CVSS: 10.0EPSS: 0%CPEs: 10EXPL: 0CVE-2014-1318 – (Pwn2Own\Pwn4Fun) Apple OS X Graphics Driver Memory Corruption Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2014-1318
The Intel Graphics Driver in Apple OS X through 10.9.2 does not properly validate a certain pointer, which allows attackers to execute arbitrary code via a crafted application. Intel Graphics Driver en Apple OS X hasta 10.9.2 no valida debidamente cierto puntero, lo que permite a atacantes ejecutar código arbitrario a través de una aplicación manipulada. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple OS X. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the Intel graphics driver. The issue lies in the failure to properly validate a pointer. • http://archives.neohapsis.com/archives/bugtraq/2014-04/0134.html • CWE-20: Improper Input Validation •
CVSS: 6.8EPSS: 1%CPEs: 3EXPL: 0CVE-2014-1319
https://notcve.org/view.php?id=CVE-2014-1319
Buffer overflow in ImageIO in Apple OS X 10.9.x through 10.9.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted JPEG image. Desbordamiento de buffer en ImageIO en Apple OS X 10.9.x hasta 10.9.2 permite a atacantes remotos ejecutar código arbitrario o causar una denegación de servicio (caída de aplicación) a través de una imagen JPEG manipulada. • http://archives.neohapsis.com/archives/bugtraq/2014-04/0134.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 4.9EPSS: 3%CPEs: 15EXPL: 0CVE-2014-1320 – (Pwn2Own\Pwn4Fun) Apple OS X IOKit Kernel Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2014-1320
IOKit in Apple iOS before 7.1.1, Apple OS X through 10.9.2, and Apple TV before 6.1.1 places kernel pointers into an object data structure, which makes it easier for local users to bypass the ASLR protection mechanism by reading unspecified attributes of the object. IOKit en Apple iOS anterior a 7.1.1, Apple OS X hasta 10.9.2 y Apple TV anterior a 6.1.1 coloca punteros de kernel dentro de una estructura de datos de objeto, lo que facilita a usuarios locales evadir el mecanismo de protección ASLR mediante la lectura de atributos no especificados del objeto. This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Apple OS X. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within IOKit. The issue lies in the storage of kernel pointers in an object's data structure that could be retrieved from userland. • http://archives.neohapsis.com/archives/bugtraq/2014-04/0134.html http://archives.neohapsis.com/archives/bugtraq/2014-04/0135.html http://archives.neohapsis.com/archives/bugtraq/2014-04/0136.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 3.3EPSS: 0%CPEs: 3EXPL: 0CVE-2014-1321
https://notcve.org/view.php?id=CVE-2014-1321
Power Management in Apple OS X 10.9.x through 10.9.2 allows physically proximate attackers to bypass an intended transition into the locked-screen state by touching (1) a key or (2) the trackpad during a lid-close action. Power Management en Apple OS X 10.9.x hasta 10.9.2 permite a atacantes físicamente próximos evadir transición en el estado de pantalla bloqueada tocando (1) una clave o (2) el Trackpad durante una acción de cierre de tapa. • http://archives.neohapsis.com/archives/bugtraq/2014-04/0134.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.9EPSS: 0%CPEs: 3EXPL: 1CVE-2014-1322 – Apple Mac OSX - Local Security Bypass
https://notcve.org/view.php?id=CVE-2014-1322
The kernel in Apple OS X through 10.9.2 places a kernel pointer into an XNU object data structure accessible from user space, which makes it easier for local users to bypass the ASLR protection mechanism by reading an unspecified attribute of the object. El kernel en Apple OS X hasta 10.9.2 coloca un puntero de kernel en una estructura de datos de objeto XNU accesible de espacio de usuario, lo que facilita a usuarios locales evadir el mecanismo de protección ASLR mediante la lectura de un atributo no especificado del objeto. • https://www.exploit-db.com/exploits/39147 http://archives.neohapsis.com/archives/bugtraq/2014-04/0134.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •