CVSS: 9.8EPSS: 25%CPEs: 21EXPL: 0CVE-2009-0946 – freetype: multiple integer overflows
https://notcve.org/view.php?id=CVE-2009-0946
17 Apr 2009 — Multiple integer overflows in FreeType 2.3.9 and earlier allow remote attackers to execute arbitrary code via vectors related to large values in certain inputs in (1) smooth/ftsmooth.c, (2) sfnt/ttcmap.c, and (3) cff/cffload.c. Múltiples desbordamientos de entero en FreeType v2.3.9 y anteriores permiten a atacantes remotos ejecutar código de su elección mediante vectores relacionados con valores grandes en ciertas entradas en (1) smooth/ftsmooth.c, (2) sfnt/ttcmap.c, y (3) cff/cffload.c. • http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=0545ec1ca36b27cb928128870a83e5f668980bc5 • CWE-190: Integer Overflow or Wraparound •
CVSS: 7.5EPSS: 1%CPEs: 3EXPL: 1CVE-2009-1233 – Apple Safari 3.2.2/4b - nested elements XML Parsing Remote Crash
https://notcve.org/view.php?id=CVE-2009-1233
02 Apr 2009 — Apple Safari 3.2.2 and 4 Beta on Windows allows remote attackers to cause a denial of service (application crash) via an XML document containing many nested A elements. Apple Safari v3.2.2 y v4 Beta en Windows permite a atacantes remotos producir una denegación de servicio (caída de aplicación) a través de un documento XML que contiene elementos "A" anidados. • https://www.exploit-db.com/exploits/8325 • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 3%CPEs: 1EXPL: 2CVE-2009-0744 – Apple Safari 4 - 'feeds:' URI Null Pointer Dereference Remote Denial of Service
https://notcve.org/view.php?id=CVE-2009-0744
27 Feb 2009 — Apple Safari 4 Beta build 528.16 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a feeds: URI beginning with a (1) % (percent), (2) { (open curly bracket), (3) } (close curly bracket), (4) ^ (caret), (5) ` (backquote), or (6) | (pipe) character, followed by an & (ampersand) character. Apple Safari v4 beta Build 528,16 permite a atacantes remotos provocar una denegación de servicio (referencia a puntero nulo y caída de la aplicación) a través de los c... • https://www.exploit-db.com/exploits/32817 • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 3CVE-2009-0321 – Apple Safari For Windows 3.2.1 - URI Remote Denial of Service
https://notcve.org/view.php?id=CVE-2009-0321
28 Jan 2009 — Apple Safari 3.2.1 (aka AppVer 3.525.27.1) on Windows allows remote attackers to cause a denial of service (infinite loop or access violation) via a link to an http URI in which the authority (aka hostname) portion is either a (1) . (dot) or (2) .. (dot dot) sequence. Apple Safari v3.2.1 (también conocido como AppVer 3.525.27.1) sobre Windows, permite a atacantes remotos provocar una denegación de servicio (bucle infinito o violación de acceso) a través de un enlace a una URI http en la que la "porción de a... • https://www.exploit-db.com/exploits/32761 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 6.5EPSS: 24%CPEs: 2EXPL: 5CVE-2008-5821 – Apple Safari 3.2 WebKit - 'alink' Property Memory Leak Remote Denial of Service
https://notcve.org/view.php?id=CVE-2008-5821
02 Jan 2009 — Memory leak in WebKit.dll in WebKit, as used by Apple Safari 3.2 on Windows Vista SP1, allows remote attackers to cause a denial of service (memory consumption and browser crash) via a long ALINK attribute in a BODY element in an HTML document. Fuga de memoria en WebKit.dll en Webkit, como el utilizado en Safari v3.2 en Windows Vista SP1, permite a atacantes remotos provocar una denegación de servicio (consumo de memoria y cuelgue del navegador) a través de un atributo ALINK largo en un elemento BODY en un ... • https://www.exploit-db.com/exploits/32694 • CWE-399: Resource Management Errors •
CVSS: 9.3EPSS: 18%CPEs: 45EXPL: 0CVE-2008-3623
https://notcve.org/view.php?id=CVE-2008-3623
17 Nov 2008 — Heap-based buffer overflow in CoreGraphics in Apple Safari before 3.2 on Windows, in iPhone OS 1.0 through 2.2.1, and in iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted image, related to improper handling of color spaces. Desbordamiento de búfer basado en montículo en CoreGraphics en Apple Safari antes de v3.2 en Windows permite a atacantes remotos ejecutar código de su elección o provocar una denegac... • http://lists.apple.com/archives/security-announce//2008//Dec/msg00000.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 3.3EPSS: 0%CPEs: 42EXPL: 0CVE-2008-3644
https://notcve.org/view.php?id=CVE-2008-3644
17 Nov 2008 — Apple Safari before 3.2 does not properly prevent caching of form data for form fields that have autocomplete disabled, which allows local users to obtain sensitive information by reading the browser's page cache. Apple Safari anterior a v3.2. no previene de forma adecuada el cambio de los datos del formulario para campos de formulario que tienen autocompletar desactivado; esto permite a usuarios locales obtener información sensible al leer la página cacheada en el navegador. • http://lists.apple.com/archives/security-announce//2008/Nov/msg00001.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.2EPSS: 0%CPEs: 42EXPL: 0CVE-2008-4216
https://notcve.org/view.php?id=CVE-2008-4216
17 Nov 2008 — The plug-in interface in WebKit in Apple Safari before 3.2 does not prevent plug-ins from accessing local URLs, which allows remote attackers to obtain sensitive information via vectors that "launch local files." La interface plug-in en WebKit de Apple Safari versiones anteiores a v3.2 no impide que los plug-ins de acceso de URLs local, lo cual permite a atacantes remotos obtener información sensible a través de vectores que "lanzan archivos locales". • http://lists.apple.com/archives/security-announce//2008/Nov/msg00001.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 10.0EPSS: 83%CPEs: 15EXPL: 1CVE-2008-3529 – Apple Safari - RSS 'feed://' Buffer Overflow via libxml2 (PoC)
https://notcve.org/view.php?id=CVE-2008-3529
12 Sep 2008 — Heap-based buffer overflow in the xmlParseAttValueComplex function in parser.c in libxml2 before 2.7.0 allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via a long XML entity name. Desbordamiento de búfer basado en pila en la función xmlParseAttValueComplex en el módulo parser.c de libxml2 versiones anteriores a 2.7.0 permite a atacantes dependientes del contexto provocar una denegación de servicio (parada inesperada) o la posibilidad de ejecutar código de su ... • https://www.exploit-db.com/exploits/8798 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-122: Heap-based Buffer Overflow •
CVSS: 6.5EPSS: 0%CPEs: 26EXPL: 0CVE-2008-3281 – libxml2 denial of service
https://notcve.org/view.php?id=CVE-2008-3281
22 Aug 2008 — libxml2 2.6.32 and earlier does not properly detect recursion during entity expansion in an attribute value, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document. libxml2 2.6.32 y anteriores, no detecta correctamente la recursividad durante la expansión de una entidad en un valor de un atributo; esto permite a atacantes dependientes del contexto provocar una denegación de servicio (consumo de la memoria y la CPU) mediante un documento ... • http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html • CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') •