Vulnerabilities > Apple > MAC OS X > 10.7.4
DATE | CVE | VULNERABILITY TITLE | RISK |
---|---|---|---|
2013-04-08 | CVE-2013-2776 | Permissions, Privileges, and Access Controls vulnerability in multiple products sudo 1.3.5 through 1.7.10p5 and 1.8.0 through 1.8.6p6, when running on systems without /proc or the sysctl function with the tty_tickets option enabled, does not properly validate the controlling terminal device, which allows local users with sudo permissions to hijack the authorization of another terminal via vectors related to connecting to the standard input, output, and error file descriptors of another terminal. | 4.4 |
2013-04-08 | CVE-2013-1776 | Permissions, Privileges, and Access Controls vulnerability in multiple products sudo 1.3.5 through 1.7.10 and 1.8.0 through 1.8.5, when the tty_tickets option is enabled, does not properly validate the controlling terminal device, which allows local users with sudo permissions to hijack the authorization of another terminal via vectors related to connecting to the standard input, output, and error file descriptors of another terminal. | 4.4 |
2013-03-15 | CVE-2013-0976 | Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Apple mac OS X IOAcceleratorFamily in Apple Mac OS X before 10.8.3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted graphics image. | 6.8 |
2013-03-15 | CVE-2013-0973 | Remote Code Execution vulnerability in Apple Mac OS X Software Update in Apple Mac OS X through 10.7.5 does not prevent plugin loading within the marketing-text WebView, which allows man-in-the-middle attackers to execute plugin code by modifying the client-server data stream. network apple | 6.8 |
2013-03-15 | CVE-2013-0971 | Resource Management Errors vulnerability in Apple mac OS X and mac OS X Server Use-after-free vulnerability in PDFKit in Apple Mac OS X before 10.8.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted ink annotations in a PDF document. | 6.8 |
2013-03-15 | CVE-2013-0967 | Security Bypass vulnerability in Apple Mac OS X CoreTypes in Apple Mac OS X before 10.8.3 includes JNLP files in the list of safe file types, which allows remote attackers to bypass a Java plug-in disabled setting, and trigger the launch of Java Web Start applications, via a crafted web site. network apple | 4.3 |
2013-03-15 | CVE-2013-0966 | Authentication Bypass vulnerability in Apple Mac OS X The Apple mod_hfs_apple module for the Apache HTTP Server in Apple Mac OS X before 10.8.3 does not properly handle ignorable Unicode characters, which allows remote attackers to bypass intended directory authentication requirements via a crafted pathname in a URI. | 6.4 |
2013-03-05 | CVE-2013-1775 | Permissions, Privileges, and Access Controls vulnerability in multiple products sudo 1.6.0 through 1.7.10p6 and sudo 1.8.0 through 1.8.6p6 allows local users or physically proximate attackers to bypass intended time restrictions and retain privileges without re-authenticating by setting the system clock and sudo user timestamp to the epoch. | 6.9 |
2012-09-20 | CVE-2012-3723 | Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Apple mac OS X and mac OS X Server Apple Mac OS X before 10.7.5 does not properly handle the bNbrPorts field of a USB hub descriptor, which allows physically proximate attackers to execute arbitrary code or cause a denial of service (memory corruption and system crash) by attaching a USB device. | 4.6 |
2012-09-20 | CVE-2012-3722 | Resource Management Errors vulnerability in Apple Iphone OS, mac OS X and mac OS X Server The Sorenson codec in QuickTime in Apple Mac OS X before 10.7.5, and in CoreMedia in iOS before 6, accesses uninitialized memory locations, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file with Sorenson encoding. | 6.8 |