CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2014-8839
https://notcve.org/view.php?id=CVE-2014-8839
Spotlight in Apple OS X before 10.10.2 does not enforce the Mail "Load remote content in messages" configuration, which allows remote attackers to discover recipient IP addresses by including an inline image in an HTML e-mail message and logging HTTP requests for this image's URL. Spotlight en Apple OS X anterior a 10.10.2 no fuerza la configuración de correo 'Cargar contenido remoto en mensajes', lo que permite a atacantes remotos descubrir direcciones IP recipientes mediante la inclusión de una imagen 'inline' en un mensaje de email en HTML y la registración de solicitudes HTTP para la URL de esta imagen. • http://heise.de/newsticker/meldung/Datenschutzpanne-in-Mac-OS-X-Yosemite-2514198.html http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html http://securitytracker.com/id/1031521 http://support.apple.com/HT204244 http://www.theregister.co.uk/2015/01/10/spotlight_caught_spreading_your_delicates https://exchange.xforce.ibmcloud.com/vulnerabilities/100527 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 0CVE-2014-8829
https://notcve.org/view.php?id=CVE-2014-8829
SceneKit in Apple OS X before 10.10.2 allows attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via a crafted app. SceneKit en Apple OS X anterior a 10.10.2 permite a atacantes ejecutar código arbitrario o causar una denegación de servicio (escritura fuera de rango) a través de una aplicación manipulada. • http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html http://support.apple.com/HT204244 http://www.securitytracker.com/id/1031650 https://exchange.xforce.ibmcloud.com/vulnerabilities/100523 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 10.0EPSS: 1%CPEs: 1EXPL: 0CVE-2014-8822
https://notcve.org/view.php?id=CVE-2014-8822
IOHIDFamily in Apple OS X before 10.10.2 allows attackers to execute arbitrary code in a kernel context or cause a denial of service (write to kernel memory) via a crafted app that calls an unspecified user-client method. IOHIDFamily en Apple OS X anterior a 10.10.2 permite a atacantes ejecutar código arbitrario en un contexto del kernel o causar una denegación de servicio (escritura a la memoria del kernel) a través de una aplicación manipulada que llama a un método de cliente usuario no especificado. • http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html http://support.apple.com/HT204244 http://www.securitytracker.com/id/1031650 https://exchange.xforce.ibmcloud.com/vulnerabilities/100513 • CWE-19: Data Processing Errors •
CVSS: 9.3EPSS: 1%CPEs: 2EXPL: 4CVE-2014-8835 – Apple Mac OSX 10.9.x - sysmond XPC Privilege Escalation
https://notcve.org/view.php?id=CVE-2014-8835
The xpc_data_get_bytes function in libxpc in Apple OS X before 10.10.2 does not verify that a dictionary's Attributes key has the xpc_data data type, which allows attackers to execute arbitrary code by providing a crafted dictionary to sysmond, related to an "XPC type confusion" issue. La función xpc_data_get_bytes en libxpc en Apple OS X anterior a 10.10.2 no verifica que la clave de atributos de un diccionario tiene el tipo de datos xpc_data, lo que permite a atacantes ejecutar código arbitrario mediante la entrga de un diccionario manipulado a sysmond, relacionado con un problema de 'confusión de tipos de XPC'. OS X suffers from a privilege escalation vulnerability due to XPC type confusion in sysmond. • https://www.exploit-db.com/exploits/35742 http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html http://packetstormsecurity.com/files/135701/OS-X-Sysmond-XPC-Type-Confusion-Privilege-Escalation.html http://support.apple.com/HT204244 http://www.exploit-db.com/exploits/35742 http://www.securityfocus.com/bid/71992 http://www.securitytracker.com/id/1031650 https://code.google.com/p/google-security-research/issues/detail?id=121 https://exchange.xforce.ibmcloud.com/vulnerabilitie • CWE-19: Data Processing Errors •
CVSS: 10.0EPSS: 1%CPEs: 1EXPL: 1CVE-2014-8836 – OS X IOKit Kernel Memory Corruption
https://notcve.org/view.php?id=CVE-2014-8836
The Bluetooth driver in Apple OS X before 10.10.2 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (arbitrary-size bzero of kernel memory) via a crafted app. El controlador Bluetooth en Apple OS X anterior a 10.10.2 permite a atacantes ejecutar código arbitrario en un contexto privilegiado o causar una denegación de servicio (bzero de tamaño arbitrario de la memoria del kernel) a través de una aplicación manipulada. An OS X IOKit kernel memory corruption issue occurs due to a bad bzero in IOBluetoothDevice. • http://code.google.com/p/google-security-research/issues/detail?id=136 http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html http://support.apple.com/HT204244 http://www.securitytracker.com/id/1031626 https://exchange.xforce.ibmcloud.com/vulnerabilities/100490 • CWE-20: Improper Input Validation •