CVSS: 6.8EPSS: 0%CPEs: 99EXPL: 0CVE-2011-3231
https://notcve.org/view.php?id=CVE-2011-3231
The SSL implementation in Apple Safari before 5.1.1 on Mac OS X before 10.7 accesses uninitialized memory during the processing of X.509 certificates, which allows remote web servers to execute arbitrary code via a crafted certificate. La implementación SSL en Apple Safari anterior a v5.1.1 en MAC OS X anterior a v10.7 accede a memoria no inicializada durante el procesamiento de certificados X.509, permitiendo a servidores web remotos ejecutar código arbitrario mediante una certificado manipulado. • http://lists.apple.com/archives/Security-announce/2011//Oct/msg00004.html http://osvdb.org/76390 http://support.apple.com/kb/HT5000 https://exchange.xforce.ibmcloud.com/vulnerabilities/70568 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 6.8EPSS: 2%CPEs: 4EXPL: 0CVE-2011-3437
https://notcve.org/view.php?id=CVE-2011-3437
Integer signedness error in Apple Type Services (ATS) in Apple Mac OS X 10.7 before 10.7.2 allows remote attackers to execute arbitrary code via a crafted embedded Type 1 font in a document. Error de signo entero en Apple Type Services (ATS) en Apple Mac OS X c10.7 antes c10.7.2 permite a atacantes remotos ejecutar código de su elección a través de una fuente de tipo 1 modificada, incrustada en un documento. • http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html http://osvdb.org/76356 http://support.apple.com/kb/HT5002 http://www.securityfocus.com/bid/50085 https://exchange.xforce.ibmcloud.com/vulnerabilities/70571 • CWE-189: Numeric Errors •
CVSS: 2.1EPSS: 0%CPEs: 136EXPL: 0CVE-2011-3216
https://notcve.org/view.php?id=CVE-2011-3216
The kernel in Apple Mac OS X before 10.7.2 does not properly implement the sticky bit for directories, which might allow local users to bypass intended permissions and delete files via an unlink system call. El kernel en Apple Mac OS X anterior a v10.7.2 no aplicar correctamente el sticky bit en los directorios, lo que podría permitir a usuarios locales eludir los permisos y eliminar archivos a través de una llamada al sistema no enlazada • http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html http://support.apple.com/kb/HT5002 http://www.securityfocus.com/bid/50085 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 2.1EPSS: 0%CPEs: 136EXPL: 0CVE-2011-3215
https://notcve.org/view.php?id=CVE-2011-3215
The kernel in Apple Mac OS X before 10.7.2 does not properly prevent FireWire DMA in the absence of a login, which allows physically proximate attackers to bypass intended access restrictions and discover a password by making a DMA request in the (1) loginwindow, (2) boot, or (3) shutdown state. El Kernel en Apple Mac OS X anterior a v10.7.2 no previene adecuadamente FireWire DMA en ausencia de login, lo que permite a atacantes físicamente próximos evitar las restricciones de acceso y descubrir una contraseña realizando una petición DM en el (1) ventana de login, (2) arrancado, o (3) estado de apagado. • http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html http://support.apple.com/kb/HT5002 http://www.securityfocus.com/bid/50085 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.0EPSS: 0%CPEs: 33EXPL: 0CVE-2011-3246
https://notcve.org/view.php?id=CVE-2011-3246
CFNetwork in Apple iOS before 5.0.1 and Mac OS X 10.7 before 10.7.2 does not properly parse URLs, which allows remote attackers to trigger visits to unintended web sites, and transmission of cookies to unintended web sites, via a crafted (1) http or (2) https URL. CFNetwork en iOS anterior a versión 5.0.1 y Mac OS X versión 10.7 anterior a 10.7.2 de Apple, no analiza apropiadamente las URL, lo que permite a los atacantes remotos desencadenar visitas a sitios web no deseados, y la transmisión de cookies a sitios web no deseados, por medio de una URL de 1) http o (2) https diseñada sin hacer uso de la aplicación. • http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html http://lists.apple.com/archives/Security-announce/2011/Nov/msg00001.html http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html http://support.apple.com/kb/HT4999 http://support.apple.com/kb/HT5002 http://support.apple.com/kb/HT5052 http://support.apple.com/kb/HT5130 http://www.securityfocus.com/bid/50085 h • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •