CVSS: 7.8EPSS: 5%CPEs: 4EXPL: 5CVE-2011-3336 – Libc - 'regcomp()' Stack Exhaustion Denial of Service
https://notcve.org/view.php?id=CVE-2011-3336
regcomp in the BSD implementation of libc is vulnerable to denial of service due to stack exhaustion. regcomp en la implementación BSD de libc, es vulnerable a una denegación de servicio debido al agotamiento de la pila. Mac OS X, Safari, Firefox and Kaspersky all suffer from a regular expression denial of service condition that was discovered long ago in regcomp(). • https://www.exploit-db.com/exploits/36288 http://seclists.org/fulldisclosure/2014/Mar/166 http://www.securityfocus.com/bid/50541 https://cxsecurity.com/issue/WLB-2011110082 https://www.securityfocus.com/archive/1/520390 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 6.8EPSS: 2%CPEs: 136EXPL: 0CVE-2011-3228
https://notcve.org/view.php?id=CVE-2011-3228
QuickTime in Apple Mac OS X before 10.7.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file. QuickTime en Apple Mac OS X anterior a v10.7.2 permite a atacantes remotos ejecutar código arbitrario o causar una denegación de servicio (corrupción de memoria y caída de aplicación) a través de un archivo de película especialmente diseñado • http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html http://osvdb.org/76372 http://support.apple.com/kb/HT5002 http://support.apple.com/kb/HT5016 http://www.securityfocus.com/bid/50085 http://www.securityfocus.com/bid/50127 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 2.6EPSS: 0%CPEs: 132EXPL: 0CVE-2011-3224 – Mac App Store Man-In-The-Middle / Remote Command Execution
https://notcve.org/view.php?id=CVE-2011-3224
The User Documentation component in Apple Mac OS X through 10.6.8 uses http sessions for updates to App Store help information, which allows man-in-the-middle attackers to execute arbitrary code by spoofing the http server. El componente User Documentation en Apple Mac OS X hasta v10.6.8 usa sesiones http para las actualizaciones a información de ayuda de la APP Store, permitiendo a atacantes de "hombre en medio" ejecutar código arbitrario mediante la suplantación de un servidor http. Mac App Store suffers from a man-in-the-middle vulnerability that allows for remote command execution. • http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html http://osvdb.org/76375 http://support.apple.com/kb/HT5002 http://www.securityfocus.com/bid/50085 •
CVSS: 7.6EPSS: 0%CPEs: 136EXPL: 0CVE-2011-3213
https://notcve.org/view.php?id=CVE-2011-3213
The File Systems component in Apple Mac OS X before 10.7.2 does not properly track the specific X.509 certificate that a user manually accepted for an initial https WebDAV connection, which allows man-in-the-middle attackers to hijack WebDAV communication by presenting an arbitrary certificate for a subsequent connection. El componente File Systems en Apple Mac OS X anterior a v10.7.2 no lleva correctamente el certificado específico X.509 que un usuario manualmente ha aceptado para una conexión inicial https WebDAV, lo que permite un ataque man-in-the-middle para secuestrar la comunicación WebDAV prsentando un certificado de su elección para una conexión subsiguiente. • http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html http://support.apple.com/kb/HT5002 http://www.securityfocus.com/bid/50085 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 2.1EPSS: 0%CPEs: 4EXPL: 0CVE-2011-3212
https://notcve.org/view.php?id=CVE-2011-3212
CoreStorage in Apple Mac OS X 10.7 before 10.7.2 does not ensure that all disk data is encrypted during the enabling of FileVault, which makes it easier for physically proximate attackers to obtain sensitive information by reading directly from the disk device. CoreStorage en Apple Mac OS X v10.7 anterior a v10.7 no asegura que toda la información de disco está encriptada durante la activación de FileVault, lo que hace más fácil a atacantes próximos físicamente obtener información sensible leyendo directamente del dispositivo de disco. • http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html http://lists.apple.com/archives/security-announce/2012/May/msg00001.html http://osvdb.org/76362 http://support.apple.com/kb/HT5002 http://support.apple.com/kb/HT5281 http://www.securityfocus.com/bid/50085 • CWE-310: Cryptographic Issues •