Vulnetix
Try Vulnetix Request Demo
Apple Security Advisories · June 2011 — Apple Security Advisories
26 advisories 26 CVEs 1 EXPLOITED

Apple-vendor CVEs for 2011-06. Mirrored into Vulnetix VDB.

Every advisory below is enriched with the Vulnetix VDB exploit-intelligence chip (hover a CVE ID in the interactive page to see CVSS, EPSS, KEV status, and PoC maturity). 1 is already weaponised in the wild — see the Exploited section.

Back to archive Open Console

What would you fix first?

The advisories below are ordered by the Vulnetix risk prioritization strategy: exploitation evidence first, scores second. On the interactive page you can switch to three other lenses.

How Vulnetix ranks risk Get a free API key

Advisories

CVE-2011-1752

OtherExploitedVulnCheck KEV listedCRITICAL2011-06-02

The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion before 1.6.17, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a request for a baselined WebDAV resource, as exp...

CVEs:CVE-2011-1752

Affected products

ProductStatusVendorPackageEcosystem
mac_os_x affected apple — —
Upstream advisory

CVE-2011-0200

macOSPoC exploitCRITICAL2011-06-24

Integer overflow in ColorSync in Apple Mac OS X before 10.6.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via an image containing a crafted embedded ColorSync profile that triggers a heap-based buf...

CVEs:CVE-2011-0200

Affected products

ProductStatusVendorPackageEcosystem
mac_os_x affected apple — —
mac_os_x_server affected apple — —
Upstream advisory

CVE-2011-0204

macOSPoC exploitCRITICAL2011-06-24

Heap-based buffer overflow in ImageIO in Apple Mac OS X before 10.6.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted TIFF image.

CVEs:CVE-2011-0204

Affected products

ProductStatusVendorPackageEcosystem
imageio affected apple — —
mac_os_x affected apple — —
mac_os_x_server affected apple — —
Upstream advisory

CVE-2011-0208

macOSPoC exploitCRITICAL2011-06-24

QuickLook in Apple Mac OS X 10.6 before 10.6.8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted Microsoft Office document.

CVEs:CVE-2011-0208

Affected products

ProductStatusVendorPackageEcosystem
mac_os_x affected apple — —
mac_os_x_server affected apple — —
Upstream advisory

CVE-2011-2192

OtherPoC exploitMEDIUM2011-06-24

The Curl_input_negotiate function in http_negotiate.c in libcurl 7.10.6 through 7.21.6, as used in curl and other products, always performs credential delegation during GSSAPI authentication, which allows remote servers to impersonate clients via GSSAP...

CVEs:CVE-2011-2192

Affected products

ProductStatusVendorPackageEcosystem
mac_os_x affected apple — —
Upstream advisory

CVE-2011-0201

macOSPoC exploitCRITICAL2011-06-24

Off-by-one error in the CoreFoundation framework in Apple Mac OS X before 10.6.8 allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via a CFString object that triggers a buffer overflow.

CVEs:CVE-2011-0201

Affected products

ProductStatusVendorPackageEcosystem
mac_os_x affected apple — —
mac_os_x_server affected apple — —
Upstream advisory

CVE-2011-0202

macOSPoC exploitCRITICAL2011-06-24

Integer overflow in CoreGraphics in Apple Mac OS X before 10.6.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted embedded Type 1 font in a PDF document.

CVEs:CVE-2011-0202

Affected products

ProductStatusVendorPackageEcosystem
mac_os_x affected apple — —
mac_os_x_server affected apple — —
Upstream advisory

CVE-2009-5044

OtherPoC exploitMEDIUM2011-06-24

contrib/pdfmark/pdfroff.sh in GNU troff (aka groff) before 1.21 allows local users to overwrite arbitrary files via a symlink attack on a pdf#####.tmp temporary file.

CVEs:CVE-2009-5044

Affected products

ProductStatusVendorPackageEcosystem
mac_os_x affected apple — —
Upstream advisory

CVE-2011-0198

macOSEPSS <= 49%CRITICAL2011-06-24

Heap-based buffer overflow in Apple Type Services (ATS) in Apple Mac OS X before 10.6.8 allows remote attackers to execute arbitrary code via a crafted embedded TrueType font.

CVEs:CVE-2011-0198

Affected products

ProductStatusVendorPackageEcosystem
mac_os_x affected apple — —
mac_os_x_server affected apple — —
Upstream advisory

CVE-2011-0205

macOSEPSS <= 49%CRITICAL2011-06-24

Heap-based buffer overflow in ImageIO in Apple Mac OS X before 10.6.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted JPEG2000 image.

CVEs:CVE-2011-0205

Affected products

ProductStatusVendorPackageEcosystem
imageio affected apple — —
mac_os_x affected apple — —
mac_os_x_server affected apple — —
Upstream advisory

CVE-2011-1755

OtherEPSS <= 49%HIGH2011-06-21

jabberd2 before 2.2.14 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references,...

CVEs:CVE-2011-1755

Affected products

ProductStatusVendorPackageEcosystem
mac_os_x affected apple — —
mac_os_x_server affected apple — —
Upstream advisory

CVE-2011-0213

macOSEPSS <= 49%CRITICAL2011-06-24

Buffer overflow in QuickTime in Apple Mac OS X before 10.6.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted JPEG file.

CVEs:CVE-2011-0213

Affected products

ProductStatusVendorPackageEcosystem
mac_os_x affected apple — —
quicktime affected apple — —
Upstream advisory

CVE-2011-0206

macOSEPSS <= 49%CRITICAL2011-06-24

Buffer overflow in International Components for Unicode (ICU) in Apple Mac OS X before 10.6.8 allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving uppercase strings.

CVEs:CVE-2011-0206

Affected products

ProductStatusVendorPackageEcosystem
mac_os_x affected apple — —
mac_os_x_server affected apple — —
Upstream advisory

CVE-2011-0209

macOSEPSS <= 49%CRITICAL2011-06-24

Integer overflow in QuickTime in Apple Mac OS X before 10.6.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted RIFF WAV file.

CVEs:CVE-2011-0209

Affected products

ProductStatusVendorPackageEcosystem
mac_os_x affected apple — —
quicktime affected apple — —
Upstream advisory

CVE-2011-0211

macOSEPSS <= 49%CRITICAL2011-06-24

Integer overflow in QuickTime in Apple Mac OS X before 10.6.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file.

CVEs:CVE-2011-0211

Affected products

ProductStatusVendorPackageEcosystem
mac_os_x affected apple — —
quicktime affected apple — —
Upstream advisory

CVE-2011-0210

macOSEPSS <= 49%CRITICAL2011-06-24

QuickTime in Apple Mac OS X before 10.6.8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via crafted sample tables in a movie file.

CVEs:CVE-2011-0210

Affected products

ProductStatusVendorPackageEcosystem
mac_os_x affected apple — —
quicktime affected apple — —
Upstream advisory

CVE-2011-0212

macOSEPSS <= 49%HIGH2011-06-24

servermgrd in Apple Mac OS X before 10.6.8 allows remote attackers to read arbitrary files, and possibly send HTTP requests to intranet servers or cause a denial of service (CPU and memory consumption), via an XML-RPC request containing an entity decla...

CVEs:CVE-2011-0212

Affected products

ProductStatusVendorPackageEcosystem
mac_os_x_server affected apple — —
Upstream advisory

CVE-2009-5078

OtherEPSS <= 49%MEDIUM2011-06-30

contrib/pdfmark/pdfroff.sh in GNU troff (aka groff) before 1.21 launches the Ghostscript program without the -dSAFER option, which allows remote attackers to create, overwrite, rename, or delete arbitrary files via a crafted document.

CVEs:CVE-2009-5078

Affected products

ProductStatusVendorPackageEcosystem
mac_os_x affected apple — —
Upstream advisory

CVE-2011-0203

macOSEPSS <= 49%HIGH2011-06-24

Absolute path traversal vulnerability in xftpd in the FTP Server component in Apple Mac OS X before 10.6.8 allows remote attackers to list arbitrary directories by using the root directory as the starting point of a recursive listing.

CVEs:CVE-2011-0203

Affected products

ProductStatusVendorPackageEcosystem
mac_os_x_server affected apple — —
Upstream advisory

CVE-2011-0207

macOSEPSS <= 49%MEDIUM2011-06-24

The MobileMe component in Apple Mac OS X before 10.6.8 uses a cleartext HTTP session for the Mail application to read e-mail aliases, which allows remote attackers to obtain potentially sensitive alias information by sniffing the network.

CVEs:CVE-2011-0207

Affected products

ProductStatusVendorPackageEcosystem
mac_os_x affected apple — —
mac_os_x_server affected apple — —
Upstream advisory

CVE-2011-0196

macOSEPSS <= 49%HIGH2011-06-24

AirPort in Apple Mac OS X 10.5.8 allows remote attackers to cause a denial of service (out-of-bounds read and reboot) via Wi-Fi frames on the local wireless network.

CVEs:CVE-2011-0196

Affected products

ProductStatusVendorPackageEcosystem
mac_os_x affected apple — —
mac_os_x_server affected apple — —
Upstream advisory

CVE-2011-2601

macOSEPSS <= 49%HIGH2011-06-30

The GPU support functionality in Mac OS X does not properly restrict rendering time, which allows remote attackers to cause a denial of service (desktop hang) via vectors involving WebGL and (1) shader programs or (2) complex 3D geometry, as demonstrat...

CVEs:CVE-2011-2601

Affected products

ProductStatusVendorPackageEcosystem
mac_os_x affected apple — —
Upstream advisory

CVE-2011-2351

OtherEPSS <= 49%CRITICAL2011-06-29

Use-after-free vulnerability in Google Chrome before 12.0.742.112 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving SVG use elements.

CVEs:CVE-2011-2351

Affected products

ProductStatusVendorPackageEcosystem
iphone_os affected apple — —
itunes affected apple — —
safari affected apple — —
Upstream advisory

CVE-2011-0199

macOSEPSS <= 49%MEDIUM2011-06-24

The Certificate Trust Policy component in Apple Mac OS X before 10.6.8 does not perform CRL checking for Extended Validation (EV) certificates that lack OCSP URLs, which might allow man-in-the-middle attackers to spoof an SSL server via a revoked certi...

CVEs:CVE-2011-0199

Affected products

ProductStatusVendorPackageEcosystem
mac_os_x affected apple — —
mac_os_x_server affected apple — —
Upstream advisory

CVE-2011-1132

macOSEPSS <= 49%MEDIUM2011-06-24

The IPv6 implementation in the kernel in Apple Mac OS X before 10.6.8 allows local users to cause a denial of service (NULL pointer dereference and reboot) via vectors involving socket options.

CVEs:CVE-2011-1132

Affected products

ProductStatusVendorPackageEcosystem
mac_os_x affected apple — —
mac_os_x_server affected apple — —
Upstream advisory

CVE-2011-0197

macOSEPSS <= 49%MEDIUM2011-06-24

App Store in Apple Mac OS X before 10.6.8 creates a log entry containing a user's AppleID password, which might allow local users to obtain sensitive information by reading a log file, as demonstrated by a log file that has non-default permissions.

CVEs:CVE-2011-0197

Affected products

ProductStatusVendorPackageEcosystem
mac_os_x affected apple — —
mac_os_x_server affected apple — —
Upstream advisory

Need live exploit intelligence?

Every CVE above is indexed in the Vulnetix VDB with KEV, EPSS, and PoC maturity. The interactive page surfaces that on hover.

All months Open Console