alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2015-7006 (published 2015-10-23)
Directory traversal vulnerability in the BOM (aka Bill of Materials) component in Apple iOS before 9.1, OS X before 10.11.1, and watchOS before 2.0.1 allows remote attackers to execute arbitrary code via a crafted CPIO archive.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-22
Affected vendors: apple
Affected products: iphone_os, mac_os_x, watchos
CVE-2015-7007 (published 2015-10-23)
Script Editor in Apple OS X before 10.11.1 allows remote attackers to bypass an intended user-confirmation requirement for AppleScript execution via unspecified vectors.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Affected vendors: apple
Affected products: mac_os_x
CVE-2015-7008 (published 2015-10-23)
FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-6976, CVE-2015-6977, CVE-2015-6978, CVE-2015-6990, CVE-2015-6991, CVE-2015-6993, CVE-2015-7009, CVE-2015-7010, and CVE-2015-7018.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-119
Affected vendors: apple
Affected products: iphone_os, mac_os_x
CVE-2015-7009 (published 2015-10-23)
FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-6976, CVE-2015-6977, CVE-2015-6978, CVE-2015-6990, CVE-2015-6991, CVE-2015-6993, CVE-2015-7008, CVE-2015-7010, and CVE-2015-7018.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-119
Affected vendors: apple
Affected products: iphone_os, mac_os_x
CVE-2015-7010 (published 2015-10-23)
FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-6976, CVE-2015-6977, CVE-2015-6978, CVE-2015-6990, CVE-2015-6991, CVE-2015-6993, CVE-2015-7008, CVE-2015-7009, and CVE-2015-7018.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-119
Affected vendors: apple
Affected products: iphone_os, mac_os_x
CVE-2015-7011 (published 2015-10-23)
WebKit, as used in Apple Safari before 9.0.1 and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-10-21-3 and APPLE-SA-2015-10-21-5.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-119
Affected vendors: apple
Affected products: itunes, safari
CVE-2015-7012 (published 2015-10-23)
WebKit, as used in Apple iOS before 9.1, Safari before 9.0.1, and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-10-21-1, APPLE-SA-2015-10-21-3, and APPLE-SA-2015-10-21-5.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-119
Affected vendors: apple
Affected products: iphone_os, itunes, safari
CVE-2015-7013 (published 2015-10-23)
WebKit, as used in Apple Safari before 9.0.1 and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-10-21-3 and APPLE-SA-2015-10-21-5.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-119
Affected vendors: apple
Affected products: iphone_os, itunes, mac_os_x
CVE-2015-7014 (published 2015-10-23)
WebKit, as used in Apple iOS before 9.1, Safari before 9.0.1, and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-10-21-1, APPLE-SA-2015-10-21-3, and APPLE-SA-2015-10-21-5.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-119
Affected vendors: apple
Affected products: iphone_os, itunes, safari
CVE-2015-7015 (published 2015-10-23)
Heap-based buffer overflow in the DNS client library in configd in Apple iOS before 9.1, OS X before 10.11.1, and watchOS before 2.0.1 allows attackers to execute arbitrary code via a crafted app that sends a spoofed configd response to a client.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-119
Affected vendors: apple
Affected products: iphone_os, mac_os_x, watchos
CVE-2015-7016 (published 2015-10-23)
The MCX Application Restrictions component in Apple OS X before 10.11.1, when Managed Configuration is enabled, mishandles provisioning profiles, which allows attackers to bypass intended entitlement restrictions and gain privileges via a crafted developer-signed app.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:H/Au:N/C:C/I:C/A:C)
Weakness: CWE-264
Affected vendors: apple
Affected products: mac_os_x
CVE-2015-7017 (published 2015-10-23)
CoreText in Apple iOS before 9.1, OS X before 10.11.1, and iTunes before 12.3.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-6975 and CVE-2015-6992.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Weakness: CWE-119
Affected vendors: apple
Affected products: iphone_os, itunes, mac_os_x
CVE-2015-7018 (published 2015-10-23)
FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-6976, CVE-2015-6977, CVE-2015-6978, CVE-2015-6990, CVE-2015-6991, CVE-2015-6993, CVE-2015-7008, CVE-2015-7009, and CVE-2015-7010.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-119
Affected vendors: apple
Affected products: iphone_os, mac_os_x
CVE-2015-7019 (published 2015-10-23)
The NVIDIA driver in the Graphics Drivers subsystem in Apple OS X before 10.11.1 allows local users to obtain sensitive information from kernel memory or cause a denial of service (out-of-bounds read and system crash) via unspecified vectors, a different vulnerability than CVE-2015-7020.
Severity: MEDIUM (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:P/I:N/A:C)
Weakness: CWE-119
Affected vendors: apple
Affected products: mac_os_x
CVE-2015-7020 (published 2015-10-23)
The NVIDIA driver in the Graphics Drivers subsystem in Apple OS X before 10.11.1 allows local users to obtain sensitive information from kernel memory or cause a denial of service (out-of-bounds read and system crash) via unspecified vectors, a different vulnerability than CVE-2015-7019.
Severity: MEDIUM (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:P/I:N/A:C)
Weakness: CWE-119
Affected vendors: apple
Affected products: mac_os_x
CVE-2015-7021 (published 2015-10-23)
The Graphics Drivers subsystem in Apple OS X before 10.11.1 allows local users to gain privileges or cause a denial of service (kernel memory corruption) via unspecified vectors.
Severity: HIGH (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)
Weakness: CWE-119
Affected vendors: apple
Affected products: mac_os_x
CVE-2015-7022 (published 2015-10-23)
The Telephony subsystem in Apple iOS before 9.1 allows attackers to obtain sensitive call-status information via a crafted app.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:N/A:N)
Weakness: CWE-200
Affected vendors: apple
Affected products: iphone_os
CVE-2015-7023 (published 2015-10-23)
CFNetwork in Apple iOS before 9.1 and OS X before 10.11.1 does not properly consider the uppercase-versus-lowercase distinction during cookie parsing, which allows remote web servers to overwrite cookies via unspecified vectors.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:P)
Weakness: CWE-17
Affected vendors: apple
Affected products: iphone_os, mac_os_x
CVE-2015-7024 (published 2016-01-11)
Untrusted search path vulnerability in Apple OS X before 10.11.1 allows local users to bypass intended Gatekeeper restrictions and gain privileges via a Trojan horse program that is loaded from an unexpected directory by an application that has a valid Apple digital signature.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: apple
Affected products: mac_os_x
CVE-2015-7029 (published 2016-07-03)
Apple AirPort Base Station Firmware before 7.6.7 and 7.7.x before 7.7.7 misparses DNS data, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: apple
Affected products: airport_base_station_firmware
CVE-2015-7030 (published 2015-10-23)
The Swift implementation in Apple Xcode before 7.1 mishandles type conversion, which has unspecified impact and attack vectors.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Weakness: CWE-17
Affected vendors: apple
Affected products: xcode
CVE-2015-7031 (published 2015-10-23)
The Web Service component in Apple OS X Server before 5.0.15 omits an unspecified HTTP header configuration, which allows remote attackers to bypass intended access restrictions via unknown vectors.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
Weakness: CWE-264
Affected vendors: apple
Affected products: mac_os_x_server
CVE-2015-7032 (published 2015-10-18)
The Apple iWork application before 2.6 for iOS, Apple Keynote before 6.6, Apple Pages before 5.6, and Apple Numbers before 3.6 allow remote attackers to obtain sensitive information via a crafted document.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:N/A:N)
Weakness: CWE-200
Affected vendors: apple
Affected products: iwork, keynote, numbers, pages
CVE-2015-7033 (published 2015-10-18)
The Apple iWork application before 2.6 for iOS, Apple Keynote before 6.6, Apple Pages before 5.6, and Apple Numbers before 3.6 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted document.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-119
Affected vendors: apple
Affected products: iwork, keynote, numbers, pages
CVE-2015-7034 (published 2015-10-18)
The Apple iWork application before 2.6 for iOS and Apple Pages before 5.6 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted Pages document.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-119
Affected vendors: apple
Affected products: iwork, pages
CVE-2015-7035 (published 2015-10-23)
Apple Mac EFI before 2015-002, as used in OS X before 10.11.1 and other products, mishandles arguments, which allows attackers to reach "unused" functions via unspecified vectors.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Weakness: CWE-17
Affected vendors: apple
Affected products: mac_os_x
CVE-2015-7036 (published 2015-11-22)
The fts3_tokenizer function in SQLite, as used in Apple iOS before 8.4 and OS X before 10.10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a SQL command that triggers an API call with a crafted pointer value in the second argument.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Weakness: CWE-20
Affected vendors: apple
Affected products: iphone_os, mac_os_x
CVE-2015-7037 (published 2015-12-11)
Directory traversal vulnerability in Mobile Backup in Photos in Apple iOS before 9.2 allows attackers to read arbitrary files via a crafted pathname.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
Weakness: CWE-22
Affected vendors: apple
Affected products: iphone_os
CVE-2015-7038 (published 2015-12-11)
Buffer overflow in libc in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows remote attackers to execute arbitrary code via a crafted package, a different vulnerability than CVE-2015-7039.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-119
Affected vendors: apple
Affected products: iphone_os, mac_os_x, tvos, watchos
CVE-2015-7039 (published 2015-12-11)
Buffer overflow in libc in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows remote attackers to execute arbitrary code via a crafted package, a different vulnerability than CVE-2015-7038.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-119
Affected vendors: apple
Affected products: iphone_os, mac_os_x, tvos, watchos
CVE-2015-7040 (published 2015-12-11)
The kernel in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows attackers to cause a denial of service via a crafted app, a different vulnerability than CVE-2015-7041, CVE-2015-7042, and CVE-2015-7043.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:N/A:P)
Affected vendors: apple
Affected products: iphone_os, mac_os_x, tvos, watchos
CVE-2015-7041 (published 2015-12-11)
The kernel in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows attackers to cause a denial of service via a crafted app, a different vulnerability than CVE-2015-7040, CVE-2015-7042, and CVE-2015-7043.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:N/A:P)
Affected vendors: apple
Affected products: iphone_os, mac_os_x, tvos, watchos
CVE-2015-7042 (published 2015-12-11)
The kernel in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows attackers to cause a denial of service via a crafted app, a different vulnerability than CVE-2015-7040, CVE-2015-7041, and CVE-2015-7043.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:N/A:P)
Affected vendors: apple
Affected products: iphone_os, mac_os_x, tvos, watchos
CVE-2015-7043 (published 2015-12-11)
The kernel in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows attackers to cause a denial of service via a crafted app, a different vulnerability than CVE-2015-7040, CVE-2015-7041, and CVE-2015-7042.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:N/A:P)
Affected vendors: apple
Affected products: iphone_os, mac_os_x, tvos, watchos
CVE-2015-7044 (published 2015-12-11)
The System Integrity Protection feature in Apple OS X before 10.11.2 mishandles union mounts, which allows attackers to execute arbitrary code in a privileged context via a crafted app with root privileges.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:H/Au:N/C:C/I:C/A:C)
Weakness: CWE-254
Affected vendors: apple
Affected products: mac_os_x
CVE-2015-7045 (published 2015-12-11)
Keychain Access in Apple OS X before 10.11.2 and tvOS before 9.1 improperly interacts with Keychain Agent, which allows attackers to spoof the Keychain Server via unspecified vectors.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
Weakness: CWE-17
Affected vendors: apple
Affected products: mac_os_x, tvos
CVE-2015-7046 (published 2015-12-11)
The Sandbox feature in xnu in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 does not properly implement privilege separation, which allows attackers to bypass the ASLR protection mechanism via a crafted app with root privileges.
Severity: LOW (CVSS 2.0 vector: AV:N/AC:H/Au:N/C:P/I:N/A:N)
Weakness: CWE-200
Affected vendors: apple
Affected products: iphone_os, mac_os_x, tvos, watchos
CVE-2015-7047 (published 2015-12-11)
The kernel in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows local users to gain privileges via a crafted mach message that is misparsed.
Severity: HIGH (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)
Weakness: CWE-20
Affected vendors: apple
Affected products: iphone_os, mac_os_x, tvos, watchos
CVE-2015-7048 (published 2015-12-11)
WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-7095, CVE-2015-7096, CVE-2015-7097, CVE-2015-7098, CVE-2015-7099, CVE-2015-7100, CVE-2015-7101, CVE-2015-7102, and CVE-2015-7103.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-119
Affected vendors: apple
Affected products: iphone_os, safari, tvos
CVE-2015-7049 (published 2015-12-11)
otools in Apple Xcode before 7.2 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted mach-o file, a different vulnerability than CVE-2015-7057.
Severity: MEDIUM (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:P/I:P/A:P)
Weakness: CWE-119
Affected vendors: apple
Affected products: xcode
CVE-2015-7050 (published 2015-12-11)
WebKit in Apple iOS before 9.2 and Safari before 9.0.2 misparses content extensions, which allows remote attackers to obtain sensitive browsing-history information via a crafted web site.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:N/A:N)
Weakness: CWE-200
Affected vendors: apple
Affected products: iphone_os, safari
CVE-2015-7051 (published 2015-12-11)
MobileStorageMounter in Apple iOS before 9.2 and tvOS before 9.1 mishandles the timing of trust-cache loading, which allows attackers to execute arbitrary code in a privileged context via a crafted app.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-264
Affected vendors: apple
Affected products: iphone_os, tvos
CVE-2015-7052 (published 2015-12-11)
kext tools in Apple OS X before 10.11.2 mishandles kernel-extension loading, which allows local users to gain privileges via unspecified vectors.
Severity: HIGH (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)
Weakness: CWE-264
Affected vendors: apple
Affected products: mac_os_x
CVE-2015-7053 (published 2015-12-11)
ImageIO in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted image.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-119
Affected vendors: apple
Affected products: iphone_os, mac_os_x, tvos, watchos
CVE-2015-7054 (published 2015-12-11)
zlib in the Compression component in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 does not initialize memory for an unspecified data structure, which allows remote attackers to execute arbitrary code via a crafted web site.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-19
Affected vendors: apple
Affected products: iphone_os, mac_os_x, tvos, watchos
CVE-2015-7055 (published 2015-12-11)
AppleMobileFileIntegrity in Apple iOS before 9.2 and tvOS before 9.1 does not prevent changes to access-control structures, which allows attackers to execute arbitrary code in a privileged context via a crafted app.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-284
Affected vendors: apple
Affected products: iphone_os, tvos
CVE-2015-7056 (published 2015-12-11)
IDE SCM in Apple Xcode before 7.2 does not recognize .gitignore files, which allows remote attackers to obtain sensitive information in opportunistic circumstances by leveraging the presence of a file matching an ignore pattern.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
Weakness: CWE-200
Affected vendors: apple
Affected products: xcode
CVE-2015-7057 (published 2015-12-11)
otools in Apple Xcode before 7.2 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted mach-o file, a different vulnerability than CVE-2015-7049.
Severity: MEDIUM (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:P/I:P/A:P)
Weakness: CWE-119
Affected vendors: apple
Affected products: xcode
CVE-2015-7058 (published 2015-12-11)
Apple iOS before 9.2, OS X before 10.11.2, and tvOS before 9.1 improperly validate keychain item ACLs, which allows attackers to obtain access to keychain items via a crafted app.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:N/A:N)
Weakness: CWE-200
Affected vendors: apple
Affected products: iphone_os, mac_os_x, tvos
CVE-2015-7059 (published 2015-12-11)
The ASN.1 decoder in Apple OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted certificate, a different vulnerability than CVE-2015-7060 and CVE-2015-7061.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-119
Affected vendors: apple
Affected products: mac_os_x, tvos, watchos
CVE-2015-7060 (published 2015-12-11)
The ASN.1 decoder in Apple OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted certificate, a different vulnerability than CVE-2015-7059 and CVE-2015-7061.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-119
Affected vendors: apple
Affected products: mac_os_x, tvos, watchos
CVE-2015-7061 (published 2015-12-11)
The ASN.1 decoder in Apple OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted certificate, a different vulnerability than CVE-2015-7059 and CVE-2015-7060.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-119
Affected vendors: apple
Affected products: mac_os_x, tvos, watchos
CVE-2015-7062 (published 2015-12-11)
Apple OS X before 10.11.2 and tvOS before 9.1 allow local users to bypass intended configuration-profile installation restrictions via unspecified vectors.
Severity: MEDIUM (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:P/I:P/A:P)
Weakness: CWE-264
Affected vendors: apple
Affected products: iphone_os, mac_os_x
CVE-2015-7063 (published 2015-12-11)
The kernel loader in EFI in Apple OS X before 10.11.2 allows local users to gain privileges via a crafted pathname.
Severity: HIGH (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)
Weakness: CWE-264
Affected vendors: apple
Affected products: mac_os_x
CVE-2015-7064 (published 2015-12-11)
OpenGL in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2015-7066.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-119
Affected vendors: apple
Affected products: iphone_os, mac_os_x, tvos, watchos
CVE-2015-7065 (published 2015-12-11)
OpenGL in Apple iOS before 9.2, OS X before 10.11.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-119
Affected vendors: apple
Affected products: iphone_os, mac_os_x, tvos
CVE-2015-7066 (published 2015-12-11)
OpenGL in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2015-7064.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-119
Affected vendors: apple
Affected products: iphone_os, mac_os_x, tvos, watchos
CVE-2015-7067 (published 2015-12-11)
IOThunderboltFamily in Apple OS X before 10.11.2 allows local users to cause a denial of service (NULL pointer dereference) via an unspecified userclient type.
Severity: LOW (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:N/I:N/A:P)
Affected vendors: apple
Affected products: mac_os_x
CVE-2015-7068 (published 2015-12-11)
IOKit SCSI in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via an app that provides an unspecified userclient type.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-476
Affected vendors: apple
Affected products: iphone_os, mac_os_x, tvos, watchos
CVE-2015-7069 (published 2015-12-11)
Mobile Replayer in GPUTools Framework in Apple iOS before 9.2 allows attackers to execute arbitrary code in a privileged context via an app that provides a crafted pathname, a different vulnerability than CVE-2015-7070.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
Affected vendors: apple
Affected products: iphone_os
CVE-2015-7070 (published 2015-12-11)
Mobile Replayer in GPUTools Framework in Apple iOS before 9.2 allows attackers to execute arbitrary code in a privileged context via an app that provides a crafted pathname, a different vulnerability than CVE-2015-7069.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
Affected vendors: apple
Affected products: iphone_os
CVE-2015-7071 (published 2015-12-11)
The File Bookmark component in Apple OS X before 10.11.2 allows attackers to bypass a sandbox protection mechanism for app scoped bookmarks via a crafted pathname.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
Weakness: CWE-264
Affected vendors: apple
Affected products: mac_os_x
CVE-2015-7072 (published 2015-12-11)
dyld in Apple iOS before 9.2, tvOS before 9.1, and watchOS before 2.1 mishandles segment validation, which allows attackers to execute arbitrary code in a privileged context via a crafted app.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-20
Affected vendors: apple
Affected products: iphone_os, tvos, watchos
CVE-2015-7073 (published 2015-12-11)
Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted SSL handshake.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-119
Affected vendors: apple
Affected products: iphone_os, mac_os_x, tvos, watchos
CVE-2015-7074 (published 2015-12-11)
CoreMedia Playback in Apple iOS before 9.2, OS X before 10.11.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a malformed media file.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-119
Affected vendors: apple
Affected products: iphone_os, mac_os_x, tvos
CVE-2015-7075 (published 2015-12-11)
CoreMedia Playback in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a malformed media file.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-119
Affected vendors: apple
Affected products: iphone_os, mac_os_x, tvos, watchos
CVE-2015-7076 (published 2015-12-11)
The Intel Graphics Driver component in Apple OS X before 10.11.2 allows local users to gain privileges or cause a denial of service (NULL pointer dereference) via unspecified vectors.
Severity: HIGH (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)
Affected vendors: apple
Affected products: mac_os_x
CVE-2015-7077 (published 2015-12-11)
The Intel Graphics Driver component in Apple OS X before 10.11.2 allows local users to gain privileges or cause a denial of service (out-of-bounds memory access) via unspecified vectors.
Severity: HIGH (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)
Weakness: CWE-119
Affected vendors: apple
Affected products: mac_os_x
CVE-2015-7078 (published 2015-12-11)
Use-after-free vulnerability in Hypervisor in Apple OS X before 10.11.2 allows local users to gain privileges via vectors involving VM objects.
Severity: HIGH (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)
Affected vendors: apple
Affected products: mac_os_x
CVE-2015-7079 (published 2015-12-11)
dyld in Apple iOS before 9.2 and tvOS before 9.1 mishandles segment validation, which allows attackers to execute arbitrary code in a privileged context via a crafted app.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-20
Affected vendors: apple
Affected products: iphone_os, tvos
CVE-2015-7080 (published 2015-12-11)
Siri in Apple iOS before 9.2 allows physically proximate attackers to bypass an intended client-side protection mechanism and obtain sensitive content-notification information by listening to a device in the lock-screen state.
Severity: LOW (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:P/I:N/A:N)
Weakness: CWE-200
Affected vendors: apple
Affected products: iphone_os
CVE-2015-7081 (published 2015-12-11)
iBooks in Apple iOS before 9.2 and OS X before 10.11.2 allows remote attackers to read arbitrary files via an iBooks file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
Affected vendors: apple
Affected products: iphone_os, mac_os_x
CVE-2015-7082 (published 2015-12-11)
Multiple unspecified vulnerabilities in Git before 2.5.4, as used in Apple Xcode before 7.2, have unknown impact and attack vectors.  NOTE: this CVE is associated only with Xcode use cases.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
Affected vendors: apple, git_project
Affected products: git, xcode
CVE-2015-7083 (published 2015-12-11)
The kernel in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-7084.
Severity: HIGH (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)
Weakness: CWE-119
Affected vendors: apple
Affected products: iphone_os, mac_os_x, tvos, watchos
CVE-2015-7084 (published 2015-12-11)
The kernel in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-7083.
Severity: HIGH (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)
Weakness: CWE-119
Affected vendors: apple
Affected products: iphone_os, mac_os_x, tvos, watchos
CVE-2015-7085 (published 2016-01-09)
Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different vulnerability than CVE-2015-7086, CVE-2015-7087, CVE-2015-7088, CVE-2015-7089, CVE-2015-7090, CVE-2015-7091, CVE-2015-7092, and CVE-2015-7117.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H)
Weakness: CWE-119
Affected vendors: apple
Affected products: quicktime
CVE-2015-7086 (published 2016-01-09)
Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different vulnerability than CVE-2015-7085, CVE-2015-7087, CVE-2015-7088, CVE-2015-7089, CVE-2015-7090, CVE-2015-7091, CVE-2015-7092, and CVE-2015-7117.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H)
Weakness: CWE-119
Affected vendors: apple
Affected products: quicktime
CVE-2015-7087 (published 2016-01-09)
Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different vulnerability than CVE-2015-7085, CVE-2015-7086, CVE-2015-7088, CVE-2015-7089, CVE-2015-7090, CVE-2015-7091, CVE-2015-7092, and CVE-2015-7117.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H)
Weakness: CWE-119
Affected vendors: apple
Affected products: quicktime
CVE-2015-7088 (published 2016-01-09)
Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different vulnerability than CVE-2015-7085, CVE-2015-7086, CVE-2015-7087, CVE-2015-7089, CVE-2015-7090, CVE-2015-7091, CVE-2015-7092, and CVE-2015-7117.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H)
Weakness: CWE-119
Affected vendors: apple
Affected products: quicktime
CVE-2015-7089 (published 2016-01-09)
Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different vulnerability than CVE-2015-7085, CVE-2015-7086, CVE-2015-7087, CVE-2015-7088, CVE-2015-7090, CVE-2015-7091, CVE-2015-7092, and CVE-2015-7117.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H)
Weakness: CWE-119
Affected vendors: apple
Affected products: quicktime
CVE-2015-7090 (published 2016-01-09)
Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different vulnerability than CVE-2015-7085, CVE-2015-7086, CVE-2015-7087, CVE-2015-7088, CVE-2015-7089, CVE-2015-7091, CVE-2015-7092, and CVE-2015-7117.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H)
Weakness: CWE-119
Affected vendors: apple
Affected products: quicktime
CVE-2015-7091 (published 2016-01-09)
Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different vulnerability than CVE-2015-7085, CVE-2015-7086, CVE-2015-7087, CVE-2015-7088, CVE-2015-7089, CVE-2015-7090, CVE-2015-7092, and CVE-2015-7117.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H)
Weakness: CWE-119
Affected vendors: apple
Affected products: quicktime
CVE-2015-7092 (published 2016-01-09)
Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow and application crash) via a crafted TXXX frame within an ID3 tag in MP3 data in a movie file, a different vulnerability than CVE-2015-7085, CVE-2015-7086, CVE-2015-7087, CVE-2015-7088, CVE-2015-7089, CVE-2015-7090, CVE-2015-7091, and CVE-2015-7117.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H)
Weakness: CWE-119
Affected vendors: apple
Affected products: quicktime
CVE-2015-7093 (published 2015-12-11)
Safari in Apple iOS before 9.2 allows remote attackers to spoof a URL in the user interface via a crafted web site.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-20
Affected vendors: apple
Affected products: safari
CVE-2015-7094 (published 2015-12-11)
CFNetwork HTTPProtocol in Apple iOS before 9.2 and OS X before 10.11.2 allows man-in-the-middle attackers to bypass the HSTS protection mechanism via a crafted URL.
Severity: LOW (CVSS 2.0 vector: AV:N/AC:H/Au:N/C:N/I:P/A:N)
Weakness: CWE-20
Affected vendors: apple
Affected products: iphone_os, mac_os_x
CVE-2015-7095 (published 2015-12-11)
WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-7048, CVE-2015-7096, CVE-2015-7097, CVE-2015-7098, CVE-2015-7099, CVE-2015-7100, CVE-2015-7101, CVE-2015-7102, and CVE-2015-7103.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-119
Affected vendors: apple
Affected products: iphone_os, safari, tvos
CVE-2015-7096 (published 2015-12-11)
WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-7048, CVE-2015-7095, CVE-2015-7097, CVE-2015-7098, CVE-2015-7099, CVE-2015-7100, CVE-2015-7101, CVE-2015-7102, and CVE-2015-7103.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-119
Affected vendors: apple
Affected products: iphone_os, safari, tvos
CVE-2015-7097 (published 2015-12-11)
WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-7048, CVE-2015-7095, CVE-2015-7096, CVE-2015-7098, CVE-2015-7099, CVE-2015-7100, CVE-2015-7101, CVE-2015-7102, and CVE-2015-7103.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-119
Affected vendors: apple
Affected products: iphone_os, safari, tvos
CVE-2015-7098 (published 2015-12-11)
WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-7048, CVE-2015-7095, CVE-2015-7096, CVE-2015-7097, CVE-2015-7099, CVE-2015-7100, CVE-2015-7101, CVE-2015-7102, and CVE-2015-7103.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-119
Affected vendors: apple
Affected products: iphone_os, safari, tvos
CVE-2015-7099 (published 2015-12-11)
WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-7048, CVE-2015-7095, CVE-2015-7096, CVE-2015-7097, CVE-2015-7098, CVE-2015-7100, CVE-2015-7101, CVE-2015-7102, and CVE-2015-7103.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-119
Affected vendors: apple
Affected products: iphone_os, safari, tvos
CVE-2015-7100 (published 2015-12-11)
WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-7048, CVE-2015-7095, CVE-2015-7096, CVE-2015-7097, CVE-2015-7098, CVE-2015-7099, CVE-2015-7101, CVE-2015-7102, and CVE-2015-7103.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-119
Affected vendors: apple
Affected products: iphone_os, safari, tvos
CVE-2015-7101 (published 2015-12-11)
WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-7048, CVE-2015-7095, CVE-2015-7096, CVE-2015-7097, CVE-2015-7098, CVE-2015-7099, CVE-2015-7100, CVE-2015-7102, and CVE-2015-7103.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-119
Affected vendors: apple
Affected products: iphone_os, safari, tvos
CVE-2015-7102 (published 2015-12-11)
WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-7048, CVE-2015-7095, CVE-2015-7096, CVE-2015-7097, CVE-2015-7098, CVE-2015-7099, CVE-2015-7100, CVE-2015-7101, and CVE-2015-7103.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-119
Affected vendors: apple
Affected products: iphone_os, safari, tvos
CVE-2015-7103 (published 2015-12-11)
WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-7048, CVE-2015-7095, CVE-2015-7096, CVE-2015-7097, CVE-2015-7098, CVE-2015-7099, CVE-2015-7100, CVE-2015-7101, and CVE-2015-7102.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-119
Affected vendors: apple
Affected products: iphone_os, safari, tvos
CVE-2015-7104 (published 2015-12-11)
WebKit in Apple Safari before 9.0.2 and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-119
Affected vendors: apple
Affected products: safari, tvos
CVE-2015-7105 (published 2015-12-11)
CoreGraphics in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-119
Affected vendors: apple
Affected products: iphone_os, mac_os_x, tvos, watchos
CVE-2015-7106 (published 2015-12-11)
The Intel Graphics Driver component in Apple OS X before 10.11.2 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
Severity: HIGH (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)
Weakness: CWE-119
Affected vendors: apple
Affected products: mac_os_x
CVE-2015-7107 (published 2015-12-11)
QuickLook in Apple iOS before 9.2 and OS X before 10.11.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted iWork file.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-119
Affected vendors: apple
Affected products: iphone_os, mac_os_x
CVE-2015-7108 (published 2015-12-11)
The Bluetooth HCI interface in Apple OS X before 10.11.2 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
Severity: HIGH (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)
Weakness: CWE-119
Affected vendors: apple
Affected products: mac_os_x
CVE-2015-7109 (published 2015-12-11)
IOAcceleratorFamily in Apple OS X before 10.11.2 and tvOS before 9.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-119
Affected vendors: apple
Affected products: iphone_os, mac_os_x
CVE-2015-7110 (published 2015-12-11)
The Disk Images component in Apple OS X before 10.11.2 and tvOS before 9.1 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted disk image.
Severity: MEDIUM (CVSS 2.0 vector: AV:L/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-119
Affected vendors: apple
Affected products: iphone_os, mac_os_x
CVE-2015-7111 (published 2015-12-11)
The IOHIDFamily API in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2015-7112.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-119
Affected vendors: apple
Affected products: iphone_os, mac_os_x, tvos, watchos
CVE-2015-7112 (published 2015-12-11)
The IOHIDFamily API in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2015-7111.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
Weakness: CWE-119
Affected vendors: apple
Affected products: iphone_os, mac_os_x, tvos, watchos
CVE-2015-7113 (published 2015-12-11)
The LaunchServices component in Apple iOS before 9.2 and watchOS before 2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a malformed plist.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
Weakness: CWE-119
Affected vendors: apple
Affected products: iphone_os, watchos
CVE-2015-7115 (published 2016-01-10)
libxml2 in Apple iOS before 9.2, OS X before 10.11.2, and tvOS before 9.1 allows remote attackers to obtain sensitive information or cause a denial of service (memory corruption) via a crafted XML document, a different vulnerability than CVE-2015-7116.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)
Weakness: CWE-119
Affected vendors: apple
Affected products: iphone_os, mac_os_x, tvos
CVE-2015-7116 (published 2016-01-10)
libxml2 in Apple iOS before 9.2, OS X before 10.11.2, and tvOS before 9.1 allows remote attackers to obtain sensitive information or cause a denial of service (memory corruption) via a crafted XML document, a different vulnerability than CVE-2015-7115.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)
Weakness: CWE-119
Affected vendors: apple
Affected products: iphone_os, mac_os_x, tvos
CVE-2015-7117 (published 2016-01-09)
Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different vulnerability than CVE-2015-7085, CVE-2015-7086, CVE-2015-7087, CVE-2015-7088, CVE-2015-7089, CVE-2015-7090, CVE-2015-7091, and CVE-2015-7092.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H)
Weakness: CWE-119
Affected vendors: apple
Affected products: quicktime
CVE-2015-7174 (published 2015-09-24)
The nsAttrAndChildArray::GrowBy function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors, related to an "overflow."
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Weakness: CWE-119
Affected vendors: mozilla
Affected products: firefox
CVE-2015-7175 (published 2015-09-24)
The XULContentSinkImpl::AddText function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors, related to an "overflow."
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Weakness: CWE-119
Affected vendors: mozilla
Affected products: firefox
CVE-2015-7176 (published 2015-09-24)
The AnimationThread function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 uses an incorrect argument to the sscanf function, which might allow remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via unknown vectors.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Weakness: CWE-119
Affected vendors: mozilla
Affected products: firefox
CVE-2015-7177 (published 2015-09-24)
The InitTextures function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Weakness: CWE-119
Affected vendors: mozilla
Affected products: firefox
CVE-2015-7178 (published 2015-09-24)
The ProgramBinary::linkAttributes function in libGLES in ANGLE, as used in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 on Windows, mishandles shader access, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via crafted (1) OpenGL or (2) WebGL content.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Weakness: CWE-119
Affected vendors: microsoft, mozilla
Affected products: firefox, windows