CVSS: 9.3EPSS: 4%CPEs: 1EXPL: 0CVE-2007-4710
https://notcve.org/view.php?id=CVE-2007-4710
Unspecified vulnerability in ColorSync in Apple Mac OS X 10.4.11 allows remote attackers to cause a denial of service (application termination) or execute arbitrary code via an image with a crafted ColorSync profile, which triggers memory corruption. Vulnerabilidad no especificada en ColorSync de Apple Mac OS X 10.4.11 permite a atacantes remotos provocar una denegación de servicio (término de aplicación) o ejecutar código de su elección mediante una imagen con un perfil ColorSync manipulado, que dispara agotamiento de memoria. • http://docs.info.apple.com/article.html?artnum=307179 http://lists.apple.com/archives/security-announce/2007/Dec/msg00002.html http://secunia.com/advisories/28136 http://securitytracker.com/id?1019106 http://www.securityfocus.com/bid/26910 http://www.us-cert.gov/cas/techalerts/TA07-352A.html http://www.vupen.com/english/advisories/2007/4238 https://exchange.xforce.ibmcloud.com/vulnerabilities/39094 • CWE-399: Resource Management Errors •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2007-5850
https://notcve.org/view.php?id=CVE-2007-5850
Heap-based buffer overflow in Desktop Services in Apple Mac OS X 10.4.11 allows user-assisted attackers to execute arbitrary code via a directory with a crafted .DS_Store file. Desbordamiento de búfer basado en montículo en Destop Services de Apple Mac OS X 10.4.11 permite a atacantes con la intervención del usuario ejecutar código de su elección mediante un directorio con un archivo .DS_Store manipulado. • http://docs.info.apple.com/article.html?artnum=307179 http://lists.apple.com/archives/security-announce/2007/Dec/msg00002.html http://secunia.com/advisories/28136 http://securitytracker.com/id?1019106 http://www.securityfocus.com/bid/26910 http://www.us-cert.gov/cas/techalerts/TA07-352A.html http://www.vupen.com/english/advisories/2007/4238 https://exchange.xforce.ibmcloud.com/vulnerabilities/39098 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2007-5854
https://notcve.org/view.php?id=CVE-2007-5854
Launch Services in Apple Mac OS X 10.4.11 and 10.5.1 does not treat HTML files as unsafe content, which allows attackers to conduct cross-site scripting (XSS) attacks or obtain sensitive information via a crafted HTML file. Launch Services en Apple Mac OS X 10.4.11 y 10.5.1 no considera los archivos HTML como contenido no seguro, lo cual permite a atacantes remotos llevar a cabo ataques de secuencias de comandos en sitios cruzados (XSS) u obtener información sensible a través de un archivo HTML manipulado. • http://docs.info.apple.com/article.html?artnum=307179 http://lists.apple.com/archives/security-announce/2007/Dec/msg00002.html http://secunia.com/advisories/28136 http://securitytracker.com/id?1019106 http://www.securityfocus.com/bid/26910 http://www.us-cert.gov/cas/techalerts/TA07-352A.html http://www.vupen.com/english/advisories/2007/4238 https://exchange.xforce.ibmcloud.com/vulnerabilities/39102 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.3EPSS: 4%CPEs: 1EXPL: 0CVE-2007-4708
https://notcve.org/view.php?id=CVE-2007-4708
Format string vulnerability in Address Book in Apple Mac OS X 10.4.11 allows remote attackers to execute arbitrary code via the URL handler. Vulnerabilidad de cadena de formato en Address Book de Apple Mac OS X 10.4.11, permite que atacantes remotos ejecuten código arbitrario a través de un manejador URL • http://docs.info.apple.com/article.html?artnum=307179 http://lists.apple.com/archives/security-announce/2007/Dec/msg00002.html http://secunia.com/advisories/28136 http://securitytracker.com/id?1019106 http://www.securityfocus.com/bid/26910 http://www.us-cert.gov/cas/techalerts/TA07-352A.html http://www.vupen.com/english/advisories/2007/4238 https://exchange.xforce.ibmcloud.com/vulnerabilities/39092 • CWE-134: Use of Externally-Controlled Format String •
CVSS: 4.3EPSS: 2%CPEs: 12EXPL: 0CVE-2007-5858
https://notcve.org/view.php?id=CVE-2007-5858
WebKit in Safari in Apple Mac OS X 10.4.11 and 10.5.1, iPhone 1.0 through 1.1.2, and iPod touch 1.1 through 1.1.2 allows remote attackers to "navigate the subframes of any other page," which can be leveraged to conduct cross-site scripting (XSS) attacks and obtain sensitive information. WebKit en Safari en Apple Mac OS X versiones 10.4.11 y 10.5.1, iPhone versiones 1.0 hasta 1.1.2, y iPod touch versiones 1.1 hasta 1.1.2, permite a los atacantes remotos "navigate the subframes of any other page", lo que se puede aprovechar para conducir ataques de tipo cross-site scripting (XSS) y obtener información confidencial. • http://docs.info.apple.com/article.html?artnum=307178 http://docs.info.apple.com/article.html?artnum=307179 http://docs.info.apple.com/article.html?artnum=307302 http://lists.apple.com/archives/security-announce/2007/Dec/msg00002.html http://lists.apple.com/archives/security-announce/2008/Jan/msg00000.html http://secunia.com/advisories/28136 http://secunia.com/advisories/28497 http://securitytracker.com/id?1019108 http://www.securityfocus.com/bid/26911 http://www.us-cert.gov/ • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •