Every advisory below is enriched with the Vulnetix VDB exploit-intelligence chip (hover a CVE ID in the interactive page to see CVSS, EPSS, KEV status, and PoC maturity).
The advisories below are ordered by the Vulnetix risk prioritization strategy: exploitation evidence first, scores second. On the interactive page you can switch to three other lenses.
The extensions APIs in the kernel in Apple iOS before 6.0.1 provide kernel addresses in responses that contain an OSBundleMachOHeaders key, which makes it easier for remote attackers to bypass the ASLR protection mechanism via a crafted app.
CVEs:CVE-2012-3749
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| iphone_os | affected | apple | — | — |
Buffer overflow in the plugin in Apple QuickTime before 7.7.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted MIME type.
CVEs:CVE-2012-3753
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| quicktime | affected | apple | — | — |
CUPS 1.4.4, when running in certain Linux distributions such as Debian GNU/Linux, stores the web interface administrator key in /var/run/cups/certs/0 using certain permissions, which allows local users in the lpadmin group to read or write arbitrary fi...
CVEs:CVE-2012-5519
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| cups | affected | apple | — | — |
Multiple buffer overflows in Apple QuickTime before 7.7.3 allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted style element in a QuickTime TeXML file.
CVEs:CVE-2012-3752
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| quicktime | affected | apple | — | — |
Buffer overflow in Apple QuickTime before 7.7.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted Targa image.
CVEs:CVE-2012-3755
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| quicktime | affected | apple | — | — |
Buffer overflow in Apple QuickTime before 7.7.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted transform attribute in a text3GTrack element in a QuickTime TeXML file.
CVEs:CVE-2012-3758
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| quicktime | affected | apple | — | — |
Heap-based buffer underflow in the xmlParseAttValueComplex function in parser.c in libxml2 2.9.0 and earlier, as used in Google Chrome before 23.0.1271.91 and other products, allows remote attackers to cause a denial of service or possibly execute arbi...
CVEs:CVE-2012-5134
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| iphone_os | affected | apple | — | — |
Race condition in WebKit in Apple iOS before 6.0.1 and Safari before 6.0.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving JavaScript arrays.
CVEs:CVE-2012-3748
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| iphone_os | affected | apple | — | — |
| safari | affected | apple | — | — |
Buffer overflow in Apple QuickTime before 7.7.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted rnet box in an MP4 movie file.
CVEs:CVE-2012-3756
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| quicktime | affected | apple | — | — |
Buffer overflow in Apple QuickTime before 7.7.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted REGION record in a PICT file.
CVEs:CVE-2011-1374
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| quicktime | affected | apple | — | — |
Apple QuickTime before 7.7.3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted PICT file.
CVEs:CVE-2012-3757
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| quicktime | affected | apple | — | — |
Use-after-free vulnerability in the plugin in Apple QuickTime before 7.7.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via an HTML document with a crafted _qtactivex_ parameter in an OBJECT element.
CVEs:CVE-2012-3751
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| quicktime | affected | apple | — | — |
Use-after-free vulnerability in the Clear method in the ActiveX control in Apple QuickTime before 7.7.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors.
CVEs:CVE-2012-3754
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| quicktime | affected | apple | — | — |
html/parser/XSSAuditor.cpp in WebCore in WebKit, as used in Google Chrome through 22 and Safari 5.1.7, does not consider all possible output contexts of reflected data, which makes it easier for remote attackers to bypass a cross-site scripting (XSS) p...
CVEs:CVE-2012-5851
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| safari | affected | apple | — | — |
| webkit | affected | apple | — | — |
The Passcode Lock implementation in Apple iOS before 6.0.1 does not properly manage the lock state, which allows physically proximate attackers to bypass an intended passcode requirement and access Passbook passes via unspecified vectors.
CVEs:CVE-2012-3750
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| iphone_os | affected | apple | — | — |
Every CVE above is indexed in the Vulnetix VDB with KEV, EPSS, and PoC maturity. The interactive page surfaces that on hover.