CVSS: 7.8EPSS: 1%CPEs: 1EXPL: 0CVE-2014-8829 – Apple Security Advisory 2015-01-27-4
https://notcve.org/view.php?id=CVE-2014-8829
28 Jan 2015 — SceneKit in Apple OS X before 10.10.2 allows attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via a crafted app. SceneKit en Apple OS X anterior a 10.10.2 permite a atacantes ejecutar código arbitrario o causar una denegación de servicio (escritura fuera de rango) a través de una aplicación manipulada. OS X 10.10.2 and Security Update 2015-001 are now available and address information disclosure, arbitrary code execution, cache clearing, integer overflow, and various ot... • http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2014-8831 – Apple Security Advisory 2015-01-27-4
https://notcve.org/view.php?id=CVE-2014-8831
28 Jan 2015 — security_taskgate in Apple OS X before 10.10.2 allows attackers to read group-ACL-restricted keychain items of arbitrary apps via a crafted app with a signature from a (1) self-signed certificate or (2) Developer ID certificate. security_taskgate en Apple OS X anterior a 10.10.2 permite a atacantes leer elementos de la cadena de claves group-ACL-restricted de aplicaciones arbitrarias a través de una aplicación manipulada con una firma de un certficado (1) auto firmado o (2) desarollador de identificaciones.... • http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.3EPSS: 0%CPEs: 1EXPL: 0CVE-2014-8837 – Apple Security Advisory 2015-01-27-4
https://notcve.org/view.php?id=CVE-2014-8837
28 Jan 2015 — Multiple unspecified vulnerabilities in the Bluetooth driver in Apple OS X before 10.10.2 allow attackers to execute arbitrary code in a privileged context via a crafted app. Múltiples vulnerabilidades no especificadas en el controlador Bluetooth en Apple OS X anterior a 10.10.2 permiten a atacantes ejecutar código arbitrario en un contexto privilegiado a través de una aplicación manipulada. OS X 10.10.2 and Security Update 2015-001 are now available and address information disclosure, arbitrary code execut... • http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html •
CVSS: 10.0EPSS: 1%CPEs: 3EXPL: 0CVE-2014-4486 – Apple Security Advisory 2015-01-27-2
https://notcve.org/view.php?id=CVE-2014-4486
28 Jan 2015 — IOAcceleratorFamily in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not properly handle resource lists and IOService userclient types, which allows attackers to execute arbitrary code or cause a denial of service (NULL pointer dereference) via a crafted app. IOAcceleratorFamily en Apple iOS anterior a 8.1.3, Apple OS X anterior a 10.10.2, y Apple TV anterior a 7.0.3 no maneja correctamente las listas de recursos y los tipos de cliente usuario de IOService, lo que permite... • http://lists.apple.com/archives/security-announce/2015/Jan/msg00000.html •
CVSS: 2.4EPSS: 0%CPEs: 1EXPL: 0CVE-2014-8827 – Apple Security Advisory 2015-01-27-4
https://notcve.org/view.php?id=CVE-2014-8827
28 Jan 2015 — LoginWindow in Apple OS X before 10.10.2 does not transition to the lock-screen state immediately upon being woken from sleep, which allows physically proximate attackers to obtain sensitive information by reading the screen. LoginWindow en Apple OS X anterior a 10.10.2 no pasa al estado de bloqueo de pantalla inmediatamente cuando se reactiva el ordenador después de un descanso, lo que permite a atacantes físicamente próximos obtener información sensible mediante la lectura de la pantalla. OS X 10.10.2 and... • http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html • CWE-284: Improper Access Control •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2014-8823 – Apple Security Advisory 2015-01-27-4
https://notcve.org/view.php?id=CVE-2014-8823
28 Jan 2015 — The IOUSBControllerUserClient::ReadRegister function in the IOUSB controller in IOUSBFamily in Apple OS X before 10.10.2 allows local users to read data from arbitrary kernel-memory locations by leveraging root access and providing a crafted first argument. La función IOUSBControllerUserClient::ReadRegister en el controlador IOUSB en IOUSBFamily en Apple OS X anterior a 10.10.2 permite a usuarios locales leer datos de localizaciones de la memoria del kernel mediante el aprovechamiento del acceso al root y l... • http://code.google.com/p/google-security-research/issues/detail?id=21 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 10.0EPSS: 2%CPEs: 3EXPL: 0CVE-2014-4488 – Apple Security Advisory 2015-01-27-2
https://notcve.org/view.php?id=CVE-2014-4488
28 Jan 2015 — IOHIDFamily in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not properly validate resource-queue metadata, which allows attackers to execute arbitrary code in a privileged context via a crafted app. IOHIDFamily en Apple iOS anterior a 8.1.3, Apple OS X anterior a 10.10.2, y Apple TV anterior a 7.0.3 no valida correctamente los metadatos de la cola de recursos, lo que permite a atacantes ejecutar código arbitrario en un contexto privilegiado a través de una aplicación man... • http://lists.apple.com/archives/security-announce/2015/Jan/msg00000.html • CWE-19: Data Processing Errors •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2014-4498 – Apple Security Advisory 2015-01-27-4
https://notcve.org/view.php?id=CVE-2014-4498
28 Jan 2015 — The CPU Software in Apple OS X before 10.10.2 allows physically proximate attackers to modify firmware during the EFI update process by inserting a Thunderbolt device with crafted code in an Option ROM, aka the "Thunderstrike" issue. El Software de la CPU en Apple OS X anterior a 10.10.2 permite a atacantes físicamente próximos modificar firmware durante el proceso de actualización EFI mediante la inserción de un dispositivo Thunderbolt con código manipulado en un ROM Option, también conocido como el proble... • http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html • CWE-17: DEPRECATED: Code •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2014-8828 – Apple Security Advisory 2015-01-27-4
https://notcve.org/view.php?id=CVE-2014-8828
28 Jan 2015 — Sandbox in Apple OS X before 10.10 allows attackers to write to the sandbox-profile cache via a sandboxed app that includes a com.apple.sandbox segment in a path. Sandbox en Apple OS X anterior a 10.10 permite a atacantes escribir al caché del prefil de las sandbox a través de una aplicación en una sandbox que incluye un segmento com.apple.sandbox en una ruta. OS X 10.10.2 and Security Update 2015-001 are now available and address information disclosure, arbitrary code execution, cache clearing, integer ove... • http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2014-8833 – Apple Security Advisory 2015-01-27-4
https://notcve.org/view.php?id=CVE-2014-8833
28 Jan 2015 — SpotlightIndex in Apple OS X before 10.10.2 does not properly perform deserialization during access to a permission cache, which allows local users to read search results associated with other users' protected files via a Spotlight query. SpotlightIndex en Apple OS X anterior a 10.10.2 no realiza correctamente la deserialización durante el acceso a un caché de permisos, lo que permite a usuarios locales leer los resultados asociados con los ficheros protegidos de otros usuarios a través de una consulta Spot... • http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html • CWE-284: Improper Access Control •