CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 2CVE-2014-1322 – Apple Mac OSX - Local Security Bypass
https://notcve.org/view.php?id=CVE-2014-1322
23 Apr 2014 — The kernel in Apple OS X through 10.9.2 places a kernel pointer into an XNU object data structure accessible from user space, which makes it easier for local users to bypass the ASLR protection mechanism by reading an unspecified attribute of the object. El kernel en Apple OS X hasta 10.9.2 coloca un puntero de kernel en una estructura de datos de objeto XNU accesible de espacio de usuario, lo que facilita a usuarios locales evadir el mecanismo de protección ASLR mediante la lectura de un atributo no especi... • https://www.exploit-db.com/exploits/39147 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2014-1321 – Apple Security Advisory 2014-04-22-1
https://notcve.org/view.php?id=CVE-2014-1321
23 Apr 2014 — Power Management in Apple OS X 10.9.x through 10.9.2 allows physically proximate attackers to bypass an intended transition into the locked-screen state by touching (1) a key or (2) the trackpad during a lid-close action. Power Management en Apple OS X 10.9.x hasta 10.9.2 permite a atacantes físicamente próximos evadir transición en el estado de pantalla bloqueada tocando (1) una clave o (2) el Trackpad durante una acción de cierre de tapa. Security Update 2014-002 is now available and addresses vulnerabili... • http://archives.neohapsis.com/archives/bugtraq/2014-04/0134.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2014-1316 – Apple Security Advisory 2014-04-22-1
https://notcve.org/view.php?id=CVE-2014-1316
23 Apr 2014 — Heimdal, as used in Apple OS X through 10.9.2, allows remote attackers to cause a denial of service (abort and daemon exit) via ASN.1 data encountered in the Kerberos 5 protocol. Heimdal, utilizado en Apple OS X hasta 10.9.2, permite a atacantes remotos causar una denegación de servicio (abortar y salida de demonio) a través de datos ASN.1 encontrados en el protocolo Kerberos 5. Security Update 2014-002 is now available and addresses vulnerabilities in CFNetwork HTTPProtocol, CoreServicesUIAgent, FontParser... • http://archives.neohapsis.com/archives/bugtraq/2014-04/0134.html • CWE-20: Improper Input Validation •
CVSS: 10.0EPSS: 0%CPEs: 10EXPL: 0CVE-2014-1318 – (Pwn2Own\Pwn4Fun) Apple OS X Graphics Driver Memory Corruption Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2014-1318
23 Apr 2014 — The Intel Graphics Driver in Apple OS X through 10.9.2 does not properly validate a certain pointer, which allows attackers to execute arbitrary code via a crafted application. Intel Graphics Driver en Apple OS X hasta 10.9.2 no valida debidamente cierto puntero, lo que permite a atacantes ejecutar código arbitrario a través de una aplicación manipulada. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple OS X. User interaction is required to exploit thi... • http://archives.neohapsis.com/archives/bugtraq/2014-04/0134.html • CWE-20: Improper Input Validation •
CVSS: 10.0EPSS: 0%CPEs: 10EXPL: 0CVE-2014-1314 – Apple OS X WindowsServer Sandbox Escape Vulnerability
https://notcve.org/view.php?id=CVE-2014-1314
23 Apr 2014 — WindowServer in Apple OS X through 10.9.2 does not prevent session creation by a sandboxed application, which allows attackers to bypass the sandbox protection mechanism and execute arbitrary code via a crafted application. WindowServer en Apple OS X hasta 10.9.2 no previene la creación de sesión mediante una aplicación en una sandbox, lo que permite a atacantes evadir el mecanismo de protección sandbox y ejecutar código arbitrario a través de una aplicación manipulada. This vulnerability allows remote atta... • http://archives.neohapsis.com/archives/bugtraq/2014-04/0134.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2014-1315 – Apple Security Advisory 2014-04-22-1
https://notcve.org/view.php?id=CVE-2014-1315
23 Apr 2014 — Format string vulnerability in CoreServicesUIAgent in Apple OS X 10.9.x through 10.9.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via format string specifiers in a URL. Vulnerabilidad de formato de cadena en CoreServicesUIAgent en Apple OS X 10.9.x hasta 10.9.2 permite a atacantes remotos ejecutar código arbitrario o causar una denegación de servicio (caída de aplicación) a través de especificadores de formato de cadena en una URL. Security Update 2014... • http://archives.neohapsis.com/archives/bugtraq/2014-04/0134.html • CWE-134: Use of Externally-Controlled Format String •
CVSS: 4.9EPSS: 3%CPEs: 15EXPL: 0CVE-2014-1320 – (Pwn2Own\Pwn4Fun) Apple OS X IOKit Kernel Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2014-1320
23 Apr 2014 — IOKit in Apple iOS before 7.1.1, Apple OS X through 10.9.2, and Apple TV before 6.1.1 places kernel pointers into an object data structure, which makes it easier for local users to bypass the ASLR protection mechanism by reading unspecified attributes of the object. IOKit en Apple iOS anterior a 7.1.1, Apple OS X hasta 10.9.2 y Apple TV anterior a 6.1.1 coloca punteros de kernel dentro de una estructura de datos de objeto, lo que facilita a usuarios locales evadir el mecanismo de protección ASLR mediante la... • http://archives.neohapsis.com/archives/bugtraq/2014-04/0134.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2014-1319 – Apple Security Advisory 2014-04-22-1
https://notcve.org/view.php?id=CVE-2014-1319
23 Apr 2014 — Buffer overflow in ImageIO in Apple OS X 10.9.x through 10.9.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted JPEG image. Desbordamiento de buffer en ImageIO en Apple OS X 10.9.x hasta 10.9.2 permite a atacantes remotos ejecutar código arbitrario o causar una denegación de servicio (caída de aplicación) a través de una imagen JPEG manipulada. Security Update 2014-002 is now available and addresses vulnerabilities in CFNetwork HTTPProtocol, Co... • http://archives.neohapsis.com/archives/bugtraq/2014-04/0134.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 0%CPEs: 17EXPL: 2CVE-2013-7338 – Gentoo Linux Security Advisory 201503-10
https://notcve.org/view.php?id=CVE-2013-7338
22 Apr 2014 — Python before 3.3.4 RC1 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a file size value larger than the size of the zip file to the (1) ZipExtFile.read, (2) ZipExtFile.read(n), (3) ZipExtFile.readlines, (4) ZipFile.extract, or (5) ZipFile.extractall function. Python anterior a 3.3.4 RC1 permite a atacantes remotos causar una denegación de servicio (bucle infinito y consumo de CPU) a través de un valor de tamaño de archivo más grande que el tamaño del archivo zi... • http://bugs.python.org/issue20078 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 25%CPEs: 76EXPL: 1CVE-2013-5704 – httpd: bypass of mod_headers rules via chunked requests
https://notcve.org/view.php?id=CVE-2013-5704
15 Apr 2014 — The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states "this is not a security issue in httpd as such." El módulo mod_headers en el servidor de Apache HTTP 2.2.22 permite a atacantes remotos evadir directivas "RequestHeader unset" mediante la colocación de una cabera en la porción "trailer" de datos enviados con codificación de tran... • http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html • CWE-287: Improper Authentication •