Page 153 of 2413 results (0.008 seconds)

CVSS: 9.8EPSS: 4%CPEs: 1EXPL: 1

CVE-2015-3693 – Rowhammer - NaCl Sandbox Escape

https://notcve.org/view.php?id=CVE-2015-3693

01 Jul 2015 — Apple Mac EFI before 2015-001, as used in OS X before 10.10.4 and other products, does not properly set refresh rates for DDR3 RAM, which might make it easier for remote attackers to conduct row-hammer attacks, and consequently gain privileges or cause a denial of service (memory corruption), by triggering certain patterns of access to memory locations. Apple Mac EFI anterior a 2015-001, utilizado en OS X anterior a 10.10.4 y otros productos, no configura correctamente los indices actualizados para DDR3 RAM... • https://www.exploit-db.com/exploits/36311 • CWE-254: 7PK - Security Features •

CVSS: 8.8EPSS: 34%CPEs: 2EXPL: 0

CVE-2015-3667

https://notcve.org/view.php?id=CVE-2015-3667

01 Jul 2015 — QT Media Foundation in Apple QuickTime before 7.7.7, as used in OS X before 10.10.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted file, a different vulnerability than CVE-2015-3661, CVE-2015-3662, CVE-2015-3663, CVE-2015-3666, and CVE-2015-3668. QT Media Foundation en Apple QuickTime anterior a 7.7.7, utilizado en OS X anterior a 10.10.4 y otro productos, permite a atacantes remotos ejecutar código arbitrario o causar una... • http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •

CVSS: 8.8EPSS: 34%CPEs: 2EXPL: 0

CVE-2015-3668

https://notcve.org/view.php?id=CVE-2015-3668

01 Jul 2015 — QT Media Foundation in Apple QuickTime before 7.7.7, as used in OS X before 10.10.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted file, a different vulnerability than CVE-2015-3661, CVE-2015-3662, CVE-2015-3663, CVE-2015-3666, and CVE-2015-3667. QT Media Foundation en Apple QuickTime anterior a 7.7.7, utilizado en OS X anterior a 10.10.4 y otros productos, permite a atacantes remotos ejecutar código arbitrario o causar un... • http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •

CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0

CVE-2015-3671

https://notcve.org/view.php?id=CVE-2015-3671

01 Jul 2015 — Admin Framework in Apple OS X before 10.10.4 does not properly verify XPC entitlements, which allows local users to bypass authentication and obtain admin privileges via unspecified vectors. Admin Framework en Apple OS X anterior a 10.10.4 no verifica correctamente los derechos XPC, lo que permite a usuarios locales evadir la autenticación y obtener privilegios de administración a través de vectores no especificados. • http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html • CWE-284: Improper Access Control •

CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0

CVE-2015-3672

https://notcve.org/view.php?id=CVE-2015-3672

01 Jul 2015 — Admin Framework in Apple OS X before 10.10.4 does not properly handle authentication errors, which allows local users to obtain admin privileges via unspecified vectors. Admin Framework en Apple OS X anterior a 10.10.4 no maneja correctamente los errores de autenticación, lo que permite a usuarios locales obtener privilegios de la administración a través de vectores no especificados. • http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html • CWE-284: Improper Access Control •

CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1

CVE-2015-3673 – Apple Mac OSX Entitlements - 'Rootpipe' Local Privilege Escalation

https://notcve.org/view.php?id=CVE-2015-3673

01 Jul 2015 — Admin Framework in Apple OS X before 10.10.4 does not properly restrict the location of writeconfig clients, which allows local users to obtain root privileges by moving and then modifying Directory Utility. Admin Framework en Apple OS X anterior a 10.10.4 no restringe correctamente la localización de los clientes writeconfig, lo que permite a usuarios locales obtener privilegios root mediante el traslado y posterior modificación de Directory Utility. • https://www.exploit-db.com/exploits/38036 • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 8.8EPSS: 1%CPEs: 24EXPL: 0

CVE-2015-3658

https://notcve.org/view.php?id=CVE-2015-3658

01 Jul 2015 — The Page Loading functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7, as used in Apple iOS before 8.4 and other products, does not properly consider redirects during decisions about sending an Origin header, which makes it easier for remote attackers to bypass CSRF protection mechanisms via a crafted web site. La funcionalidad Page Loading en WebKit en Apple Safari anterior a 6.2.7, 7.x anterior a 7.1.7, y 8.x anterior a 8.0.7, utilizado en Apple iOS anterior a 8.4 y... • http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.html • CWE-254: 7PK - Security Features •

CVSS: 8.8EPSS: 5%CPEs: 2EXPL: 0

CVE-2015-3684

https://notcve.org/view.php?id=CVE-2015-3684

01 Jul 2015 — The HTTPAuthentication implementation in CFNetwork in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted credentials in a URL. La implementación HTTPAuthentication en CFNetwork en Apple iOS anterior a 8.4 y OS X anterior a 10.10.4 permite a atacantes remotos ejecutar código arbitrario o causar una denegación de servicio (corrupción de memoria) a través de credenciales manipuladas en una URL. • http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •

CVSS: 8.8EPSS: 5%CPEs: 2EXPL: 0

CVE-2015-3685

https://notcve.org/view.php?id=CVE-2015-3685

01 Jul 2015 — CoreText in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted text file, a different vulnerability than CVE-2015-3686, CVE-2015-3687, CVE-2015-3688, and CVE-2015-3689. CoreText en Apple iOS anterior a 8.4 y OS X anterior a 10.10.4 permite a atacantes remotos ejecutar código arbitrario o causar una denegación de servicio (corrupción de memoria) a través de un fichero de texto manipulado, una vulnerabil... • http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •

CVSS: 8.8EPSS: 5%CPEs: 3EXPL: 0

CVE-2015-3686

https://notcve.org/view.php?id=CVE-2015-3686

01 Jul 2015 — CoreText in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted text file, a different vulnerability than CVE-2015-3685, CVE-2015-3687, CVE-2015-3688, and CVE-2015-3689. CoreText en Apple iOS anterior a 8.4 y OS X anterior a 10.10.4 permite a atacantes remotos ejecutar código arbitrario o causar una denegación de servicio (corrupción de memoria) a través de un fichero de texto manipulado, una vulnerabil... • http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •