CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2015-7021
https://notcve.org/view.php?id=CVE-2015-7021
The Graphics Drivers subsystem in Apple OS X before 10.11.1 allows local users to gain privileges or cause a denial of service (kernel memory corruption) via unspecified vectors. El subsistema Graphics Drivers en Apple OS X en versiones anteriores a 10.11.1 permite a usuarios locales obtener privilegios o provocar una denegación de servicio (corrupción de memoria del kernel) a través de vectores no especificados. • http://lists.apple.com/archives/security-announce/2015/Oct/msg00005.html https://support.apple.com/HT205375 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.6EPSS: 0%CPEs: 1EXPL: 0CVE-2015-7020
https://notcve.org/view.php?id=CVE-2015-7020
The NVIDIA driver in the Graphics Drivers subsystem in Apple OS X before 10.11.1 allows local users to obtain sensitive information from kernel memory or cause a denial of service (out-of-bounds read and system crash) via unspecified vectors, a different vulnerability than CVE-2015-7019. El controlador NVIDIA en el subsistema Graphics Drivers en Apple OS X en versiones anteriores a 10.11.1 permite a usuarios locales obtener información sensible de la memoria del kernel o provocar una denegación de servicio (lectura fuera de los límites y caída del sistema) a través de vectores no especificados, una vulnerabilidad diferente a CVE-2015-7019. • http://lists.apple.com/archives/security-announce/2015/Oct/msg00005.html https://support.apple.com/HT205375 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.6EPSS: 0%CPEs: 1EXPL: 0CVE-2015-7016
https://notcve.org/view.php?id=CVE-2015-7016
The MCX Application Restrictions component in Apple OS X before 10.11.1, when Managed Configuration is enabled, mishandles provisioning profiles, which allows attackers to bypass intended entitlement restrictions and gain privileges via a crafted developer-signed app. El componente MCX Application Restrictions en Apple OS X en versiones anteriores a 10.11.1, cuando Managed Configuration esta habilitado, no maneja correctamente los perfiles de aprovisionamiento, lo que permite a atacantes eludir restricciones previstas para autorización y obtener privilegios a través de una aplicación firmada por desarrollador manipulada. • http://lists.apple.com/archives/security-announce/2015/Oct/msg00005.html https://support.apple.com/HT205375 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2015-7003 – OS X Coreaudiod Calls Uninitialized Function Pointer
https://notcve.org/view.php?id=CVE-2015-7003
coreaudiod in Audio in Apple OS X before 10.11.1 does not initialize an unspecified data structure, which allows attackers to execute arbitrary code via a crafted app. coreaudiod en Audio en Apple OS X en versiones anteriores a 10.11.1 no inicializa una estructura de datos sin especificar, lo que permite a atacantes ejecutar código arbitrario a través de una aplicación manipulada. com.apple.audio.coreaudiod is reachable from various sandboxes including the Safari renderer. coreaudiod is sandboxed and runs as its own user, nevertheless it has access to various other interesting attack surfaces which safari doesn't, allowing this bug to potentially form part of a full sandbox escape chain. • http://lists.apple.com/archives/security-announce/2015/Oct/msg00005.html https://support.apple.com/HT205375 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2015-6984
https://notcve.org/view.php?id=CVE-2015-6984
libarchive in Apple OS X before 10.11.1 allows attackers to write to arbitrary files via a crafted app that conducts an unspecified symlink attack. libarchive en Apple OS X en versiones anteriores a 10.11.1 permite a atacantes escribir en archivos arbitrarios a través de una aplicación manipulada que lleva a cabo un ataque de enlace simbólico no especificado. • http://lists.apple.com/archives/security-announce/2015/Oct/msg00005.html https://support.apple.com/HT205375 • CWE-284: Improper Access Control •