CVSS: 10.0EPSS: 4%CPEs: 6EXPL: 0CVE-2010-0060 – Apple QuickTime QDMC/QDM2 Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2010-0060
CoreAudio in Apple Mac OS X before 10.6.3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via crafted audio content with QDMC encoding. CoreAudio en Apple Mac OS X anteriores a v10.6.3 permite a atacantes remotos ejecutar código de su elección o a provocar una denegación de servicio (corrupción de memoria y caída de aplicación) a través de contenido de audio manipulado, codificado con QDMC. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple QuickTime. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists in the QuickTimeAudioSupport.qtx library when parsing malformed QDMC and QDM2 codec atoms. By modifying specific values within the stream an attacker can cause heap corruption which can lead to arbitrary code execution under the context of the currently logged in user. • http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html http://lists.apple.com/archives/security-announce/2010//Mar/msg00002.html http://support.apple.com/kb/HT4077 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7513 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.8EPSS: 0%CPEs: 26EXPL: 0CVE-2010-0507
https://notcve.org/view.php?id=CVE-2010-0507
Buffer overflow in Image RAW in Apple Mac OS X before 10.6.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PEF image. Desbordamiento de búfer en Image RAW en Apple Mac OS X anteriores a v10.6.3 permite a atacantes remotos ejecutar código arbitrario o causar una denegación de servicio (cuelgue de aplicación) a través de una imagen PEF manipulada. • http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html http://support.apple.com/kb/HT4077 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2010-0524
https://notcve.org/view.php?id=CVE-2010-0524
The default configuration of the FreeRADIUS server in Apple Mac OS X Server before 10.6.3 permits EAP-TLS authenticated connections on the basis of an arbitrary client certificate, which allows remote attackers to obtain network connectivity via a crafted RADIUS Access Request message. La configuración por defecto del FreeRADIUS server en Apple Mac OS X Server anterior a la v10.6.3, permite a las conexiones EAP-TLS autenticadas sobre la base de cualquier certificado cliente, lo que permite a atacantes remotos obtener conectividad de red a través de un mensaje RADIUS Access Request manipulado. • http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html http://support.apple.com/kb/HT4077 http://www.securityfocus.com/bid/39234 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 10.0EPSS: 9%CPEs: 6EXPL: 0CVE-2010-0062 – Apple QuickTime H.263 Array Index Parsing Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2010-0062
Heap-based buffer overflow in quicktime.qts in CoreMedia and QuickTime in Apple Mac OS X before 10.6.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a malformed .3g2 movie file with H.263 encoding that triggers an incorrect buffer length calculation. Desbordamiento de búfer basado en memoria dinámica en CoreMedia y QuickTime en Apple Mac OS X en versiones anteriores a la v10.6.3 permite a usuarios remtos ejecutar código de su elección o provocar una denegación de servicio (caída de la aplicación) a través de un fichero de video modificado con una codificación H.263. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple QuickTime. User interaction is required in that a target must open a malicious media file or visit a malicious page. The specific flaw exists within the parsing of H.263 media files. The code within QuickTime trusts various values from MDAT structures and uses them during operations on heap memory. • http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html http://lists.apple.com/archives/security-announce/2010//Mar/msg00002.html http://support.apple.com/kb/HT4077 http://www.securityfocus.com/archive/1/510510/100/0/threaded http://www.zerodayinitiative.com/advisories/ZDI-10-036 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6626 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 10.0EPSS: 0%CPEs: 26EXPL: 0CVE-2010-0508
https://notcve.org/view.php?id=CVE-2010-0508
Mail in Apple Mac OS X before 10.6.3 does not disable the filter rules associated with a deleted mail account, which has unspecified impact and attack vectors. Mail en Apple Mac OS X en versiones anteriores a la v10.6.3 no deshabilita las reglas de filtrado asociadas con una cuenta de correo eliminada, lo que tiene un impacto y vectores de ataque sin especificar. • http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html http://support.apple.com/kb/HT4077 •