CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register   Reset Password   Activate Account
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Apple : Security Vulnerabilities (CVSS score between 7 and 7.99)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2016-4073 119 DoS Exec Code Overflow 2016-05-20 2016-05-24
7.5
None Remote Low Not required Partial Partial Partial
Multiple integer overflows in the mbfl_strcut function in ext/mbstring/libmbfl/mbfl/mbfilter.c in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted mb_strcut call.
2 CVE-2016-4072 20 Exec Code 2016-05-20 2016-05-23
7.5
None Remote Low Not required Partial Partial Partial
The Phar extension in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allows remote attackers to execute arbitrary code via a crafted filename, as demonstrated by mishandling of \0 characters by the phar_analyze_path function in ext/phar/phar.c.
3 CVE-2016-4071 20 Exec Code 2016-05-20 2016-05-23
7.5
None Remote Low Not required Partial Partial Partial
Format string vulnerability in the php_snmp_error function in ext/snmp/snmp.c in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allows remote attackers to execute arbitrary code via format string specifiers in an SNMP::get call.
4 CVE-2016-1809 2016-05-20 2016-05-20
7.8
None Remote Low Not required Complete None None
Disk Utility in Apple OS X before 10.11.5 uses incorrect encryption keys for disk images, which has unspecified impact and attack vectors.
5 CVE-2016-1771 19 DoS 2016-03-23 2016-03-25
7.1
None Remote Medium Not required None None Complete
The Downloads feature in Apple Safari before 9.1 mishandles file expansion, which allows remote attackers to cause a denial of service via a crafted web site.
6 CVE-2016-1742 264 +Priv 2016-05-20 2016-05-20
7.2
None Local Low Not required Complete Complete Complete
Untrusted search path vulnerability in the installer in Apple iTunes before 12.4 allows local users to gain privileges via a Trojan horse DLL in the current working directory.
7 CVE-2016-1738 254 Bypass 2016-03-23 2016-03-24
7.2
None Local Low Not required Complete Complete Complete
dyld in Apple OS X before 10.11.4 allows attackers to bypass a code-signing protection mechanism via a modified app.
8 CVE-2016-1734 119 DoS Exec Code Overflow Mem. Corr. 2016-03-23 2016-03-25
7.2
None Local Low Not required Complete Complete Complete
AppleUSBNetworking in Apple iOS before 9.3 and OS X before 10.11.4 allows physically proximate attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted USB device.
9 CVE-2016-1729 2016-02-01 2016-02-16
7.5
None Remote Low Not required Partial Partial Partial
Untrusted search path vulnerability in OSA Scripts in Apple OS X before 10.11.3 allows attackers to load arbitrary script libraries via a quarantined application.
10 CVE-2016-1722 119 DoS Overflow +Priv Mem. Corr. 2016-02-01 2016-03-29
7.2
None Local Low Not required Complete Complete Complete
syslog in Apple iOS before 9.2.1, OS X before 10.11.3, and tvOS before 9.1.1 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
11 CVE-2016-1721 119 DoS Overflow +Priv Mem. Corr. 2016-02-01 2016-03-29
7.2
None Local Low Not required Complete Complete Complete
The kernel in Apple iOS before 9.2.1, OS X before 10.11.3, and tvOS before 9.1.1 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
12 CVE-2016-1720 119 DoS Overflow +Priv Mem. Corr. 2016-02-01 2016-03-29
7.2
None Local Low Not required Complete Complete Complete
IOKit in Apple iOS before 9.2.1, OS X before 10.11.3, and tvOS before 9.1.1 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
13 CVE-2016-1719 119 DoS Overflow +Priv Mem. Corr. 2016-02-01 2016-03-29
7.2
None Local Low Not required Complete Complete Complete
The IOHIDFamily API in Apple iOS before 9.2.1, OS X before 10.11.3, and tvOS before 9.1.1 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
14 CVE-2016-1717 119 DoS Overflow +Priv Mem. Corr. 2016-02-01 2016-03-29
7.2
None Local Low Not required Complete Complete Complete
The Disk Images component in Apple iOS before 9.2.1, OS X before 10.11.3, and tvOS before 9.1.1 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
15 CVE-2016-1716 119 DoS Overflow +Priv Mem. Corr. 2016-02-01 2016-02-08
7.2
None Local Low Not required Complete Complete Complete
AppleGraphicsPowerManagement in Apple OS X before 10.11.3 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
16 CVE-2015-8865 119 DoS Exec Code Overflow 2016-05-20 2016-05-24
7.5
None Remote Low Not required Partial Partial Partial
The file_check_mem function in funcs.c in file before 5.23, as used in the Fileinfo component in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5, mishandles continuation-level jumps, which allows context-dependent attackers to cause a denial of service (buffer overflow and application crash) or possibly execute arbitrary code via a crafted magic file.
17 CVE-2015-8472 119 DoS Overflow 2016-01-21 2016-03-29
7.5
None Remote Low Not required Partial Partial Partial
Buffer overflow in the png_set_PLTE function in libpng before 1.0.65, 1.1.x and 1.2.x before 1.2.55, 1.3.x, 1.4.x before 1.4.18, 1.5.x before 1.5.25, and 1.6.x before 1.6.20 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-8126.
18 CVE-2015-8126 119 DoS Overflow 2015-11-12 2016-03-29
7.5
None Remote Low Not required Partial Partial Partial
Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image.
19 CVE-2015-7108 119 DoS Overflow +Priv Mem. Corr. 2015-12-11 2015-12-11
7.2
Admin Local Low Not required Complete Complete Complete
The Bluetooth HCI interface in Apple OS X before 10.11.2 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
20 CVE-2015-7106 119 DoS Overflow +Priv Mem. Corr. 2015-12-11 2015-12-11
7.2
Admin Local Low Not required Complete Complete Complete
The Intel Graphics Driver component in Apple OS X before 10.11.2 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
21 CVE-2015-7084 119 DoS Overflow +Priv Mem. Corr. 2015-12-11 2015-12-11
7.2
None Local Low Not required Complete Complete Complete
The kernel in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-7083.
22 CVE-2015-7083 119 DoS Overflow +Priv Mem. Corr. 2015-12-11 2015-12-11
7.2
None Local Low Not required Complete Complete Complete
The kernel in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-7084.
23 CVE-2015-7078 +Priv 2015-12-11 2015-12-11
7.2
None Local Low Not required Complete Complete Complete
Use-after-free vulnerability in Hypervisor in Apple OS X before 10.11.2 allows local users to gain privileges via vectors involving VM objects.
24 CVE-2015-7077 119 DoS Overflow +Priv 2015-12-11 2015-12-11
7.2
None Local Low Not required Complete Complete Complete
The Intel Graphics Driver component in Apple OS X before 10.11.2 allows local users to gain privileges or cause a denial of service (out-of-bounds memory access) via unspecified vectors.
25 CVE-2015-7076 DoS +Priv 2015-12-11 2015-12-11
7.2
None Local Low Not required Complete Complete Complete
The Intel Graphics Driver component in Apple OS X before 10.11.2 allows local users to gain privileges or cause a denial of service (NULL pointer dereference) via unspecified vectors.
26 CVE-2015-7063 264 +Priv 2015-12-11 2015-12-11
7.2
Admin Local Low Not required Complete Complete Complete
The kernel loader in EFI in Apple OS X before 10.11.2 allows local users to gain privileges via a crafted pathname.
27 CVE-2015-7052 264 +Priv 2015-12-11 2015-12-11
7.2
Admin Local Low Not required Complete Complete Complete
kext tools in Apple OS X before 10.11.2 mishandles kernel-extension loading, which allows local users to gain privileges via unspecified vectors.
28 CVE-2015-7047 20 +Priv 2015-12-11 2015-12-11
7.2
Admin Local Low Not required Complete Complete Complete
The kernel in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows local users to gain privileges via a crafted mach message that is misparsed.
29 CVE-2015-7044 254 Exec Code 2015-12-11 2015-12-11
7.6
None Remote High Not required Complete Complete Complete
The System Integrity Protection feature in Apple OS X before 10.11.2 mishandles union mounts, which allows attackers to execute arbitrary code in a privileged context via a crafted app with root privileges.
30 CVE-2015-7036 20 DoS Exec Code 2015-11-21 2015-11-23
7.5
None Remote Low Not required Partial Partial Partial
The fts3_tokenizer function in SQLite, as used in Apple iOS before 8.4 and OS X before 10.10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a SQL command that triggers an API call with a crafted pointer value in the second argument.
31 CVE-2015-7035 17 2015-10-23 2015-10-23
7.5
None Remote Low Not required Partial Partial Partial
Apple Mac EFI before 2015-002, as used in OS X before 10.11.1 and other products, mishandles arguments, which allows attackers to reach "unused" functions via unspecified vectors.
32 CVE-2015-7030 17 2015-10-23 2015-10-23
7.5
None Remote Low Not required Partial Partial Partial
The Swift implementation in Apple Xcode before 7.1 mishandles type conversion, which has unspecified impact and attack vectors.
33 CVE-2015-7021 119 DoS Overflow +Priv Mem. Corr. 2015-10-23 2015-10-26
7.2
None Local Low Not required Complete Complete Complete
The Graphics Drivers subsystem in Apple OS X before 10.11.1 allows local users to gain privileges or cause a denial of service (kernel memory corruption) via unspecified vectors.
34 CVE-2015-7017 119 DoS Exec Code Overflow Mem. Corr. 2015-10-23 2015-10-23
7.5
None Remote Low Not required Partial Partial Partial
CoreText in Apple iOS before 9.1, OS X before 10.11.1, and iTunes before 12.3.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-6975 and CVE-2015-6992.
35 CVE-2015-7016 264 +Priv Bypass 2015-10-23 2015-10-26
7.6
None Remote High Not required Complete Complete Complete
The MCX Application Restrictions component in Apple OS X before 10.11.1, when Managed Configuration is enabled, mishandles provisioning profiles, which allows attackers to bypass intended entitlement restrictions and gain privileges via a crafted developer-signed app.
36 CVE-2015-7007 Bypass 2015-10-23 2015-10-26
7.5
None Remote Low Not required Partial Partial Partial
Script Editor in Apple OS X before 10.11.1 allows remote attackers to bypass an intended user-confirmation requirement for AppleScript execution via unspecified vectors.
37 CVE-2015-7004 20 DoS 2015-10-23 2015-10-23
7.1
None Remote Medium Not required None None Complete
The kernel in Apple iOS before 9.1 allows attackers to cause a denial of service via a crafted app.
38 CVE-2015-6994 399 DoS 2015-10-23 2015-10-26
7.1
None Remote Medium Not required None None Complete
The kernel in Apple iOS before 9.1 and OS X before 10.11.1 mishandles reuse of virtual memory, which allows attackers to cause a denial of service via a crafted app.
39 CVE-2015-6992 119 DoS Exec Code Overflow Mem. Corr. 2015-10-23 2015-10-23
7.5
None Remote Low Not required Partial Partial Partial
CoreText in Apple iOS before 9.1, OS X before 10.11.1, and iTunes before 12.3.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-6975 and CVE-2015-7017.
40 CVE-2015-6980 264 +Priv 2016-01-11 2016-01-11
7.2
Admin Local Low Not required Complete Complete Complete
Directory Utility in Apple OS X before 10.11.1 mishandles authentication for new sessions, which allows local users to gain privileges via unspecified vectors.
41 CVE-2015-6975 119 DoS Exec Code Overflow Mem. Corr. 2015-10-23 2015-10-23
7.5
None Remote Low Not required Partial Partial Partial
CoreText in Apple iOS before 9.1, OS X before 10.11.1, and iTunes before 12.3.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-6992 and CVE-2015-7017.
42 CVE-2015-5986 20 DoS 2015-09-04 2016-04-01
7.1
None Remote Medium Not required None None Complete
openpgpkey_61.c in named in ISC BIND 9.9.7 before 9.9.7-P3 and 9.10.x before 9.10.2-P4 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via a crafted DNS response.
43 CVE-2015-5945 20 +Priv 2015-10-23 2015-10-26
7.2
None Local Low Not required Complete Complete Complete
The Sandbox subsystem in Apple OS X before 10.11.1 allows local users to gain privileges via vectors involving NVRAM parameters.
44 CVE-2015-5932 +Priv 2015-10-23 2015-10-26
7.2
None Local Low Not required Complete Complete Complete
The kernel in Apple OS X before 10.11.1 allows local users to gain privileges by leveraging an unspecified "type confusion" during Mach task processing.
45 CVE-2015-5919 119 DoS Overflow +Priv Mem. Corr. 2015-10-09 2015-10-09
7.2
None Local Low Not required Complete Complete Complete
GasGauge in Apple watchOS before 2 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5918.
46 CVE-2015-5918 119 DoS Overflow +Priv Mem. Corr. 2015-10-09 2015-10-09
7.2
None Local Low Not required Complete Complete Complete
GasGauge in Apple watchOS before 2 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5919.
47 CVE-2015-5900 254 DoS 2015-10-09 2015-10-09
7.1
None Remote Medium Not required None None Complete
The protected range register in the EFI component in Apple OS X before 10.11 has an incorrect value, which allows attackers to cause a denial of service (boot failure) via a crafted app that writes to an unintended address.
48 CVE-2015-5899 119 DoS Overflow +Priv Mem. Corr. 2015-09-18 2015-10-09
7.2
None Local Low Not required Complete Complete Complete
libpthread in the kernel in Apple iOS before 9 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
49 CVE-2015-5896 119 DoS Overflow +Priv Mem. Corr. 2015-09-18 2015-10-09
7.2
None Local Low Not required Complete Complete Complete
The kernel in Apple iOS before 9 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5868 and CVE-2015-5903.
50 CVE-2015-5891 119 DoS Overflow +Priv Mem. Corr. 2015-10-09 2015-10-09
7.2
None Local Low Not required Complete Complete Complete
The SMB implementation in the kernel in Apple OS X before 10.11 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
Total number of vulnerabilities : 567   Page : 1 (This Page)2 3 4 5 6 7 8 9 10 11 12
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.