CVSS: 7.5EPSS: 34%CPEs: 3EXPL: 1CVE-2015-1067 – Apple Security Advisory 2015-03-09-2
https://notcve.org/view.php?id=CVE-2015-1067
10 Mar 2015 — Secure Transport in Apple iOS before 8.2, Apple OS X through 10.10.2, and Apple TV before 7.1 does not properly restrict TLS state transitions, which makes it easier for remote attackers to conduct cipher-downgrade attacks to EXPORT_RSA ciphers via crafted TLS traffic, related to the "FREAK" issue, a different vulnerability than CVE-2015-0204 and CVE-2015-1637. Secure Transport en Apple iOS anterior a 8.2, Apple OS X hasta 10.10.2, y Apple TV anterior a 7.1 no restringe correctamente las transiciones de est... • http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html • CWE-310: Cryptographic Issues •
CVSS: 8.1EPSS: 0%CPEs: 2EXPL: 0CVE-2015-1065 – Apple Security Advisory 2015-03-09-1
https://notcve.org/view.php?id=CVE-2015-1065
10 Mar 2015 — Multiple buffer overflows in iCloud Keychain in Apple iOS before 8.2 and Apple OS X through 10.10.2 allow man-in-the-middle attackers to execute arbitrary code by modifying the client-server data stream during keychain recovery. Múltiples desbordamientos de buffer en iCloud Keychain en Apple iOS anterior a 8.2 y Apple OS X hasta 10.10.2 permiten a atacantes man-in-the-middle ejecutar código arbitrario mediante la modificación del flujo de datos del servidor cliente durante una recuperación de la cadena de c... • http://lists.apple.com/archives/security-announce/2015/Mar/msg00000.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 10.0EPSS: 1%CPEs: 1EXPL: 0CVE-2015-1066 – Apple Security Advisory 2015-03-09-3
https://notcve.org/view.php?id=CVE-2015-1066
10 Mar 2015 — Off-by-one error in IOAcceleratorFamily in Apple OS X through 10.10.2 allows attackers to execute arbitrary code in a privileged context via a crafted app. Error de superación de límite (off-by-one) en IOAcceleratorFamily en Apple OS X hasta 10.10.2 permite a atacantes ejecutar código arbitrario en un contexto privilegiado a través de una aplicación manipulada. Security Update 2015-002 is now available and addresses buffer overflow, off-by-one, type confusion, and secure transport vulnerabilities. • http://lists.apple.com/archives/security-announce/2015/Mar/msg00002.html • CWE-189: Numeric Errors •
CVSS: 9.8EPSS: 19%CPEs: 4EXPL: 1CVE-2015-1352 – php: NULL pointer dereference in pgsql extension
https://notcve.org/view.php?id=CVE-2015-1352
17 Feb 2015 — The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5.6.7 does not validate token extraction for table names, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted name. La función build_tablename en pgsql.c en la extensión PostgreSQL (también conocido como pgsql) en PHP hasta 5.6.7 no valida la extracción de tokens para nombres de tablas, lo que permite a atacantes remotos causar una denegación de... • http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=124fb22a13fafa3648e4e15b4f207c7096d8155e • CWE-476: NULL Pointer Dereference •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2014-8823 – Apple Security Advisory 2015-01-27-4
https://notcve.org/view.php?id=CVE-2014-8823
28 Jan 2015 — The IOUSBControllerUserClient::ReadRegister function in the IOUSB controller in IOUSBFamily in Apple OS X before 10.10.2 allows local users to read data from arbitrary kernel-memory locations by leveraging root access and providing a crafted first argument. La función IOUSBControllerUserClient::ReadRegister en el controlador IOUSB en IOUSBFamily en Apple OS X anterior a 10.10.2 permite a usuarios locales leer datos de localizaciones de la memoria del kernel mediante el aprovechamiento del acceso al root y l... • http://code.google.com/p/google-security-research/issues/detail?id=21 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 10.0EPSS: 2%CPEs: 3EXPL: 0CVE-2014-4488 – Apple Security Advisory 2015-01-27-2
https://notcve.org/view.php?id=CVE-2014-4488
28 Jan 2015 — IOHIDFamily in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not properly validate resource-queue metadata, which allows attackers to execute arbitrary code in a privileged context via a crafted app. IOHIDFamily en Apple iOS anterior a 8.1.3, Apple OS X anterior a 10.10.2, y Apple TV anterior a 7.0.3 no valida correctamente los metadatos de la cola de recursos, lo que permite a atacantes ejecutar código arbitrario en un contexto privilegiado a través de una aplicación man... • http://lists.apple.com/archives/security-announce/2015/Jan/msg00000.html • CWE-19: Data Processing Errors •
CVSS: 5.0EPSS: 0%CPEs: 3EXPL: 0CVE-2014-4491 – Apple Security Advisory 2015-01-27-2
https://notcve.org/view.php?id=CVE-2014-4491
28 Jan 2015 — The extension APIs in the kernel in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 do not prevent the presence of addresses within an OSBundleMachOHeaders key in a response, which makes it easier for attackers to bypass the ASLR protection mechanism via a crafted app. Las APIs de extensiónTen el kernel en Apple iOS anterior a 8.1.3, Apple OS X anterior a 10.10.2, y Apple TV anterior a 7.0.3 no previene la presencia de direcciones dentro de una clave OSBundleMachOHeaders en una ... • http://lists.apple.com/archives/security-announce/2015/Jan/msg00000.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.8EPSS: 3%CPEs: 1EXPL: 5CVE-2014-8826 – Apple Mac OSX < 10.10.x - GateKeeper Bypass
https://notcve.org/view.php?id=CVE-2014-8826
28 Jan 2015 — LaunchServices in Apple OS X before 10.10.2 does not properly handle file-type metadata, which allows attackers to bypass the Gatekeeper protection mechanism via a crafted JAR archive. LaunchServices en Apple OS X anterior a 10.10.2 no maneja correctamente los metadatos de tipos de ficheros, lo que permite a atacantes evadir el mecanismo de protección Gatekeeper a través de un archive JAR manipulado. A malicious Jar file can bypass all OS X Gatekeeper warnings and protections, allowing a remote attacker to ... • https://packetstorm.news/files/id/130147 • CWE-19: Data Processing Errors •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2014-8838 – Apple Security Advisory 2015-01-27-4
https://notcve.org/view.php?id=CVE-2014-8838
28 Jan 2015 — The Security component in Apple OS X before 10.10.2 does not properly process cached information about app certificates, which allows attackers to bypass the Gatekeeper protection mechanism by leveraging access to a revoked Developer ID certificate for signing a crafted app. El componente de seguridad en Apple OS X anterior a 10.10.2 no procesa correctamente la información en caché sobre los certificados de aplicaciones, lo que permite a atacantes evadir el mecanismo de protección Gatekeeper mediante el apr... • http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 10.0EPSS: 1%CPEs: 3EXPL: 0CVE-2014-4487 – Apple Security Advisory 2015-01-27-2
https://notcve.org/view.php?id=CVE-2014-4487
28 Jan 2015 — Buffer overflow in IOHIDFamily in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 allows attackers to execute arbitrary code in a privileged context via a crafted app. Desbordamiento de buffer en IOHIDFamily en Apple iOS anterior a 8.1.3, Apple OS X anterior a 10.10.2, y Apple TV anterior a 7.0.3 permite a atacantes ejecutar código arbitrario en un contexto privilegiado a través de una aplicación manipulada. OS X 10.10.2 and Security Update 2015-001 are now available and address... • http://lists.apple.com/archives/security-announce/2015/Jan/msg00000.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •