CVSS: 7.5EPSS: 8%CPEs: 12EXPL: 0CVE-2010-3790 – Apple QuickTime Pict File Matrix Parsing Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2010-3790
QuickTime in Apple Mac OS X 10.6.x before 10.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file that causes an image sample transformation to scale a sprite outside a buffer boundary. QuickTime en Apple Mac OS X V10.6.x anterior v10.6.5 permite a atacantes remotos ejecutar código de su elección o causar una denegación de servicio (corrupción de memoria y caída aplicación) a través de un archivo de película manipulado. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple QuickTime Player. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within how the application parses a Matrix structure within a particular opcode embedded within a .pict file. When using this Matrix structure to transform image data, the application will miscalculate an index to represent a row of an object. • http://lists.apple.com/archives/security-announce/2010//Dec/msg00000.html http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html http://lists.apple.com/archives/security-announce/2011//Jun/msg00000.html http://support.apple.com/kb/HT4435 http://support.apple.com/kb/HT4447 http://support.apple.com/kb/HT4723 http://www.securityfocus.com/bid/44794 http://www.securitytracker.com/id?1024729 http://www.zerodayinitiative.com/advisories/ZDI-11-038 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 3.5EPSS: 0%CPEs: 6EXPL: 0CVE-2010-3797
https://notcve.org/view.php?id=CVE-2010-3797
Cross-site scripting (XSS) vulnerability in Wiki Server in Apple Mac OS X 10.5.8 and 10.6.x before 10.6.5 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en Apple Mac OS X v10.5.8 y v10.6.x anterior a v10.6.5 permite a usuarios autenticados remotamente inyectar secuencias de comandos web o HTML a través de vectores sin especificar. • http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html http://support.apple.com/kb/HT4435 http://www.securitytracker.com/id?1024723 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 2%CPEs: 10EXPL: 0CVE-2010-3798
https://notcve.org/view.php?id=CVE-2010-3798
Heap-based buffer overflow in xar in Apple Mac OS X 10.6.x before 10.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted xar archive. Desbordamiento de búfer basado en memoria dinámica en xar en Apple Mac OS X v10.6.x anterior v10.6.5 permite a atacantes remotos ejecutar código de su elección o causar una denegación de servicio (caída aplicación) a través de un archivo xar manipulado. • http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html http://support.apple.com/kb/HT4435 http://www.securitytracker.com/id?1024723 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2S2KRIILUKBJHXDNYJQQX74TFUQRG5ND https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YV6RF6VWM7AFYFTTS7VY5TNH26QUEEFC • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 4.9EPSS: 0%CPEs: 10EXPL: 0CVE-2010-1847
https://notcve.org/view.php?id=CVE-2010-1847
The kernel in Apple Mac OS X 10.6.x before 10.6.5 does not properly perform memory management associated with terminal devices, which allows local users to cause a denial of service (system crash) via unspecified vectors. El kernel en Apple Mac OS X v10.6.x anteriores a v10.6.5 no realiza de forma adecuada la gestión de memoria asociada con dispositivos terminales, lo que permite a usuarios locales provocar una denegación de servicio (caída del sistema) a través de vectores no especificos. • http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html http://support.apple.com/kb/HT4435 http://www.securitytracker.com/id?1024723 • CWE-399: Resource Management Errors •
CVSS: 6.8EPSS: 0%CPEs: 6EXPL: 0CVE-2010-3783
https://notcve.org/view.php?id=CVE-2010-3783
Password Server in Apple Mac OS X 10.5.8 and 10.6.x before 10.6.5 does not properly perform replication, which allows remote authenticated users to bypass verification of the current password via unspecified vectors. Servidor de contraseñas en Apple Mac OS X v10.5.8 y v10.6.x anterior v10.6.5 no realiza adecuadamente la replicación, lo que permite a a usuarios autenticados remotamente superar la verificación de la contraseña corriente a través de vectores no especificados. • http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html http://support.apple.com/kb/HT4435 http://www.securitytracker.com/id?1024723 • CWE-264: Permissions, Privileges, and Access Controls •