CVSS: 5.9EPSS: 0%CPEs: 2EXPL: 0CVE-2015-6997 – Apple Security Advisory 2015-10-21-1
https://notcve.org/view.php?id=CVE-2015-6997
21 Oct 2015 — The X.509 certificate-trust implementation in Apple iOS before 9.1 does not recognize that the kSecRevocationRequirePositiveResponse flag implies a revocation-checking requirement, which makes it easier for man-in-the-middle attackers to spoof endpoints by leveraging access to a revoked certificate. La implementación del certificado de confianza X.509 en Apple iOS en versiones anteriores a 9.1 no reconoce que el indicador kSecRevocationRequirePositiveResponse implica un requerimiento de verificación de revo... • http://lists.apple.com/archives/security-announce/2015/Dec/msg00002.html • CWE-254: 7PK - Security Features •
CVSS: 9.8EPSS: 3%CPEs: 3EXPL: 0CVE-2015-7006 – Apple Security Advisory 2015-10-21-4
https://notcve.org/view.php?id=CVE-2015-7006
21 Oct 2015 — Directory traversal vulnerability in the BOM (aka Bill of Materials) component in Apple iOS before 9.1, OS X before 10.11.1, and watchOS before 2.0.1 allows remote attackers to execute arbitrary code via a crafted CPIO archive. Vulnerabilidad de salto de directorio en el componente BOM (también conocido como Bill of Materials) en Apple iOS en versiones anteriores a 9.1, OS X en versiones anteriores a 10.11.1 y watchOS en versiones anteriores a 2.0.1 permite a atacantes remotos ejecutar código arbitrario a t... • http://lists.apple.com/archives/security-announce/2015/Oct/msg00002.html • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2015-7015 – Apple Security Advisory 2015-10-21-4
https://notcve.org/view.php?id=CVE-2015-7015
21 Oct 2015 — Heap-based buffer overflow in the DNS client library in configd in Apple iOS before 9.1, OS X before 10.11.1, and watchOS before 2.0.1 allows attackers to execute arbitrary code via a crafted app that sends a spoofed configd response to a client. Desbordamiento de buffer basado en memoria dinámica en la librería del cliente DNS en configd en Apple iOS en versiones anteriores a 9.1, OS X en versiones anteriores a 10.11.1 y watchOS en versiones anteriores a 2.0.1 permite a atacantes ejecutar código arbitrario... • http://lists.apple.com/archives/security-announce/2015/Oct/msg00002.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2015-5925 – Apple Security Advisory 2015-10-21-4
https://notcve.org/view.php?id=CVE-2015-5925
21 Oct 2015 — The CoreGraphics component in Apple iOS before 9.1, OS X before 10.11.1, and watchOS before 2.0.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2015-5926. El componente CoreGraphics en Apple iOS en versiones anteriores a 9.1, OS X en versiones anteriores a 10.11.1 y watchOS en versiones anteriores a 2.0.1 permite a atacantes remotos ejecutar código arbitrario o provocar una denegación de servicio ... • http://lists.apple.com/archives/security-announce/2015/Oct/msg00002.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 10.0EPSS: 1%CPEs: 3EXPL: 0CVE-2015-5922 – Apple Security Advisory 2015-09-30-03
https://notcve.org/view.php?id=CVE-2015-5922
01 Oct 2015 — Unspecified vulnerability in International Components for Unicode (ICU) before 53.1.0, as used in Apple OS X before 10.11 and watchOS before 2, has unknown impact and attack vectors. Vulnerabilidad no especificada en International Components para Unicode (ICU) en versiones anteriores a 53.1.0, tal como se utiliza en Apple OS X en versiones anteriores a 10.11 y watchOS en versiones anteriores a 2, tiene un impacto y vectores de ataque desconocidos. OS X El Capitan 10.11 is now available and addresses close t... • http://lists.apple.com/archives/security-announce/2015/Sep/msg00005.html •
CVSS: 5.9EPSS: 0%CPEs: 3EXPL: 0CVE-2015-5824 – Apple Security Advisory 2015-09-16-1
https://notcve.org/view.php?id=CVE-2015-5824
18 Sep 2015 — The NSURL implementation in the CFNetwork SSL component in Apple iOS before 9 does not properly verify X.509 certificates from SSL servers after a certificate change, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. Vulnerabilidad en la implementación de NSURL en el componente CFNetwork SSL en Apple iOS en versiones anteriores a 9, no verifica adecuadamente los certificados X.509 de los servidores SSL después un cambio en el certificado, l... • http://lists.apple.com/archives/security-announce/2015/Sep/msg00001.html • CWE-310: Cryptographic Issues •
CVSS: 7.8EPSS: 1%CPEs: 2EXPL: 0CVE-2015-5829 – Apple Security Advisory 2015-09-16-1
https://notcve.org/view.php?id=CVE-2015-5829
18 Sep 2015 — Data Detectors Engine in Apple iOS before 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted text file. Vulnerabilidad en Data Detectors Engine en Apple iOS en versiones anteriores a 9, permite a atacantes remotos ejecutar código arbitrario o causar una denegación de servicio (corrupción de memoria) a través de un archivo de texto manipulado. iOS 9 is now available and addresses denial of service, information disclosure, and various other issue... • http://lists.apple.com/archives/security-announce/2015/Sep/msg00001.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2015-5834 – Apple Security Advisory 2015-09-16-1
https://notcve.org/view.php?id=CVE-2015-5834
18 Sep 2015 — IOAcceleratorFamily in Apple iOS before 9 allows attackers to obtain sensitive kernel memory-layout information via a crafted app. Vulnerabilidad en IOAcceleratorFamily en Apple iOS en versiones anteriores a 9, permite a atacantes obtener información sensible de la estructura de memoria del kernel a través de una aplicación manipulada. iOS 9 is now available and addresses denial of service, information disclosure, and various other issues. • http://lists.apple.com/archives/security-announce/2015/Sep/msg00001.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2015-5837 – Apple Security Advisory 2015-09-16-1
https://notcve.org/view.php?id=CVE-2015-5837
18 Sep 2015 — PluginKit in Apple iOS before 9 allows attackers to bypass an intended app-trust requirement and install arbitrary extensions via a crafted enterprise app. Vulnerabilidad en PluginKit en Apple iOS en versiones anteriores a 9, permite a atacantes eludir un requisito destinado a app-trust e instalar extensiones arbitrarias a través de una aplicación empresarial manipulada. iOS 9 is now available and addresses denial of service, information disclosure, and various other issues. • http://lists.apple.com/archives/security-announce/2015/Sep/msg00001.html • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2015-5839 – Apple Security Advisory 2015-09-16-1
https://notcve.org/view.php?id=CVE-2015-5839
18 Sep 2015 — dyld in Apple iOS before 9 allows attackers to bypass a code-signing protection mechanism via an app that places a crafted signature in an executable file. Vulnerabilidad en dyld en Apple iOS en versiones anteriores a 9, permite a atacantes eludir el mecanismo de protección de firmado de código a través de una aplicación que coloca una firma manipulada en un archivo ejecutable. OS X El Capitan 10.11 is now available and addresses close to 100 vulnerabilities that may exist in prior releases. • http://lists.apple.com/archives/security-announce/2015/Sep/msg00001.html • CWE-254: 7PK - Security Features •