CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Apple : Security Vulnerabilities (CVSS score between 7 and 7.99)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2016-4775 119 DoS Overflow +Priv Mem. Corr. 2016-09-25 2016-11-28
7.2
None Local Low Not required Complete Complete Complete
The kernel in Apple OS X before 10.12, tvOS before 10, and watchOS before 3 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
2 CVE-2016-4722 20 DoS 2016-09-25 2016-11-28
7.1
None Remote Medium Not required None None Complete
The IDS - Connectivity component in Apple iOS before 10 and OS X before 10.12 allows man-in-the-middle attackers to conduct Call Relay spoofing attacks and cause a denial of service via unspecified vectors.
3 CVE-2016-4716 264 +Priv 2016-09-25 2016-11-28
7.2
None Local Low Not required Complete Complete Complete
diskutil in DiskArbitration in Apple OS X before 10.12 allows local users to gain privileges via unspecified vectors.
4 CVE-2016-4710 704 2016-09-25 2016-11-28
7.2
None Local Low Not required Complete Complete Complete
WindowServer in Apple OS X before 10.12 allows local users to obtain root access via vectors that leverage "type confusion," a different vulnerability than CVE-2016-4709.
5 CVE-2016-4709 704 2016-09-25 2016-11-28
7.2
None Local Low Not required Complete Complete Complete
WindowServer in Apple OS X before 10.12 allows local users to obtain root access via vectors that leverage "type confusion," a different vulnerability than CVE-2016-4710.
6 CVE-2016-4705 119 DoS Overflow +Priv Mem. Corr. 2016-09-18 2016-11-28
7.2
None Local Low Not required Complete Complete Complete
otool in Apple Xcode before 8 allows local users to gain privileges or cause a denial of service (memory corruption and application crash) via unspecified vectors, a different vulnerability than CVE-2016-4704.
7 CVE-2016-4704 119 DoS Overflow +Priv Mem. Corr. 2016-09-18 2016-11-28
7.2
None Local Low Not required Complete Complete Complete
otool in Apple Xcode before 8 allows local users to gain privileges or cause a denial of service (memory corruption and application crash) via unspecified vectors, a different vulnerability than CVE-2016-4705.
8 CVE-2016-4694 284 2016-09-25 2016-11-28
7.5
None Remote Low Not required Partial Partial Partial
The Apache HTTP Server in Apple OS X before 10.12 and OS X Server before 5.2 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted CGI client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue, a related issue to CVE-2016-5387.
9 CVE-2016-4655 200 +Info 2016-08-25 2016-11-28
7.1
None Remote Medium Not required Complete None None
The kernel in Apple iOS before 9.3.5 allows attackers to obtain sensitive information from memory via a crafted app.
10 CVE-2016-4653 119 DoS Overflow +Priv Mem. Corr. 2016-07-21 2016-11-28
7.2
None Local Low Not required Complete Complete Complete
The kernel in Apple iOS before 9.3.3, OS X before 10.11.6, tvOS before 9.2.2, and watchOS before 2.2.2 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1863 and CVE-2016-4582.
11 CVE-2016-4647 119 DoS Overflow +Priv Mem. Corr. 2016-07-21 2016-11-28
7.2
None Local Low Not required Complete Complete Complete
Audio in Apple OS X before 10.11.6 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted file.
12 CVE-2016-4634 119 DoS Overflow +Priv Mem. Corr. 2016-07-21 2016-11-28
7.2
None Local Low Not required Complete Complete Complete
The Graphics Drivers subsystem in Apple OS X before 10.11.6 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
13 CVE-2016-4627 476 DoS +Priv 2016-07-21 2016-11-28
7.2
None Local Low Not required Complete Complete Complete
IOAcceleratorFamily in Apple iOS before 9.3.3, tvOS before 9.2.2, and watchOS before 2.2.2 allows local users to gain privileges or cause a denial of service (NULL pointer dereference) via unspecified vectors.
14 CVE-2016-4626 476 DoS +Priv 2016-07-21 2016-11-28
7.2
None Local Low Not required Complete Complete Complete
IOHIDFamily in Apple iOS before 9.3.3, OS X before 10.11.6, tvOS before 9.2.2, and watchOS before 2.2.2 allows local users to gain privileges or cause a denial of service (NULL pointer dereference) via unspecified vectors.
15 CVE-2016-4625 416 +Priv 2016-07-21 2016-11-28
7.2
None Local Low Not required Complete Complete Complete
Use-after-free vulnerability in IOSurface in Apple OS X before 10.11.6 allows local users to gain privileges via unspecified vectors.
16 CVE-2016-4605 476 DoS 2016-07-21 2016-11-28
7.1
None Remote Medium Not required None None Complete
Calendar in Apple iOS before 9.3.3 allows remote attackers to cause a denial of service (NULL pointer dereference and device restart) via a crafted invitation.
17 CVE-2016-4592 399 DoS 2016-07-21 2016-11-28
7.1
None Remote Medium Not required None None Complete
WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to cause a denial of service (memory consumption) via a crafted web site.
18 CVE-2016-4591 284 2016-07-21 2016-11-28
7.8
None Remote Low Not required Complete None None
WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 mishandles the location variable, which allows remote attackers to access the local filesystem via unspecified vectors.
19 CVE-2016-4582 119 DoS Overflow +Priv Mem. Corr. 2016-07-21 2016-11-28
7.2
None Local Low Not required Complete Complete Complete
The kernel in Apple iOS before 9.3.3, OS X before 10.11.6, tvOS before 9.2.2, and watchOS before 2.2.2 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1863 and CVE-2016-4653.
20 CVE-2016-4073 119 DoS Exec Code Overflow 2016-05-20 2016-12-02
7.5
None Remote Low Not required Partial Partial Partial
Multiple integer overflows in the mbfl_strcut function in ext/mbstring/libmbfl/mbfl/mbfilter.c in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted mb_strcut call.
21 CVE-2016-4072 20 Exec Code 2016-05-20 2016-11-30
7.5
None Remote Low Not required Partial Partial Partial
The Phar extension in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allows remote attackers to execute arbitrary code via a crafted filename, as demonstrated by mishandling of \0 characters by the phar_analyze_path function in ext/phar/phar.c.
22 CVE-2016-4071 20 Exec Code 2016-05-20 2016-11-30
7.5
None Remote Low Not required Partial Partial Partial
Format string vulnerability in the php_snmp_error function in ext/snmp/snmp.c in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allows remote attackers to execute arbitrary code via format string specifiers in an SNMP::get call.
23 CVE-2016-3141 119 DoS Overflow Mem. Corr. 2016-03-31 2016-12-02
7.5
None Remote Low Not required Partial Partial Partial
Use-after-free vulnerability in wddx.c in the WDDX extension in PHP before 5.5.33 and 5.6.x before 5.6.19 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact by triggering a wddx_deserialize call on XML data containing a crafted var element.
24 CVE-2016-1863 119 DoS Overflow +Priv Mem. Corr. 2016-07-21 2016-11-28
7.2
None Local Low Not required Complete Complete Complete
The kernel in Apple iOS before 9.3.3, OS X before 10.11.6, tvOS before 9.2.2, and watchOS before 2.2.2 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4582 and CVE-2016-4653.
25 CVE-2016-1809 2016-05-20 2016-11-30
7.8
None Remote Low Not required Complete None None
Disk Utility in Apple OS X before 10.11.5 uses incorrect encryption keys for disk images, which has unspecified impact and attack vectors.
26 CVE-2016-1771 19 DoS 2016-03-23 2016-12-02
7.1
None Remote Medium Not required None None Complete
The Downloads feature in Apple Safari before 9.1 mishandles file expansion, which allows remote attackers to cause a denial of service via a crafted web site.
27 CVE-2016-1742 264 +Priv 2016-05-20 2016-11-30
7.2
None Local Low Not required Complete Complete Complete
Untrusted search path vulnerability in the installer in Apple iTunes before 12.4 allows local users to gain privileges via a Trojan horse DLL in the current working directory.
28 CVE-2016-1738 254 Bypass 2016-03-23 2016-12-02
7.2
None Local Low Not required Complete Complete Complete
dyld in Apple OS X before 10.11.4 allows attackers to bypass a code-signing protection mechanism via a modified app.
29 CVE-2016-1734 119 DoS Exec Code Overflow Mem. Corr. 2016-03-23 2016-12-02
7.2
None Local Low Not required Complete Complete Complete
AppleUSBNetworking in Apple iOS before 9.3 and OS X before 10.11.4 allows physically proximate attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted USB device.
30 CVE-2016-1729 2016-02-01 2016-02-16
7.5
None Remote Low Not required Partial Partial Partial
Untrusted search path vulnerability in OSA Scripts in Apple OS X before 10.11.3 allows attackers to load arbitrary script libraries via a quarantined application.
31 CVE-2016-1722 119 DoS Overflow +Priv Mem. Corr. 2016-02-01 2016-03-29
7.2
None Local Low Not required Complete Complete Complete
syslog in Apple iOS before 9.2.1, OS X before 10.11.3, and tvOS before 9.1.1 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
32 CVE-2016-1721 119 DoS Overflow +Priv Mem. Corr. 2016-02-01 2016-03-29
7.2
None Local Low Not required Complete Complete Complete
The kernel in Apple iOS before 9.2.1, OS X before 10.11.3, and tvOS before 9.1.1 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
33 CVE-2016-1720 119 DoS Overflow +Priv Mem. Corr. 2016-02-01 2016-03-29
7.2
None Local Low Not required Complete Complete Complete
IOKit in Apple iOS before 9.2.1, OS X before 10.11.3, and tvOS before 9.1.1 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
34 CVE-2016-1719 119 DoS Overflow +Priv Mem. Corr. 2016-02-01 2016-03-29
7.2
None Local Low Not required Complete Complete Complete
The IOHIDFamily API in Apple iOS before 9.2.1, OS X before 10.11.3, and tvOS before 9.1.1 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
35 CVE-2016-1717 119 DoS Overflow +Priv Mem. Corr. 2016-02-01 2016-03-29
7.2
None Local Low Not required Complete Complete Complete
The Disk Images component in Apple iOS before 9.2.1, OS X before 10.11.3, and tvOS before 9.1.1 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
36 CVE-2016-1716 119 DoS Overflow +Priv Mem. Corr. 2016-02-01 2016-02-08
7.2
None Local Low Not required Complete Complete Complete
AppleGraphicsPowerManagement in Apple OS X before 10.11.3 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
37 CVE-2016-0718 119 DoS Exec Code Overflow 2016-05-26 2016-11-30
7.5
None Remote Low Not required Partial Partial Partial
Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow.
38 CVE-2015-8865 119 DoS Exec Code Overflow 2016-05-20 2016-12-02
7.5
None Remote Low Not required Partial Partial Partial
The file_check_mem function in funcs.c in file before 5.23, as used in the Fileinfo component in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5, mishandles continuation-level jumps, which allows context-dependent attackers to cause a denial of service (buffer overflow and application crash) or possibly execute arbitrary code via a crafted magic file.
39 CVE-2015-8472 119 DoS Overflow 2016-01-21 2016-11-28
7.5
None Remote Low Not required Partial Partial Partial
Buffer overflow in the png_set_PLTE function in libpng before 1.0.65, 1.1.x and 1.2.x before 1.2.55, 1.3.x, 1.4.x before 1.4.18, 1.5.x before 1.5.25, and 1.6.x before 1.6.20 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-8126.
40 CVE-2015-8126 119 DoS Overflow 2015-11-12 2016-12-02
7.5
None Remote Low Not required Partial Partial Partial
Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image.
41 CVE-2015-7988 DoS Exec Code 2016-06-25 2016-11-29
7.5
None Remote Low Not required Partial Partial Partial
The handle_regservice_request function in mDNSResponder before 625.41.2 allows remote attackers to execute arbitrary code or cause a denial of service (NULL pointer dereference) via unspecified vectors.
42 CVE-2015-7108 119 DoS Overflow +Priv Mem. Corr. 2015-12-11 2015-12-11
7.2
Admin Local Low Not required Complete Complete Complete
The Bluetooth HCI interface in Apple OS X before 10.11.2 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
43 CVE-2015-7106 119 DoS Overflow +Priv Mem. Corr. 2015-12-11 2015-12-11
7.2
Admin Local Low Not required Complete Complete Complete
The Intel Graphics Driver component in Apple OS X before 10.11.2 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
44 CVE-2015-7084 119 DoS Overflow +Priv Mem. Corr. 2015-12-11 2016-11-28
7.2
None Local Low Not required Complete Complete Complete
The kernel in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-7083.
45 CVE-2015-7083 119 DoS Overflow +Priv Mem. Corr. 2015-12-11 2016-11-28
7.2
None Local Low Not required Complete Complete Complete
The kernel in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-7084.
46 CVE-2015-7078 +Priv 2015-12-11 2015-12-11
7.2
None Local Low Not required Complete Complete Complete
Use-after-free vulnerability in Hypervisor in Apple OS X before 10.11.2 allows local users to gain privileges via vectors involving VM objects.
47 CVE-2015-7077 119 DoS Overflow +Priv 2015-12-11 2015-12-11
7.2
None Local Low Not required Complete Complete Complete
The Intel Graphics Driver component in Apple OS X before 10.11.2 allows local users to gain privileges or cause a denial of service (out-of-bounds memory access) via unspecified vectors.
48 CVE-2015-7076 DoS +Priv 2015-12-11 2015-12-11
7.2
None Local Low Not required Complete Complete Complete
The Intel Graphics Driver component in Apple OS X before 10.11.2 allows local users to gain privileges or cause a denial of service (NULL pointer dereference) via unspecified vectors.
49 CVE-2015-7063 264 +Priv 2015-12-11 2015-12-11
7.2
Admin Local Low Not required Complete Complete Complete
The kernel loader in EFI in Apple OS X before 10.11.2 allows local users to gain privileges via a crafted pathname.
50 CVE-2015-7052 264 +Priv 2015-12-11 2015-12-11
7.2
Admin Local Low Not required Complete Complete Complete
kext tools in Apple OS X before 10.11.2 mishandles kernel-extension loading, which allows local users to gain privileges via unspecified vectors.
Total number of vulnerabilities : 598   Page : 1 (This Page)2 3 4 5 6 7 8 9 10 11 12
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.