CVSS: 2.1EPSS: 0%CPEs: 18EXPL: 0CVE-2011-0197
https://notcve.org/view.php?id=CVE-2011-0197
App Store in Apple Mac OS X before 10.6.8 creates a log entry containing a user's AppleID password, which might allow local users to obtain sensitive information by reading a log file, as demonstrated by a log file that has non-default permissions. El "App Store" de Apple Mac OS X antes de v10.6.8, crea una entrada de registro que contiene la contraseña del AppleID de un usuario, lo que podría permitir a usuarios locales obtener información sensible mediante la lectura de un archivo de registro, como lo demuestra un archivo de registro que no tenga los permisos predeterminados. • http://lists.apple.com/archives/security-announce/2011//Jun/msg00000.html http://support.apple.com/kb/HT4723 http://www.securityfocus.com/bid/48443 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.9EPSS: 0%CPEs: 16EXPL: 0CVE-2011-1132
https://notcve.org/view.php?id=CVE-2011-1132
The IPv6 implementation in the kernel in Apple Mac OS X before 10.6.8 allows local users to cause a denial of service (NULL pointer dereference and reboot) via vectors involving socket options. La implementación de IPv6 en el núcleo de Apple Mac OS X antes de v10.6.8 permite a usuarios locales provocar una denegación de servicio (por un puntero a NULL y el reinicio de la máquina) a través de vectores que implican opciones de socket. • http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html http://lists.apple.com/archives/security-announce/2011//Jun/msg00000.html http://support.apple.com/kb/HT4723 http://support.apple.com/kb/HT4999 http://www.securityfocus.com/bid/48422 •
CVSS: 7.5EPSS: 7%CPEs: 16EXPL: 0CVE-2011-0200 – Apple ColorSync ICC Profile ncl2 Parsing Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2011-0200
Integer overflow in ColorSync in Apple Mac OS X before 10.6.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via an image containing a crafted embedded ColorSync profile that triggers a heap-based buffer overflow. Un desbordamiento de entero en ColorSync para Apple Mac OS X antes de v10.6.8 permite a atacantes remotos ejecutar código de su elección o causar una denegación de servicio (caída de la aplicación) a través de una imagen que contiene un perfil ColorSync incrustado que ha sido debidamente modificado y que provoca un desbordamiento de búfer basado en memoria dinámica. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple Safari on Windows and multiple applications on OSX. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The flaw exists within the ColorSync component which is used when handling image files containing embedded ICC data. When handling the ncl2 tag the process miscalculates an integer value used in a memory allocation. • http://lists.apple.com/archives/Security-announce/2011//Oct/msg00000.html http://lists.apple.com/archives/security-announce/2011//Jul/msg00002.html http://lists.apple.com/archives/security-announce/2011//Jun/msg00000.html http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html http://support.apple.com/kb/HT4723 http://support.apple.com/kb/HT4808 http://support.apple.com/kb/HT4981 http://support.apple.com/kb/HT5130 • CWE-189: Numeric Errors •
CVSS: 6.8EPSS: 2%CPEs: 20EXPL: 0CVE-2011-0204
https://notcve.org/view.php?id=CVE-2011-0204
Heap-based buffer overflow in ImageIO in Apple Mac OS X before 10.6.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted TIFF image. Una vulnerabilidad de desbordamiento de búfer de memoria dinámica en ImageIO en Apple Mac OS X antes de v10.6.8 permite a atacantes remotos ejecutar código arbitrario o causar una denegación de servicio (caída de aplicación) a través de una imagen TIFF modificada a mano. • http://archives.neohapsis.com/archives/bugtraq/2011-07/0034.html http://lists.apple.com/archives/Security-announce/2011//Oct/msg00000.html http://lists.apple.com/archives/security-announce/2011//Jul/msg00002.html http://lists.apple.com/archives/security-announce/2011//Jun/msg00000.html http://osvdb.org/73368 http://support.apple.com/kb/HT4723 http://support.apple.com/kb/HT4808 http://support.apple.com/kb/HT4981 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.9EPSS: 0%CPEs: 2EXPL: 0CVE-2011-0199
https://notcve.org/view.php?id=CVE-2011-0199
The Certificate Trust Policy component in Apple Mac OS X before 10.6.8 does not perform CRL checking for Extended Validation (EV) certificates that lack OCSP URLs, which might allow man-in-the-middle attackers to spoof an SSL server via a revoked certificate. El componente de Política de Certificados de Confianza en Apple Mac OS X antes de v10.6.8 no realiza la comprobación de CRL para los certificados de Validación Extendida (EV) que carecen de direcciones URL OCSP, lo que podría permitir falsificar un servidor SSL a atacantes man-in-the-middle a través de una revocación certificado. • http://lists.apple.com/archives/security-announce/2011//Jun/msg00000.html http://support.apple.com/kb/HT4723 http://www.securityfocus.com/bid/48447 • CWE-295: Improper Certificate Validation •