cve.bz

apple macos vulnerabilities, newest first, page 64

Filter
  1. 7.8CVE-2020-27930KEVEPSS 22%

    A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watchOS 6.2.9, Security Update 2020-006 High Sierra, Security Update 2020-006 Mojave, iOS 14.2 an…

  2. 7.8CVE-2020-27927EPSS 1.3%

    An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.0.1, iOS 14.2 and iPadOS 14.2, tvOS 14.2, watchOS 7.1. Processing a maliciously crafted font file may lead to arbitrary code …

  3. 7.8CVE-2020-27917EPSS 1.7%

    A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 14.2 and iPadOS 14.2, iCloud for Windows 11.5, tvOS 14.2, iTunes 12.11 for Windows. Processing maliciously …

  4. 7.8CVE-2020-27916EPSS 1.6%

    An out-of-bounds write was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1, iOS 14.2 and iPadOS 14.2, tvOS 14.2, watchOS 7.1. Processing a maliciously crafted audio file may lead to arbitrary code exec…

  5. 7.8CVE-2020-27912EPSS 1.8%

    An out-of-bounds write was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 14.2 and iPadOS 14.2, iCloud for Windows 11.5, tvOS 14.2, iTunes 12.11 for Windows. Processing a maliciously…

  6. 7.8CVE-2020-27911EPSS 3.4%

    An integer overflow was addressed through improved input validation. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 14.2 and iPadOS 14.2, iCloud for Windows 11.5, tvOS 14.2, iTunes 12.11 for Windows. A remote attacker may be…

  7. 7.8CVE-2020-27910EPSS 1.7%

    An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1, iOS 14.2 and iPadOS 14.2, tvOS 14.2, watchOS 7.1. Processing a maliciously crafted audio file may lead to arbitrary code execu…

  8. 7.8CVE-2020-27909EPSS 2.2%

    An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 14.2 and iPadOS 14.2, tvOS 14.2, watchOS 7.1. Processing a maliciously crafted audio file may lead to arbitrary code execution.

  9. 8.8CVE-2020-27906EPSS 2.9%

    Multiple integer overflows were addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1. A remote attacker may be able to cause unexpected application termination or heap corruption.

  10. 7.8CVE-2020-27904EPSS 3.1%

    A logic issue existed resulting in memory corruption. This was addressed with improved state management. This issue is fixed in macOS Big Sur 11.0.1. An application may be able to execute arbitrary code with kernel privileges.

  11. 7.8CVE-2020-27903EPSS 1.2%

    This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Big Sur 11.0.1. An application may be able to gain elevated privileges.

  12. 5.5CVE-2020-27900EPSS 1.0%

    An issue existed in the handling of snapshots. The issue was resolved with improved permissions logic. This issue is fixed in macOS Big Sur 11.0.1. A malicious application may be able to preview files it does not have access to.

  13. 5.5CVE-2020-27898EPSS 1.0%

    A denial of service issue was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.0.1. An attacker may be able to bypass Managed Frame Protection.

  14. 7.8CVE-2020-9972EPSS 1.4%

    A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 14.0 and iPadOS 14.0. Processing a maliciously crafted USD file may lead to unexpected application termination or arbitrary code execution.

  15. 7.8CVE-2020-9965EPSS 1.5%

    An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.0, tvOS 14.0, iOS 14.0 and iPadOS 14.0. An application may be able to execute arbitrary code with kernel privileges.

  16. 6.5CVE-2020-9849EPSS 2.1%

    An information disclosure issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.0, iOS 14.0 and iPadOS 14.0, iTunes for Windows 12.10.9, iCloud for Windows 11.5, tvOS 14.0. A remote atta…

  17. 5.5CVE-2020-27894EPSS 0.7%

    The issue was addressed with additional user controls. This issue is fixed in macOS Big Sur 11.0.1. Users may be unable to remove metadata indicating where files were downloaded from.

  18. 7.8CVE-2020-10016EPSS 1.7%

    A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.0.1, iOS 14.2 and iPadOS 14.2, tvOS 14.2, watchOS 7.1. An application may be able to execute arbitrary code with kernel privile…

  19. 6.3CVE-2020-10014EPSS 1.1%

    A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Big Sur 11.0.1. A malicious application may be able to break out of its sandbox.

  20. 6.1CVE-2020-10012EPSS 1.0%

    An access issue was addressed with improved access restrictions. This issue is fixed in macOS Big Sur 11.0.1. Processing a maliciously crafted document may lead to a cross site scripting attack.

  21. 5.5CVE-2020-13524EPSS 0.8%

    An out-of-bounds memory corruption vulnerability exists in the way Pixar OpenUSD 20.05 uses SPECS data from binary USD files. A specially crafted malformed file can trigger an out-of-bounds memory access and modification which results in m…

  22. 7.5CVE-2020-8037EPSS 3.1%

    The ppp decapsulator in tcpdump 4.9.3 can be convinced to allocate a large amount of memory.

  23. 8.8CVE-2020-15969EPSS 1.7%

    Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

  24. 7.5CVE-2020-9941EPSS 2.6%

    This issue was addressed with improved checks. This issue is fixed in macOS Catalina 10.15.7, Security Update 2020-005 High Sierra, Security Update 2020-005 Mojave. A remote attacker may be able to unexpectedly alter application state.

  25. 7.8CVE-2020-9883EPSS 6.0%

    A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windo…

  26. 7.8CVE-2020-9876EPSS 2.0%

    An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for …

  27. 5.5CVE-2020-15358EPSS 1.0%

    In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant propagation.

  28. 5.3CVE-2020-14155EPSS 4.2%

    libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring.

  29. 7.5CVE-2019-20838EPSS 2.8%

    libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and \X or \R has more than one fixed quantifier, a related issue to CVE-2019-20454.

  30. 5.5CVE-2020-13631EPSS 0.7%

    SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c and build.c.

  31. 7.0CVE-2020-13630EPSS 1.0%

    ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature.

  32. 5.5CVE-2020-13434EPSS 1.0%

    SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c.

  33. 7.5CVE-2020-10663EPSS 6.8%

    The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collec…

  34. 7.4CVE-2019-14899EPSS 0.8%

    A vulnerability was discovered in Linux, FreeBSD, OpenBSD, MacOS, iOS, and Android that allows a malicious access point, or an adjacent user, to determine if a connected user is using a VPN, make positive inferences about the websites they…

  35. 5.3CVE-2019-13118EPSS 5.1%

    In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an invalid character/length combination could be passed to xsltNumberFormatDecimal, leading to a read of uninitialized stack…

  36. –CVE-2013-0340EPSS 19%

    expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP…

  37. –CVE-2001-0102EPSS 0.5%

    "Multiple Users" Control Panel in Mac OS 9 allows Normal users to gain Owner privileges by removing the Users & Groups Data File, which effectively removes the Owner password and allows the Normal user to log in as the Owner account withou…

  38. –CVE-1999-0590EPSS 6.0%

    A system does not present an appropriate legal message or warning to a user who is accessing it.

  39. –CVE-2000-0041EPSS 1.4%

    Macintosh systems generate large ICMP datagrams in response to malformed datagrams, allowing them to be used as amplifiers in a flood attack.

  40. –CVE-1999-1077EPSS 0.4%

    Idle locking function in MacOS 9 allows local attackers to bypass the password protection of idled sessions via the programmer's switch or CMD-PWR keyboard sequence, which brings up a debugger that the attacker can use to disable the lock.

  41. –CVE-1999-1076EPSS 0.4%

    Idle locking function in MacOS 9 allows local users to bypass the password protection of idled sessions by selecting the "Log Out" option and selecting a "Cancel" option in the dialog box for an application that attempts to verify that the…

  42. –CVE-1999-1543EPSS 0.8%

    MacOS uses weak encryption for passwords that are stored in the Users & Groups Data File.

  43. –CVE-1999-1412EPSS 36%

    A possible interaction between Apple MacOS X release 1.0 and Apache HTTP server allows remote attackers to cause a denial of service (crash) via a flood of HTTP GET requests to CGI programs, which generates a large number of processes.

  44. –CVE-1999-1393EPSS 0.5%

    Control Panel "Password Security" option for Apple Powerbooks allows attackers with physical access to the machine to bypass the security by booting it with an emergency startup disk and using a disk editor to modify the on/off toggle or p…

  45. 4.0CVE-1999-0524EPSS 32%

    ICMP information such as (1) netmask and (2) timestamp is allowed from arbitrary hosts.