CVSS: 9.1EPSS: 0%CPEs: 2EXPL: 0CVE-2014-1255 – Apple Security Advisory 2014-02-25-1
https://notcve.org/view.php?id=CVE-2014-1255
26 Feb 2014 — Apple Type Services (ATS) in Apple OS X before 10.9.2 does not properly validate calls to the free function, which allows attackers to bypass the App Sandbox protection mechanism via crafted Mach messages. Apple Type Services (ATS) en Apple OS X anterior a 10.9.2 no valida debidamente llamadas a la función "free", lo que permite a atacantes evadir el mecanismo de protección App Sandbox a través de mensajes Mach manipuilados. OS X Mavericks 10.9.2 and Security Update 2014-001 is now available and addresses m... • http://support.apple.com/kb/HT6150 • CWE-20: Improper Input Validation •
CVSS: 8.8EPSS: 0%CPEs: 32EXPL: 0CVE-2014-1268 – Apple Security Advisory 2014-02-25-2
https://notcve.org/view.php?id=CVE-2014-1268
26 Feb 2014 — WebKit, as used in Apple Safari before 6.1.2 and 7.x before 7.0.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1269 and CVE-2014-1270. WebKit, tal como es utilizado en Apple Safari anterior a 6.1.2 y 7.x anterior a 7.0.2, permite a atacantes remotos ejecutar código arbitrario o causar una denegación de servicio (corrupción de memoria y caída de aplicación) a través de ... • http://support.apple.com/kb/HT6145 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2014-1262 – Apple Security Advisory 2014-02-25-1
https://notcve.org/view.php?id=CVE-2014-1262
26 Feb 2014 — Apple Type Services (ATS) in Apple OS X before 10.9.2 allows attackers to bypass the App Sandbox protection mechanism via crafted Mach messages that trigger memory corruption. Apple Type Services (ATS) en Apple OS X anterior a 10.9.2 permite a atacantes evadir el mecanismo de protección App Sandbox a través de mensajes Mach manipulados que provocan una corrupción de memoria. OS X Mavericks 10.9.2 and Security Update 2014-001 is now available and addresses multiple security issues including the recent SSL vu... • http://support.apple.com/kb/HT6150 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 8.8EPSS: 0%CPEs: 32EXPL: 0CVE-2014-1270 – Apple Security Advisory 2014-03-10-2
https://notcve.org/view.php?id=CVE-2014-1270
26 Feb 2014 — WebKit, as used in Apple Safari before 6.1.2 and 7.x before 7.0.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1268 and CVE-2014-1269. WebKit, tal como es utilizado en Apple Safari anterior a 6.1.2 y 7.x anterior a 7.0.2, permite a atacantes remotos ejecutar código arbitrario o causar una denegación de servicio (corrupción de memoria y caída de aplicación) a través de ... • http://support.apple.com/kb/HT6145 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.9EPSS: 0%CPEs: 2EXPL: 2CVE-2014-1263 – Apple Security Advisory 2014-02-25-1
https://notcve.org/view.php?id=CVE-2014-1263
26 Feb 2014 — curl and libcurl 7.27.0 through 7.35.0, when using the SecureTransport/Darwinssl backend, as used in in Apple OS X 10.9.x before 10.9.2, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate when accessing a URL that uses a numerical IP address, which allows man-in-the-middle attackers to spoof servers via an arbitrary valid certificate. curl en Apple OS X 10.9.x anterior a 10.9.2 no verifica los certificados X.509 d... • http://curl.haxx.se/docs/adv_20140326C.html • CWE-310: Cryptographic Issues •
CVSS: 7.8EPSS: 0%CPEs: 9EXPL: 0CVE-2014-1258 – Apple Security Advisory 2014-02-25-1
https://notcve.org/view.php?id=CVE-2014-1258
26 Feb 2014 — Heap-based buffer overflow in CoreAnimation in Apple OS X before 10.9.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted image. Desbordamiento de buffer basado en pila en CoreAnimation en Apple OS X anterior a 10.9.2 permite a atacantes remotos ejecutar código arbitrario o causar una denegación de servicio (caída de aplicación) a través de una imagen manipulada. OS X Mavericks 10.9.2 and Security Update 2014-001 is now available and addresses m... • http://support.apple.com/kb/HT6150 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.8EPSS: 0%CPEs: 21EXPL: 0CVE-2014-1256 – Apple Security Advisory 2014-02-25-1
https://notcve.org/view.php?id=CVE-2014-1256
26 Feb 2014 — Buffer overflow in Apple Type Services (ATS) in Apple OS X before 10.9.2 allows attackers to bypass the App Sandbox protection mechanism via crafted Mach messages. Desbordamiento de buffer en Apple Type Services (ATS) en Apple OS X anterior a 10.9.2 permite a atacantes evadir el mecanismo de protección App Sandbox a través de mensajes Mach manipilados. OS X Mavericks 10.9.2 and Security Update 2014-001 is now available and addresses multiple security issues including the recent SSL vulnerability. • http://support.apple.com/kb/HT6150 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.1EPSS: 0%CPEs: 2EXPL: 0CVE-2014-1264 – Apple Security Advisory 2014-02-25-1
https://notcve.org/view.php?id=CVE-2014-1264
26 Feb 2014 — Finder in Apple OS X before 10.9.2 does not ensure ACL integrity after the viewing of file ACL information, which allows local users to bypass intended access restrictions in opportunistic circumstances via standard filesystem operations on a file with a damaged ACL. Finder en Apple OS X anterior a 10.9.2 no asegura la integridad ACL después de la visualización de información de archivo ACL, lo que permite a usuarios locales evadir restricciones de acceso en circunstancias oportunistas a través de operacion... • http://support.apple.com/kb/HT6150 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.8EPSS: 0%CPEs: 9EXPL: 0CVE-2014-1254 – Apple Security Advisory 2014-02-25-1
https://notcve.org/view.php?id=CVE-2014-1254
26 Feb 2014 — Apple Type Services (ATS) in Apple OS X before 10.9.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Type 1 font that is embedded in a document. Apple Type Services (ATS) en Apple OS X anterior a 10.9.2 permite a atacantes remotos ejecutar código arbitrario o causar una denegación de servicio (corrupción de memoria) a través de una fuente Type 1 manipulada que se encuentra embebida en un documento. OS X Mavericks 10.9.2 and Security Update 20... • http://support.apple.com/kb/HT6150 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.4EPSS: 0%CPEs: 4EXPL: 8CVE-2014-1266 – Apple Security Advisory 2014-02-21-1
https://notcve.org/view.php?id=CVE-2014-1266
22 Feb 2014 — The SSLVerifySignedServerKeyExchange function in libsecurity_ssl/lib/sslKeyExchange.c in the Secure Transport feature in the Data Security component in Apple iOS 6.x before 6.1.6 and 7.x before 7.0.6, Apple TV 6.x before 6.0.2, and Apple OS X 10.9.x before 10.9.2 does not check the signature in a TLS Server Key Exchange message, which allows man-in-the-middle attackers to spoof SSL servers by (1) using an arbitrary private key for the signing step or (2) omitting the signing step. La función SSLVerifySigned... • https://github.com/gabrielg/CVE-2014-1266-poc • CWE-295: Improper Certificate Validation •