

Affected products

ProductStatusVendorPackageEcosystem
itunes affected apple — —
Upstream advisory

CVE-2010-1794

macOSEPSS <= 49%MEDIUM2010-08-02

The webdav_mount function in webdav_vfsops.c in the WebDAV kernel extension (aka webdav_fs.kext) for Mac OS X 10.6 allows local users to cause a denial of service (panic) via a mount request with a large integer in the pa_socket_namelen field.

CVEs:CVE-2010-1794

Affected products

ProductStatusVendorPackageEcosystem
mac_os_x affected apple — —
Upstream advisory

Need live exploit intelligence?

Every CVE above is indexed in the Vulnetix VDB with KEV, EPSS, and PoC maturity. The interactive page surfaces that on hover.

All months Open Console