CVSS: 9.3EPSS: 3%CPEs: 12EXPL: 0CVE-2008-2305
https://notcve.org/view.php?id=CVE-2008-2305
Heap-based buffer overflow in Apple Type Services (ATS) in Apple Mac OS X 10.4.11 and 10.5 through 10.5.4 allows remote attackers to execute arbitrary code via a document containing a crafted font, related to "PostScript font names." Desbordamiento de búfer basado en montículo en Apple Type Services (ATS) en Apple Mac OS X 10.4.11 y 10.5 a la v10.5.4, permite a atacantes remotos ejecutar código de su elección a través de un documento que contiene un tipo de fuente manipulado, relacionado con "PostScript font names." (Nombres de fuentes postscript) • http://lists.apple.com/archives/security-announce//2008/Sep/msg00005.html http://secunia.com/advisories/31882 http://securitytracker.com/id?1020873 http://www.securityfocus.com/bid/31189 http://www.us-cert.gov/cas/techalerts/TA08-260A.html http://www.vupen.com/english/advisories/2008/2584 https://exchange.xforce.ibmcloud.com/vulnerabilities/45162 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 4.3EPSS: 2%CPEs: 37EXPL: 0CVE-2008-3629
https://notcve.org/view.php?id=CVE-2008-3629
Apple QuickTime before 7.5.5 allows remote attackers to cause a denial of service (application crash) via a crafted PICT image that triggers an out-of-bounds read. Apple QuickTime anterior a 7.5.5 , permite a atacantes remotos provocar una denegación de servicio (caída de la aplicación), a través de una imagen PICT manipulada que induce una lectura fuera de rango. • http://lists.apple.com/archives/security-announce//2008/Sep/msg00000.html http://lists.apple.com/archives/security-announce/2008/Oct/msg00000.html http://secunia.com/advisories/31821 http://secunia.com/advisories/32121 http://securitytracker.com/id?1020841 http://support.apple.com/kb/HT3027 http://support.apple.com/kb/HT3189 http://www.securityfocus.com/bid/31086 http://www.securityfocus.com/bid/31548 http://www.vupen.com/english/advisories/2008/2527 http://www.vupen • CWE-399: Resource Management Errors •
CVSS: 2.6EPSS: 0%CPEs: 47EXPL: 0CVE-2008-3634
https://notcve.org/view.php?id=CVE-2008-3634
Apple iTunes before 8.0 on Mac OS X 10.4.11, when iTunes Music Sharing is enabled but blocked by the host-based firewall, presents misleading information about firewall security, which might allow remote attackers to leverage an exposure that would be absent if the administrator were given better information. Aplicación Itunes anterior a la v8 sobre Mac OS X 10.4.11, cuando iTunes Sharing se encuentra habilitado pero bloqueado por el cortafuegos del sistema, muestra información falsa (engañosa) sobre la seguridad del cortafuegos. Esto podría ser aprovechado por atacantes remotos. El administrador no obviaría esta cuestión si se le diera mejor información al respecto. • http://lists.apple.com/archives/security-announce//2008/Sep/msg00001.html http://securitytracker.com/id?1020840 http://www.securityfocus.com/bid/31090 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 12%CPEs: 9EXPL: 0CVE-2008-2939 – httpd: mod_proxy_ftp globbing XSS
https://notcve.org/view.php?id=CVE-2008-2939
Cross-site scripting (XSS) vulnerability in proxy_ftp.c in the mod_proxy_ftp module in Apache 2.0.63 and earlier, and mod_proxy_ftp.c in the mod_proxy_ftp module in Apache 2.2.9 and earlier 2.2 versions, allows remote attackers to inject arbitrary web script or HTML via a wildcard in the last directory component in the pathname in an FTP URI. Vulnerabilidad de XSS en proxy_ftp.c en el módulo mod_proxy_ftp en Apache 2.0.63 y en versiones anteriores y mod_proxy_ftp.c en el módulo mod_proxy_ftp en Apache 2.2.9 y en versiones anteriores a 2.2, permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de un comodín en el último componente del directorio en el nombre de ruta en una URI FTPI. • http://lists.apple.com/archives/security-announce/2009/May/msg00002.html http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00000.html http://marc.info/?l=bugtraq&m=123376588623823&w=2 http://marc.info/?l=bugtraq&m=125631037611762&w=2 http://rhn.redhat.com/errata/RHSA-2008-0967.html http://secunia.com/advisories/31384 http://secunia.com/advisories/31673 http://secunia.com/advisories/32685 http://secunia.com/advisories/32838 http://secunia.com/advisories/33156&# • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.3EPSS: 1%CPEs: 5EXPL: 0CVE-2008-2325
https://notcve.org/view.php?id=CVE-2008-2325
QuickLook in Apple Mac OS X 10.4.11 and 10.5.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted Microsoft Office file, related to insufficient "bounds checking." QuickLook en Apple Mac OS X 10.4.11 y 10.5.4, permite a atacantes remotos ejecutar código arbitrariamente o provocar una denegación de servicio (corrupción de memoria y caída de aplicación) a través de un archivo de Microsoft Office, relacionado con la "comprobación de límite" insuficiente. • http://lists.apple.com/archives/security-announce//2008/Jul/msg00003.html http://secunia.com/advisories/31326 http://www.securityfocus.com/bid/30483 http://www.securityfocus.com/bid/30493 http://www.securitytracker.com/id?1020607 http://www.vupen.com/english/advisories/2008/2268 https://exchange.xforce.ibmcloud.com/vulnerabilities/44135 • CWE-399: Resource Management Errors •