Vulnerabilities > Apple > MAC OS X > 10.10.0

DATE CVE VULNERABILITY TITLE RISK
2015-06-09 CVE-2015-4024 Resource Management Errors vulnerability in multiple products
Algorithmic complexity vulnerability in the multipart_buffer_headers function in main/rfc1867.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 allows remote attackers to cause a denial of service (CPU consumption) via crafted form data that triggers an improper order-of-growth outcome.
network
low complexity
redhat apple php hp oracle CWE-399
5.0
2015-06-09 CVE-2015-4022 Numeric Errors vulnerability in multiple products
Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 allows remote FTP servers to execute arbitrary code via a long reply to a LIST command, leading to a heap-based buffer overflow.
network
low complexity
redhat php apple CWE-189
7.5
2015-06-09 CVE-2015-4021 Numeric Errors vulnerability in multiple products
The phar_parse_tarfile function in ext/phar/tar.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 does not verify that the first character of a filename is different from the \0 character, which allows remote attackers to cause a denial of service (integer underflow and memory corruption) via a crafted entry in a tar archive.
network
low complexity
redhat apple php CWE-189
5.0
2015-06-09 CVE-2015-3307 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
The phar_parse_metadata function in ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (heap metadata corruption) or possibly have unspecified other impact via a crafted tar archive.
network
low complexity
redhat apple php CWE-119
7.5
2015-06-09 CVE-2015-2783 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in PHP
ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read and application crash) via a crafted length value in conjunction with crafted serialized data in a phar archive, related to the phar_parse_metadata and phar_parse_pharfile functions.
5.8
2015-05-25 CVE-2014-8146 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
The resolveImplicitLevels function in common/ubidi.c in the Unicode Bidirectional Algorithm implementation in ICU4C in International Components for Unicode (ICU) before 55.1 does not properly track directionally isolated pieces of text, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly execute arbitrary code via crafted text.
network
low complexity
apple icu-project CWE-119
7.5
2015-05-21 CVE-2015-4000 Cryptographic Issues vulnerability in multiple products
The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the "Logjam" issue.
3.7
2015-04-24 CVE-2015-3148 Improper Access Control vulnerability in multiple products
cURL and libcurl 7.10.6 through 7.41.0 do not properly re-use authenticated Negotiate connections, which allows remote attackers to connect as other users via a request.
5.0
2015-04-24 CVE-2015-3145 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds write and crash) or possibly have other unspecified impact via a cookie path containing only a double-quote character.
7.5
2015-04-24 CVE-2015-3143 Permissions, Privileges, and Access Controls vulnerability in multiple products
cURL and libcurl 7.10.6 through 7.41.0 does not properly re-use NTLM connections, which allows remote attackers to connect as other users via an unauthenticated request, a similar issue to CVE-2014-0015.
network
low complexity
haxx canonical debian hp apple CWE-264
5.0