CVSS: 9.3EPSS: 86%CPEs: 3EXPL: 0CVE-2008-0047 – cups: heap based buffer overflow in cgiCompileSearch()
https://notcve.org/view.php?id=CVE-2008-0047
Heap-based buffer overflow in the cgiCompileSearch function in CUPS 1.3.5, and other versions including the version bundled with Apple Mac OS X 10.5.2, when printer sharing is enabled, allows remote attackers to execute arbitrary code via crafted search expressions. Un desbordamiento de búfer en la región heap de la memoria en la función cgiCompileSearch en CUPS versión 1.3.5 y otras versiones incluyendo la versión incorporada con Apple Mac OS X versión 10.5.2, cuando el uso compartido de impresoras está habilitado, permite a los atacantes remotos ejecutar código arbitrario por medio de expresiones de búsqueda diseñadas. • http://docs.info.apple.com/article.html?artnum=307562 http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=674 http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00005.html http://secunia.com/advisories/29420 http://secunia.com/advisories/29431 http://secunia.com/advisories/29448 http://secunia.com/advisories/29485 http://secunia.com/advisories/29573 http://secunia.com/advisories/29603 h • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-122: Heap-based Buffer Overflow •
CVSS: 6.8EPSS: 2%CPEs: 4EXPL: 0CVE-2008-0060
https://notcve.org/view.php?id=CVE-2008-0060
Help Viewer in Apple Mac OS X 10.4.11 and 10.5.2 allows remote attackers to execute arbitrary Applescript via a help:topic_list URL that injects HTML or JavaScript into a topic list page, as demonstrated using a help:runscript link. Help Viewer en Apple Mac OS X 10.4.11 y 10.5.2, permite a atacantes remotos ejecutar Applescript de su elección a través de la URL help:topic_list, la cual inyecta HTML o JavaScript dentro de una página de listado de topic, tal y como se ha demostrado usando el enlace help:runscript. • http://docs.info.apple.com/article.html?artnum=307562 http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html http://secunia.com/advisories/29420 http://www.securityfocus.com/bid/28304 http://www.securityfocus.com/bid/28371 http://www.securitytracker.com/id?1019657 http://www.us-cert.gov/cas/techalerts/TA08-079A.html http://www.vupen.com/english/advisories/2008/0924/references https://exchange.xforce.ibmcloud.com/vulnerabilities/41295 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 2.6EPSS: 0%CPEs: 2EXPL: 0CVE-2008-0995
https://notcve.org/view.php?id=CVE-2008-0995
The Printing component in Apple Mac OS X 10.5.2 uses 40-bit RC4 when printing to an encrypted PDF file, which makes it easier for attackers to decrypt the file via brute force methods. El componente Printing (Impresión) en Apple Mac OS X 10.5.2 utiliza un RC4 de 40 bits cuando imprime un archivo PDF encriptado, lo que facilita a los atacantes descifrar el archivo a través de métodos de fuerza bruta. • http://docs.info.apple.com/article.html?artnum=307562 http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html http://secunia.com/advisories/29420 http://www.securityfocus.com/bid/28304 http://www.securityfocus.com/bid/28387 http://www.securitytracker.com/id?1019667 http://www.us-cert.gov/cas/techalerts/TA08-079A.html http://www.vupen.com/english/advisories/2008/0924/references https://exchange.xforce.ibmcloud.com/vulnerabilities/41287 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.4EPSS: 0%CPEs: 2EXPL: 0CVE-2008-0990
https://notcve.org/view.php?id=CVE-2008-0990
notifyd in Apple Mac OS X 10.4.11 does not verify that Mach port death notifications have originated from the kernel, which allows local users to cause a denial of service via spoofed death notifications that prevent other applications from receiving notifications. notifyd en Apple Mac OS X 10.4.11 no verifica que las notificaciones death (muerte) del puerto Mach sean originadas desde el kernel, lo que permite a usuarios locales provocar una denegación de servicio a través de notificaciones death falsas que evitan que otras aplicaciones reciban notificaciones. • http://docs.info.apple.com/article.html?artnum=307562 http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html http://secunia.com/advisories/29420 http://www.securityfocus.com/bid/28304 http://www.securityfocus.com/bid/28345 http://www.securitytracker.com/id?1019663 http://www.us-cert.gov/cas/techalerts/TA08-079A.html http://www.vupen.com/english/advisories/2008/0924/references https://exchange.xforce.ibmcloud.com/vulnerabilities/41289 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.8EPSS: 0%CPEs: 2EXPL: 0CVE-2008-0056
https://notcve.org/view.php?id=CVE-2008-0056
Stack-based buffer overflow in Foundation in Apple Mac OS X 10.4.11 allows context-dependent attackers to execute arbitrary code via a "long pathname with an unexpected structure" that triggers the overflow in NSFileManager. Desbordamiento de búfer basado en pila en Foundation de Apple Mac OS X 10.4.11 permite a atacantes dependientes del contexto ejecutar código de su elección a través de "un nombre de ruta largo con una estructura inesperada" que dispara el desbordamiento en NSFileManager. • http://docs.info.apple.com/article.html?artnum=307562 http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html http://secunia.com/advisories/29420 http://www.securityfocus.com/bid/28304 http://www.securityfocus.com/bid/28357 http://www.securitytracker.com/id?1019649 http://www.us-cert.gov/cas/techalerts/TA08-079A.html http://www.vupen.com/english/advisories/2008/0924/references https://exchange.xforce.ibmcloud.com/vulnerabilities/41309 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •