CVEs referencing
https://support.apple.com/HT207170

The ConnectionExists function in lib/url.c in libcurl before 7.47.0 does not properly re-use NTLM-authenticated proxy connections, which might allow remote attackers to authenticate as other users via a request, a similar issue to CVE-2014-0015.
Max Base Score
7.3
Published
2016-01-29
Updated
2018-10-17
EPSS
1.70%
An issue was discovered in certain Apple products. macOS before 10.12 is affected. The issue involves a sandbox escape related to launchctl process spawning in the "libxpc" component.
Max Base Score
8.8
Published
2017-02-20
Updated
2017-03-24
EPSS
0.04%
xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbid namespace nodes in XPointer ranges, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and memory corruption) via a crafted XML document.
Max Base Score
10.0
Published
2016-09-25
Updated
2019-03-13
EPSS
1.92%
An issue was discovered in certain Apple products. macOS before 10.12 is affected. macOS before 10.12.1 is affected. The issue involves the "ImageIO" component. It allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and application crash) via a crafted SGI file.
Max Base Score
7.1
Published
2017-02-20
Updated
2017-07-29
EPSS
0.35%
The Apache HTTP Server in Apple OS X before 10.12 and OS X Server before 5.2 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted CGI client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue, a related issue to CVE-2016-5387.
Max Base Score
9.1
Published
2016-09-25
Updated
2017-07-30
EPSS
0.57%
AppleEFIRuntime in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via a crafted app.
Max Base Score
9.3
Published
2016-09-25
Updated
2017-07-30
EPSS
0.19%
Apple HSSPI Support in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
Max Base Score
9.3
Published
2016-09-25
Updated
2017-07-30
EPSS
0.20%
AppleMobileFileIntegrity in Apple iOS before 10 and OS X before 10.12 mishandles process entitlement and Team ID values in the task port inheritance policy, which allows attackers to execute arbitrary code in a privileged context via a crafted app.
Max Base Score
9.3
Published
2016-09-25
Updated
2017-07-30
EPSS
0.23%
AppleUUC in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2016-4700.
Max Base Score
9.3
Published
2016-09-25
Updated
2017-07-30
EPSS
0.20%
AppleUUC in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2016-4699.
Max Base Score
9.3
Published
2016-09-25
Updated
2017-07-30
EPSS
0.20%
Application Firewall in Apple OS X before 10.12 allows local users to cause a denial of service via vectors involving a crafted SO_EXECPATH environment variable.
Max Base Score
6.2
Published
2016-09-25
Updated
2017-07-30
EPSS
0.08%
Audio in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Max Base Score
10.0
Published
2016-09-25
Updated
2019-03-13
EPSS
1.71%
Bluetooth in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
Max Base Score
9.3
Published
2016-09-25
Updated
2017-07-30
EPSS
0.19%
cd9660 in Apple OS X before 10.12 allows local users to cause a denial of service via unspecified vectors.
Max Base Score
5.5
Published
2016-09-25
Updated
2017-07-30
EPSS
0.04%
CFNetwork in Apple iOS before 10 and OS X before 10.12 mishandles Local Storage deletion, which allows local users to discover the visited web sites of arbitrary users via unspecified vectors.
Max Base Score
4.0
Published
2016-09-25
Updated
2017-07-30
EPSS
0.08%
CFNetwork in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 misparses the Set-Cookie header, which allows remote attackers to obtain sensitive information via a crafted HTTP response.
Max Base Score
6.5
Published
2016-09-25
Updated
2019-03-13
EPSS
0.63%
WindowServer in Apple OS X before 10.12 allows local users to obtain root access via vectors that leverage "type confusion," a different vulnerability than CVE-2016-4710.
Max Base Score
7.8
Published
2016-09-25
Updated
2017-07-30
EPSS
0.05%
WindowServer in Apple OS X before 10.12 allows local users to obtain root access via vectors that leverage "type confusion," a different vulnerability than CVE-2016-4709.
Max Base Score
7.8
Published
2016-09-25
Updated
2017-07-30
EPSS
0.05%
CCrypt in corecrypto in CommonCrypto in Apple iOS before 10 and OS X before 10.12 allows attackers to discover cleartext information by leveraging a function call that specifies the same buffer for input and output.
Max Base Score
7.5
Published
2016-09-25
Updated
2017-07-30
EPSS
0.32%
CoreCrypto in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via a crafted app.
Max Base Score
9.3
Published
2016-09-25
Updated
2019-03-13
EPSS
0.20%
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!