Vulnetix
Try Vulnetix Request Demo
Apple Security Advisories · May 2012 — Apple Security Advisories
31 advisories 31 CVEs 1 EXPLOITED

Apple-vendor CVEs for 2012-05. Mirrored into Vulnetix VDB.

Every advisory below is enriched with the Vulnetix VDB exploit-intelligence chip (hover a CVE ID in the interactive page to see CVSS, EPSS, KEV status, and PoC maturity). 1 is already weaponised in the wild — see the Exploited section.

Back to archive Open Console

What would you fix first?

The advisories below are ordered by the Vulnetix risk prioritization strategy: exploitation evidence first, scores second. On the interactive page you can switch to three other lenses.

How Vulnetix ranks risk Get a free API key

Advisories

CVE-2012-1823

OtherExploitedCISA KEV listedCRITICAL2012-05-03

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by pl...

CVEs:CVE-2012-1823

Affected products

ProductStatusVendorPackageEcosystem
mac_os_x affected apple — —
Upstream advisory

CVE-2012-0663

OtherActive exploitation (sightings)HIGH2012-05-15

Multiple stack-based buffer overflows in Apple QuickTime before 7.7.2 on Windows allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted TeXML file.

CVEs:CVE-2012-0663

Affected products

ProductStatusVendorPackageEcosystem
quicktime affected apple — —
Upstream advisory

CVE-2012-0671

OtherPoC exploitHIGH2012-05-16

Apple QuickTime before 7.7.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted .pict file.

CVEs:CVE-2012-0671

Affected products

ProductStatusVendorPackageEcosystem
quicktime affected apple — —
Upstream advisory

CVE-2011-3102

OtherPoC exploitCRITICAL2012-05-15

Off-by-one error in libxml2, as used in Google Chrome before 19.0.1084.46 and other products, allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via unknown vectors.

CVEs:CVE-2011-3102

Affected products

ProductStatusVendorPackageEcosystem
iphone_os affected apple — —
Upstream advisory

CVE-2012-0664

OtherEPSS <= 49%HIGH2012-05-16

Heap-based buffer overflow in Apple QuickTime before 7.7.2 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted text track in a movie file.

CVEs:CVE-2012-0664

Affected products

ProductStatusVendorPackageEcosystem
quicktime affected apple — —
Upstream advisory

CVE-2012-0669

OtherEPSS <= 49%HIGH2012-05-16

Buffer overflow in Apple QuickTime before 7.7.2 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file with Sorenson encoding.

CVEs:CVE-2012-0669

Affected products

ProductStatusVendorPackageEcosystem
quicktime affected apple — —
Upstream advisory

CVE-2012-0265

OtherEPSS <= 49%HIGH2012-05-16

Stack-based buffer overflow in Apple QuickTime before 7.7.2 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted pathname for a file.

CVEs:CVE-2012-0265

Affected products

ProductStatusVendorPackageEcosystem
quicktime affected apple — —
Upstream advisory

CVE-2012-0670

OtherEPSS <= 49%HIGH2012-05-16

Integer overflow in Apple QuickTime before 7.7.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted sean atom in a movie file.

CVEs:CVE-2012-0670

Affected products

ProductStatusVendorPackageEcosystem
quicktime affected apple — —
Upstream advisory

CVE-2012-0668

OtherEPSS <= 49%HIGH2012-05-16

Buffer overflow in Apple QuickTime before 7.7.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file with RLE encoding.

CVEs:CVE-2012-0668

Affected products

ProductStatusVendorPackageEcosystem
quicktime affected apple — —
Upstream advisory

CVE-2012-0665

OtherEPSS <= 49%HIGH2012-05-16

Heap-based buffer overflow in Apple QuickTime before 7.7.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file with H.264 encoding.

CVEs:CVE-2012-0665

Affected products

ProductStatusVendorPackageEcosystem
quicktime affected apple — —
Upstream advisory

CVE-2012-0666

OtherEPSS <= 49%HIGH2012-05-16

Stack-based buffer overflow in the plugin in Apple QuickTime before 7.7.2 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted QTMovie object.

CVEs:CVE-2012-0666

Affected products

ProductStatusVendorPackageEcosystem
quicktime affected apple — —
Upstream advisory

CVE-2012-0658

macOSEPSS <= 49%CRITICAL2012-05-10

Buffer overflow in QuickTime in Apple Mac OS X before 10.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted audio sample tables in a movie file that is progressively downloaded.

CVEs:CVE-2012-0658

Affected products

ProductStatusVendorPackageEcosystem
mac_os_x affected apple — —
mac_os_x_server affected apple — —
Upstream advisory

CVE-2012-0667

OtherEPSS <= 49%HIGH2012-05-16

Integer signedness error in Apple QuickTime before 7.7.2 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted QTVR movie file.

CVEs:CVE-2012-0667

Affected products

ProductStatusVendorPackageEcosystem
quicktime affected apple — —
Upstream advisory

CVE-2012-0662

macOSEPSS <= 49%CRITICAL2012-05-10

Integer overflow in the Security Framework in Apple Mac OS X before 10.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via crafted input.

CVEs:CVE-2012-0662

Affected products

ProductStatusVendorPackageEcosystem
mac_os_x affected apple — —
mac_os_x_server affected apple — —
Upstream advisory

CVE-2012-0659

macOSEPSS <= 49%CRITICAL2012-05-10

Integer overflow in QuickTime in Apple Mac OS X before 10.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted MPEG file.

CVEs:CVE-2012-0659

Affected products

ProductStatusVendorPackageEcosystem
mac_os_x affected apple — —
mac_os_x_server affected apple — —
Upstream advisory

CVE-2012-0661

macOSEPSS <= 49%CRITICAL2012-05-10

Use-after-free vulnerability in QuickTime in Apple Mac OS X 10.7.x before 10.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file with JPEG2000 encoding.

CVEs:CVE-2012-0661

Affected products

ProductStatusVendorPackageEcosystem
mac_os_x affected apple — —
mac_os_x_server affected apple — —
Upstream advisory

CVE-2011-3081

OtherEPSS <= 49%HIGH2012-05-01

Use-after-free vulnerability in Google Chrome before 18.0.1025.168 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the floating of elements, a different vulnerability than CVE-2011-3...

CVEs:CVE-2011-3081

Affected products

ProductStatusVendorPackageEcosystem
iphone_os affected apple — —
itunes affected apple — —
safari affected apple — —
Upstream advisory

CVE-2012-0660

macOSEPSS <= 49%CRITICAL2012-05-10

Buffer underflow in QuickTime in Apple Mac OS X before 10.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted MPEG file.

CVEs:CVE-2012-0660

Affected products

ProductStatusVendorPackageEcosystem
mac_os_x affected apple — —
mac_os_x_server affected apple — —
Upstream advisory

CVE-2012-0672

iOSEPSS <= 49%CRITICAL2012-05-07

WebKit in Apple iOS before 5.1.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.

CVEs:CVE-2012-0672

Affected products

ProductStatusVendorPackageEcosystem
iphone_os affected apple — —
Upstream advisory

CVE-2011-3078

OtherEPSS <= 49%CRITICAL2012-05-01

Use-after-free vulnerability in Google Chrome before 18.0.1025.168 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the floating of elements, a different vulnerability than CVE-2011-3...

CVEs:CVE-2011-3078

Affected products

ProductStatusVendorPackageEcosystem
iphone_os affected apple — —
itunes affected apple — —
safari affected apple — —
Upstream advisory

CVE-2012-1521

OtherEPSS <= 49%CRITICAL2012-05-01

Use-after-free vulnerability in the XML parser in Google Chrome before 18.0.1025.168 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

CVEs:CVE-2012-1521

Affected products

ProductStatusVendorPackageEcosystem
iphone_os affected apple — —
itunes affected apple — —
safari affected apple — —
Upstream advisory

CVE-2012-0676

SafariEPSS <= 49%MEDIUM2012-05-10

WebKit in Apple Safari before 5.1.7 does not properly track state information during the processing of form input, which allows remote attackers to fill in form fields on the pages of arbitrary web sites via unspecified vectors.

CVEs:CVE-2012-0676

Affected products

ProductStatusVendorPackageEcosystem
safari affected apple — —
Upstream advisory

CVE-2012-0651

macOSEPSS <= 49%HIGH2012-05-10

The directory server in Directory Service in Apple Mac OS X 10.6.8 allows remote attackers to obtain sensitive information from process memory via a crafted message.

CVEs:CVE-2012-0651

Affected products

ProductStatusVendorPackageEcosystem
mac_os_x affected apple — —
mac_os_x_server affected apple — —
Upstream advisory

CVE-2012-0654

macOSEPSS <= 49%CRITICAL2012-05-10

libsecurity in Apple Mac OS X before 10.7.4 accesses uninitialized memory locations during the processing of X.509 certificates, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted cert...

CVEs:CVE-2012-0654

Affected products

ProductStatusVendorPackageEcosystem
mac_os_x affected apple — —
mac_os_x_server affected apple — —
Upstream advisory

CVE-2012-0675

macOSEPSS <= 49%MEDIUM2012-05-10

Time Machine in Apple Mac OS X before 10.7.4 does not require continued use of SRP-based authentication after this authentication method is first used, which allows remote attackers to read Time Capsule credentials by spoofing the backup volume.

CVEs:CVE-2012-0675

Affected products

ProductStatusVendorPackageEcosystem
mac_os_x affected apple — —
mac_os_x_server affected apple — —
Upstream advisory

CVE-2012-0674

iOSEPSS <= 49%MEDIUM2012-05-08

Safari in Apple iOS before 5.1.1 allows remote attackers to spoof the location bar's URL via a crafted web site.

CVEs:CVE-2012-0674

Affected products

ProductStatusVendorPackageEcosystem
iphone_os affected apple — —
Upstream advisory

CVE-2012-0655

macOSEPSS <= 49%MEDIUM2012-05-10

libsecurity in Apple Mac OS X before 10.7.4 does not properly restrict the length of RSA keys within X.509 certificates, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by conducting a spoofing or network-sniffi...

CVEs:CVE-2012-0655

Affected products

ProductStatusVendorPackageEcosystem
mac_os_x affected apple — —
mac_os_x_server affected apple — —
Upstream advisory

CVE-2012-0657

macOSEPSS <= 49%LOW2012-05-10

Quartz Composer in Apple Mac OS X before 10.7.4, when the RSS Visualizer screensaver is enabled, allows physically proximate attackers to bypass screen locking and launch a Safari process via unspecified vectors.

CVEs:CVE-2012-0657

Affected products

ProductStatusVendorPackageEcosystem
mac_os_x affected apple — —
mac_os_x_server affected apple — —
Upstream advisory

CVE-2012-0652

macOSEPSS <= 49%MEDIUM2012-05-10

Login Window in Apple Mac OS X 10.7.3, when Legacy File Vault or networked home directories are enabled, does not properly restrict what is written to the system log for network logins, which allows local users to obtain sensitive information by readin...

CVEs:CVE-2012-0652

Affected products

ProductStatusVendorPackageEcosystem
mac_os_x affected apple — —
Upstream advisory

CVE-2012-0656

macOSEPSS <= 49%MEDIUM2012-05-10

Race condition in LoginUIFramework in Apple Mac OS X 10.7.x before 10.7.4, when the Guest account is enabled, allows physically proximate attackers to login to arbitrary accounts by entering the account name and no password.

CVEs:CVE-2012-0656

Affected products

ProductStatusVendorPackageEcosystem
mac_os_x affected apple — —
Upstream advisory

CVE-2012-0649

macOSEPSS <= 49%MEDIUM2012-05-10

Race condition in the initialization routine in blued in Bluetooth in Apple Mac OS X before 10.7.4 allows local users to gain privileges via vectors involving a temporary file.

CVEs:CVE-2012-0649

Affected products

ProductStatusVendorPackageEcosystem
mac_os_x affected apple — —
mac_os_x_server affected apple — —
Upstream advisory

Need live exploit intelligence?

Every CVE above is indexed in the Vulnetix VDB with KEV, EPSS, and PoC maturity. The interactive page surfaces that on hover.

All months Open Console