CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register   Reset Password   Activate Account
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Apple : Security Vulnerabilities Published In 2008 (Gain Information)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2008-4593 200 +Info 2008-10-17 2009-07-22
1.2
None Local High Not required Partial None None
Apple iPhone 2.1 with firmware 5F136, when Require Passcode is enabled and Show SMS Preview is disabled, allows physically proximate attackers to obtain sensitive information by performing an Emergency Call tap and then reading SMS messages on the device screen, aka Apple bug number 6267416.
2 CVE-2008-4491 200 +Info 2008-10-08 2009-02-10
5.0
None Remote Low Not required Partial None None
Apple Mail.app 3.5 on Mac OS X, when "Store draft messages on the server" is enabled, stores draft copies of S/MIME email in plaintext on the email server, which allows server owners and remote man-in-the-middle attackers to read sensitive mail.
3 CVE-2008-4230 264 +Info 2008-11-25 2008-12-03
1.9
None Local Medium Not required Partial None None
The Passcode Lock feature in Apple iPhone OS 1.0 through 2.1 and iPhone OS for iPod touch 1.1 through 2.1 displays SMS messages when the emergency-call screen is visible, which allows physically proximate attackers to obtain sensitive information by reading these messages. NOTE: this might be a duplicate of CVE-2008-4593.
4 CVE-2008-4227 310 +Info 2008-11-25 2011-09-20
7.5
None Remote Low Not required Partial Partial Partial
Apple iPhone OS 1.0 through 2.1 and iPhone OS for iPod touch 1.1 through 2.1 changes the encryption level of PPTP VPN connections to a lower level than was previously used, which makes it easier for remote attackers to obtain sensitive information or hijack a connection by decrypting network traffic.
5 CVE-2008-4216 200 +Info 2008-11-17 2012-10-30
4.3
None Remote Medium Not required Partial None None
The plug-in interface in WebKit in Apple Safari before 3.2 does not prevent plug-ins from accessing local URLs, which allows remote attackers to obtain sensitive information via vectors that "launch local files."
6 CVE-2008-3876 264 Bypass +Info 2008-09-02 2008-09-17
1.9
None Local Medium Not required Partial None None
Apple iPhone 2.0.2, in some configurations, allows physically proximate attackers to bypass intended access restrictions, and obtain sensitive information or make arbitrary use of the device, via an Emergency Call tap and a Home double-tap, followed by a tap of any contact's blue arrow.
7 CVE-2008-3644 200 +Info 2008-11-17 2012-10-30
1.9
None Local Medium Not required Partial None None
Apple Safari before 3.2 does not properly prevent caching of form data for form fields that have autocomplete disabled, which allows local users to obtain sensitive information by reading the browser's page cache.
8 CVE-2008-3634 200 +Info 2008-09-10 2008-09-11
2.6
None Remote High Not required Partial None None
Apple iTunes before 8.0 on Mac OS X 10.4.11, when iTunes Music Sharing is enabled but blocked by the host-based firewall, presents misleading information about firewall security, which might allow remote attackers to leverage an exposure that would be absent if the administrator were given better information.
9 CVE-2008-3619 264 +Info 2008-09-16 2008-11-15
2.1
None Local Low Not required Partial None None
Time Machine in Apple Mac OS X 10.5 through 10.5.4 uses weak permissions for Time Machine Backup log files, which allows local users to obtain sensitive information by reading these files.
10 CVE-2008-3171 200 +Info 2008-07-14 2008-09-10
5.0
None Remote Low Not required Partial None None
Apple Safari sends Referer headers containing https URLs to different https web sites, which allows remote attackers to obtain potentially sensitive information by reading Referer log data.
11 CVE-2008-2330 200 +Info 2008-09-16 2008-11-15
4.9
None Local Low Not required Complete None None
slapconfig in Directory Services in Apple Mac OS X 10.5 through 10.5.4 allows local users to select a readable output file into which the server password will be written by an OpenLDAP system administrator, related to the mkfifo function, aka an "insecure file operation issue."
12 CVE-2008-2329 200 +Info 2008-09-16 2008-11-15
1.9
None Local Medium Not required Partial None None
Directory Services in Apple Mac OS X 10.5 through 10.5.4, when Active Directory is used, allows attackers to enumerate user names via wildcard characters in the Login Window.
13 CVE-2008-2318 200 +Info 2008-07-14 2008-11-15
5.0
None Remote Low Not required Partial None None
The WOHyperlink implementation in WebObjects in Apple Xcode tools before 3.1 appends local session IDs to generated non-local URLs, which allows remote attackers to obtain potentially sensitive information by reading the requests for these URLs.
14 CVE-2008-2312 255 +Info 2008-09-16 2008-11-15
4.9
None Local Low Not required Complete None None
Network Preferences in Apple Mac OS X 10.4.11 stores PPP passwords in cleartext in a world-readable file, which allows local users to obtain sensitive information by reading this file.
15 CVE-2008-1580 200 +Info 2008-06-02 2008-09-05
4.3
None Remote Medium Not required Partial None None
CFNetwork in Safari in Apple Mac OS X before 10.5.3 automatically sends an SSL client certificate in response to a web server's certificate request, which allows remote web sites to obtain sensitive information (Subject data) from personally identifiable certificates, and use arbitrary certificates to track user activities across domains, a related issue to CVE-2007-4879.
16 CVE-2008-1579 200 +Info 2008-06-02 2011-03-09
5.0
None Remote Low Not required Partial None None
Wiki Server in Apple Mac OS X 10.5 before 10.5.3 allows remote attackers to obtain sensitive information (user names) by reading the error message produced upon access to a nonexistent blog.
17 CVE-2008-1578 200 +Info 2008-06-02 2011-06-13
2.1
None Local Low Not required Partial None None
The sso_util program in Single Sign-On in Apple Mac OS X before 10.5.3 places passwords on the command line, which allows local users to obtain sensitive information by listing the process.
18 CVE-2008-1576 399 DoS Exec Code +Info 2008-06-02 2008-09-05
6.8
User Remote Medium Not required Partial Partial Partial
Mail in Apple Mac OS X before 10.5, when an IPv6 SMTP server is used, does not properly initialize memory, which might allow remote attackers to execute arbitrary code or cause a denial of service (application crash), or obtain sensitive information (memory contents) in opportunistic circumstances, by sending an e-mail message.
19 CVE-2008-1573 119 Overflow +Info 2008-06-02 2011-07-14
7.1
None Remote Medium Not required Complete None None
The BMP and GIF image decoding engine in ImageIO in Apple Mac OS X before 10.5.3 allows remote attackers to obtain sensitive information (memory contents) via a crafted (1) BMP or (2) GIF image, which causes an out-of-bounds read.
20 CVE-2008-1033 264 +Info 2008-06-02 2011-06-16
2.1
None Remote High Single system Partial None None
The scheduler in CUPS in Apple Mac OS X 10.5 before 10.5.3, when debug logging is enabled and a printer requires a password, allows attackers to obtain sensitive information (credentials) by reading the log data, related to "authentication environment variables."
21 CVE-2008-1014 20 +Info 2008-04-04 2008-09-05
4.3
None Remote Medium Not required Partial None None
Apple QuickTime before 7.4.5 does not properly handle external URLs in movies, which allows remote attackers to obtain sensitive information.
22 CVE-2008-1005 200 +Info 2008-03-18 2008-10-11
2.1
None Local Low Not required Partial None None
WebCore, as used in Apple Safari before 3.1, does not properly mask the password field when reverse conversion is used with the Kotoeri input method, which allows physically proximate attackers to read the password.
23 CVE-2008-0995 200 +Info 2008-03-18 2013-01-03
2.6
None Remote High Not required Partial None None
The Printing component in Apple Mac OS X 10.5.2 uses 40-bit RC4 when printing to an encrypted PDF file, which makes it easier for attackers to decrypt the file via brute force methods.
24 CVE-2008-0994 200 +Info 2008-03-18 2013-01-03
2.6
None Remote High Not required Partial None None
Preview in Apple Mac OS X 10.5.2 uses 40-bit RC4 when saving a PDF file with encryption, which makes it easier for attackers to decrypt the file via brute force methods.
25 CVE-2008-0993 200 +Info 2008-03-18 2013-08-27
2.1
None Local Low Not required Partial None None
Podcast Capture in Podcast Producer for Apple Mac OS X 10.5.2 invokes a subtask with passwords in command line arguments, which allows local users to read the passwords via process listings.
26 CVE-2008-0990 200 DoS +Info 2008-03-18 2008-10-11
4.4
None Local Medium Not required Partial Partial Partial
notifyd in Apple Mac OS X 10.4.11 does not verify that Mach port death notifications have originated from the kernel, which allows local users to cause a denial of service via spoofed death notifications that prevent other applications from receiving notifications.
27 CVE-2008-0052 200 +Info 2008-03-18 2008-10-11
6.8
User Remote Medium Not required Partial Partial Partial
CoreServices in Apple Mac OS X 10.4.11 treats .ief as a safe file type, which allows remote attackers to force Safari users into opening an .ief file in AppleWorks, even when the "Open 'Safe' files" preference is set.
28 CVE-2008-0050 200 +Info 2008-03-18 2008-10-11
5.0
None Remote Low Not required Partial None None
CFNetwork in Apple Mac OS X 10.4.11 allows remote HTTPS proxy servers to spoof secure websites via data in a 502 Bad Gateway error.
29 CVE-2008-0041 200 +Info 2008-02-12 2008-09-05
5.0
None Remote Low Not required Partial None None
Parental Controls in Apple Mac OS X 10.5 through 10.5.1 contacts www.apple.com "when a website is unblocked," which allows remote attackers to determine when a system is running Parental Controls.
Total number of vulnerabilities : 29   Page : 1 (This Page)
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.