CVSS: 6.4EPSS: 0%CPEs: 140EXPL: 0CVE-2012-0655
https://notcve.org/view.php?id=CVE-2012-0655
libsecurity in Apple Mac OS X before 10.7.4 does not properly restrict the length of RSA keys within X.509 certificates, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by conducting a spoofing or network-sniffing attack during communication with a site that uses a short key. libsecurity en Apple Mac OS X anteriores a 10.7.4 no restringe apropiadamente la longitud de las claves RSA de certificados X.509, lo que facilita a atacantes remotos evitar los mecanismos de protección criptográfica realizando un ataque de suplantación de identidad ("spoofing") o de captura del tráfico de red ("network-sniffing") durante la comunicación con una página web que utiliza una clave de poca longitud. • http://lists.apple.com/archives/security-announce/2012/May/msg00001.html http://support.apple.com/kb/HT5281 http://www.securityfocus.com/bid/53445 http://www.securityfocus.com/bid/53462 • CWE-310: Cryptographic Issues •
CVSS: 2.1EPSS: 0%CPEs: 140EXPL: 0CVE-2012-0657
https://notcve.org/view.php?id=CVE-2012-0657
Quartz Composer in Apple Mac OS X before 10.7.4, when the RSS Visualizer screensaver is enabled, allows physically proximate attackers to bypass screen locking and launch a Safari process via unspecified vectors. Quartz Composer en Apple Mac OS X antes de v10.7.4, cuando el salvapantallas RSS Visualizer está activado, permite a atacantes físicamente próximos eludir el bloqueo de pantalla y poner en marcha un proceso de Safari a través de vectores no especificados. • http://lists.apple.com/archives/security-announce/2012/May/msg00001.html http://support.apple.com/kb/HT5281 http://www.securityfocus.com/bid/53445 http://www.securityfocus.com/bid/53473 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.8EPSS: 80%CPEs: 11EXPL: 1CVE-2011-3026 – libpng: Heap buffer overflow in png_decompress_chunk (MFSA 2012-11)
https://notcve.org/view.php?id=CVE-2011-3026
Integer overflow in libpng, as used in Google Chrome before 17.0.963.56, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that trigger an integer truncation. Desbordamiento de entero en libpng, tal como se utiliza en Google Chrome antes de v17.0.963.56, permite a atacantes remotos causar una denegación de servicio o posiblemente tener un impacto no especificado a través de vectores desconocidos que provocan el truncado de enteros. • http://code.google.com/p/chromium/issues/detail?id=112822 http://googlechromereleases.blogspot.com/2012/02/chrome-stable-update.html http://lists.apple.com/archives/security-announce/2012/Sep/msg00003.html http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00020.html http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00023.html http://secunia.com/advisories/48016 http://secunia.com/advisories/48110& • CWE-122: Heap-based Buffer Overflow CWE-190: Integer Overflow or Wraparound •