CVSS: 8.8EPSS: 1%CPEs: 132EXPL: 0CVE-2011-3217
https://notcve.org/view.php?id=CVE-2011-3217
14 Oct 2011 — MediaKit in Apple Mac OS X through 10.6.8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted disk image. Mediakit en Apple Mac OS X v10.6.8 permite a atacantes remotos ejecutar código arbitrario o causar una denegación de servicio (corrupción de memoria y caída de aplicación) a través de una imagen de disco maniuplada. • http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.0EPSS: 1%CPEs: 136EXPL: 0CVE-2011-3220 – Apple Quicktime Empty URL Data Handler Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2011-3220
14 Oct 2011 — QuickTime in Apple Mac OS X before 10.7.2 does not properly process URL data handlers in movie files, which allows remote attackers to obtain sensitive information from uninitialized memory locations via a crafted file. QuickTime en Apple Mac OS X anterior a v10.7.2 no procesa correctamente los datos de los manipuladores URL de los archivos de película, lo que permite a atacantes remotos obtener información sensible desde memoria no inicializada mediante un fichero especialmente diseñado. This vulnerability... • http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.8EPSS: 1%CPEs: 136EXPL: 0CVE-2011-0230
https://notcve.org/view.php?id=CVE-2011-0230
14 Oct 2011 — Buffer overflow in the ATSFontDeactivate API in Apple Type Services (ATS) in Apple Mac OS X before 10.7.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors. Desbordamiento de búfer en la API de ATSFontDeactivate en Apple Type Services (ATS) en Apple Mac OS X v10.7.2 y anteriores que permite a atacantes remotos ejecutar código de su elección o causar una denegación de servicio (caída de aplicación) a través de vectores no especificados. • http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.1EPSS: 0%CPEs: 132EXPL: 0CVE-2011-3218
https://notcve.org/view.php?id=CVE-2011-3218
14 Oct 2011 — The "Save for Web" selection in QuickTime Player in Apple Mac OS X through 10.6.8 exports HTML documents that contain an http link to a script file, which allows man-in-the-middle attackers to conduct cross-site scripting (XSS) attacks by spoofing the http server during local viewing of an exported document. La selección "Save for Web" en QuickTime Player de Apple Mac OS X v10.6.8 a través de las exportaciones de los documentos HTML que contienen un enlace http a un archivo de comandos, permite a atacantes ... • http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 99EXPL: 0CVE-2011-3231
https://notcve.org/view.php?id=CVE-2011-3231
14 Oct 2011 — The SSL implementation in Apple Safari before 5.1.1 on Mac OS X before 10.7 accesses uninitialized memory during the processing of X.509 certificates, which allows remote web servers to execute arbitrary code via a crafted certificate. La implementación SSL en Apple Safari anterior a v5.1.1 en MAC OS X anterior a v10.7 accede a memoria no inicializada durante el procesamiento de certificados X.509, permitiendo a servidores web remotos ejecutar código arbitrario mediante una certificado manipulado. • http://lists.apple.com/archives/Security-announce/2011//Oct/msg00004.html • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 5.5EPSS: 0%CPEs: 136EXPL: 0CVE-2011-3216
https://notcve.org/view.php?id=CVE-2011-3216
14 Oct 2011 — The kernel in Apple Mac OS X before 10.7.2 does not properly implement the sticky bit for directories, which might allow local users to bypass intended permissions and delete files via an unlink system call. El kernel en Apple Mac OS X anterior a v10.7.2 no aplicar correctamente el sticky bit en los directorios, lo que podría permitir a usuarios locales eludir los permisos y eliminar archivos a través de una llamada al sistema no enlazada • http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.8EPSS: 4%CPEs: 10EXPL: 0CVE-2011-2834 – libxml2: double-free caused by malformed XPath expression in XSLT
https://notcve.org/view.php?id=CVE-2011-2834
17 Sep 2011 — Double free vulnerability in libxml2, as used in Google Chrome before 14.0.835.163, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to XPath handling. Vulnerabilidad de doble liberación en libxml2, tal y como se usa en Google Chrome antes de v14.0.835.163, permite a atacantes remotos causar una denegación de servicio o posiblemente tener un impacto no especificado a través de vectores relacionados con el manejo de XPath. • http://code.google.com/p/chromium/issues/detail?id=93472 • CWE-415: Double Free •
CVSS: 5.9EPSS: 0%CPEs: 18EXPL: 0CVE-2011-3422
https://notcve.org/view.php?id=CVE-2011-3422
10 Sep 2011 — The Keychain implementation in Apple Mac OS X 10.6.8 and earlier does not properly handle an untrusted attribute of a Certification Authority certificate, which makes it easier for man-in-the-middle attackers to spoof arbitrary SSL servers via an Extended Validation certificate, as demonstrated by https access with Safari. La implementación del Keychain en Apple Mac OS X v10.6.8 y anteriores no controla correctamente un atributo, no es de confianza un certificado de una autoridad de certificación, lo que ha... • http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html • CWE-20: Improper Input Validation •
CVSS: 8.8EPSS: 2%CPEs: 10EXPL: 0CVE-2011-2821 – libxml2: double free caused by malformed XPath expression in XSLT
https://notcve.org/view.php?id=CVE-2011-2821
29 Aug 2011 — Double free vulnerability in libxml2, as used in Google Chrome before 13.0.782.215, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted XPath expression. Doble vulnerabilidad libre en libxml2, como se usa en Google Chrome antes de v13.0.782.215, permite a atacantes remotos causar una denegación de servicio o posiblemente tener un impacto no especificado a través de una expresión XPath manipulada. • http://code.google.com/p/chromium/issues/detail?id=89402 • CWE-415: Double Free CWE-672: Operation on a Resource after Expiration or Release •
CVSS: 9.8EPSS: 0%CPEs: 11EXPL: 0CVE-2011-2192 – curl: Improper delegation of client credentials during GSS negotiation
https://notcve.org/view.php?id=CVE-2011-2192
07 Jul 2011 — The Curl_input_negotiate function in http_negotiate.c in libcurl 7.10.6 through 7.21.6, as used in curl and other products, always performs credential delegation during GSSAPI authentication, which allows remote servers to impersonate clients via GSSAPI requests. La función Curl_input_negotiate en http_negotiate.c en libcurl v7.10.6 a v7.21.6, tal y como se utiliza en curl y otras aplicaciones, siempre lleva a cabo delegación de credenciales durante la autenticación GSSAPI, lo que permite a hacerse pasar po... • http://curl.haxx.se/curl-gssapi-delegation.patch • CWE-255: Credentials Management Errors •