CVSS: 7.5EPSS: 1%CPEs: 5EXPL: 3CVE-2014-8146 – ICU library 52 < 54 - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2014-8146
The resolveImplicitLevels function in common/ubidi.c in the Unicode Bidirectional Algorithm implementation in ICU4C in International Components for Unicode (ICU) before 55.1 does not properly track directionally isolated pieces of text, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly execute arbitrary code via crafted text. La función resolveImplicitLevels en common/ubidi.c en la implementación Unicode Bidirectional Algorithm en ICU4C en International Components for Unicode (ICU) anterior a 55.1 no rastrea correctamente trozos de texto aislados direccionalmente, lo que permite a atacantes remotos causar una denegación de servicio (desbordamiento de buffer basado en memoria dinámica) o posiblemente ejecutar código arbitrario a través de texto manipulado. • https://www.exploit-db.com/exploits/43887 http://bugs.icu-project.org/trac/changeset/37162 http://lists.apple.com/archives/security-announce/2015/Sep/msg00001.html http://lists.apple.com/archives/security-announce/2015/Sep/msg00003.html http://lists.apple.com/archives/security-announce/2015/Sep/msg00005.html http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html http://openwall.com/lists/oss-security/2015/05/05/6 http://seclists.org/fulldisclosure/2015/May/14 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.8EPSS: 3%CPEs: 2EXPL: 0CVE-2015-1123
https://notcve.org/view.php?id=CVE-2015-1123
WebKit, as used in Apple iOS before 8.3 and Apple TV before 7.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-04-08-3 and APPLE-SA-2015-04-08-4. WebKit, utilizado en Apple iOS anterior a 8.3 y Apple TV anterior a 7.2, permite a atacantes remotos ejecutar código arbitrario o causar una denegación de servicio (corrupción de memoria y caída de aplicación) a través de un sitio web manipulado, una vulnerabilidad diferente a otros CVEs de WebKit listados en APPLE-SA-2015-04-08-3 y APPLE-SA-2015-04-08-4. • http://lists.apple.com/archives/security-announce/2015/Apr/msg00002.html http://lists.apple.com/archives/security-announce/2015/Apr/msg00003.html http://www.securitytracker.com/id/1032050 https://support.apple.com/HT204661 https://support.apple.com/HT204662 •
CVSS: 5.0EPSS: 0%CPEs: 2EXPL: 0CVE-2015-1110
https://notcve.org/view.php?id=CVE-2015-1110
The Podcasts component in Apple iOS before 8.3 and Apple TV before 7.2 allows remote attackers to discover unique identifiers by reading asset-download request data. El componente Podcasts en Apple iOS anterior a 8.3 y Apple TV anterior a 7.2 permite a atacantes remotos descubrir identificadores únicos mediante la lectura de datos de solicitudes de la descarga de activos. • http://lists.apple.com/archives/security-announce/2015/Apr/msg00002.html http://lists.apple.com/archives/security-announce/2015/Apr/msg00003.html http://www.securityfocus.com/bid/73983 http://www.securitytracker.com/id/1032050 https://support.apple.com/HT204661 https://support.apple.com/HT204662 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 1.9EPSS: 0%CPEs: 1EXPL: 0CVE-2015-1107
https://notcve.org/view.php?id=CVE-2015-1107
The Lock Screen component in Apple iOS before 8.3 does not properly implement the erasure feature for incorrect passcode-authentication attempts, which makes it easier for physically proximate attackers to obtain access by making many passcode guesses. El componente Lock Screen en Apple iOS anterior a 8.3 no implementa correctamente la característica de erradicación para intentos de la autenticación de contraseñas incorrectos, lo que facilita a atacantes físicamente próximos obtener el acceso medinate la creación de muchas adivinaciones de contraseñas. • http://lists.apple.com/archives/security-announce/2015/Apr/msg00002.html http://www.securityfocus.com/bid/73978 http://www.securitytracker.com/id/1032050 https://support.apple.com/HT204661 •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2015-1111
https://notcve.org/view.php?id=CVE-2015-1111
Safari in Apple iOS before 8.3 does not delete Recently Closed Tabs data in response to a history-clearing action, which allows attackers to obtain sensitive information by reading a history file. Safari en Apple iOS anterior a 8.3 no elimina los datos Recently Closed Tabs en respuesta a una acción de limpieza del historial, lo que permite a atacantes obtener información sensible mediante la lectura de un fichero del historial. • http://lists.apple.com/archives/security-announce/2015/Apr/msg00002.html http://www.securityfocus.com/bid/73978 http://www.securitytracker.com/id/1032050 https://support.apple.com/HT204661 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •