deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-3660
Published: 2015-07-03
Description: Cross-site scripting (XSS) vulnerability in the PDF functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL in embedded PDF content.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00004.html; http://lists.opensuse.org/opensuse-updates/2016-03/msg00054.html; http://support.apple.com/kb/HT204950
CVE: CVE-2015-3661
Published: 2015-07-03
Description: QT Media Foundation in Apple QuickTime before 7.7.7, as used in OS X before 10.10.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted file, a different vulnerability than CVE-2015-3662, CVE-2015-3663, CVE-2015-3666, CVE-2015-3667, and CVE-2015-3668.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://lists.apple.com/archives/security-announce/2015/Jun/msg00005.html; http://support.apple.com/kb/HT204942
CVE: CVE-2015-3662
Published: 2015-07-03
Description: QT Media Foundation in Apple QuickTime before 7.7.7, as used in OS X before 10.10.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted file, a different vulnerability than CVE-2015-3661, CVE-2015-3663, CVE-2015-3666, CVE-2015-3667, and CVE-2015-3668.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://lists.apple.com/archives/security-announce/2015/Jun/msg00005.html; http://support.apple.com/kb/HT204942
CVE: CVE-2015-3663
Published: 2015-07-03
Description: QT Media Foundation in Apple QuickTime before 7.7.7, as used in OS X before 10.10.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted file, a different vulnerability than CVE-2015-3661, CVE-2015-3662, CVE-2015-3666, CVE-2015-3667, and CVE-2015-3668.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://lists.apple.com/archives/security-announce/2015/Jun/msg00005.html; http://support.apple.com/kb/HT204942
CVE: CVE-2015-3664
Published: 2015-07-03
Description: QT Media Foundation in Apple QuickTime before 7.7.7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted file, a different vulnerability than CVE-2015-3665 and CVE-2015-3669.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00005.html; http://support.apple.com/kb/HT204947; http://www.securityfocus.com/bid/75499
CVE: CVE-2015-3665
Published: 2015-07-03
Description: QT Media Foundation in Apple QuickTime before 7.7.7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted file, a different vulnerability than CVE-2015-3664 and CVE-2015-3669.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00005.html; http://support.apple.com/kb/HT204947; http://www.securityfocus.com/bid/75498
CVE: CVE-2015-3666
Published: 2015-07-03
Description: QT Media Foundation in Apple QuickTime before 7.7.7, as used in OS X before 10.10.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted file, a different vulnerability than CVE-2015-3661, CVE-2015-3662, CVE-2015-3663, CVE-2015-3667, and CVE-2015-3668.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://lists.apple.com/archives/security-announce/2015/Jun/msg00005.html; http://support.apple.com/kb/HT204942
CVE: CVE-2015-3667
Published: 2015-07-03
Description: QT Media Foundation in Apple QuickTime before 7.7.7, as used in OS X before 10.10.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted file, a different vulnerability than CVE-2015-3661, CVE-2015-3662, CVE-2015-3663, CVE-2015-3666, and CVE-2015-3668.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://lists.apple.com/archives/security-announce/2015/Jun/msg00005.html; http://support.apple.com/kb/HT204942
CVE: CVE-2015-3668
Published: 2015-07-03
Description: QT Media Foundation in Apple QuickTime before 7.7.7, as used in OS X before 10.10.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted file, a different vulnerability than CVE-2015-3661, CVE-2015-3662, CVE-2015-3663, CVE-2015-3666, and CVE-2015-3667.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://lists.apple.com/archives/security-announce/2015/Jun/msg00005.html; http://support.apple.com/kb/HT204942
CVE: CVE-2015-3669
Published: 2015-07-03
Description: QT Media Foundation in Apple QuickTime before 7.7.7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted file, a different vulnerability than CVE-2015-3664 and CVE-2015-3665.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00005.html; http://support.apple.com/kb/HT204947; http://www.securityfocus.com/bid/75497
CVE: CVE-2015-3671
Published: 2015-07-03
Description: Admin Framework in Apple OS X before 10.10.4 does not properly verify XPC entitlements, which allows local users to bypass authentication and obtain admin privileges via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-284
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://support.apple.com/kb/HT204942; http://www.securityfocus.com/bid/75493
CVE: CVE-2015-3672
Published: 2015-07-03
Description: Admin Framework in Apple OS X before 10.10.4 does not properly handle authentication errors, which allows local users to obtain admin privileges via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-284
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://support.apple.com/kb/HT204942; http://www.securityfocus.com/bid/75493
CVE: CVE-2015-3673
Published: 2015-07-03
Description: Admin Framework in Apple OS X before 10.10.4 does not properly restrict the location of writeconfig clients, which allows local users to obtain root privileges by moving and then modifying Directory Utility.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://support.apple.com/kb/HT204942; http://www.securityfocus.com/bid/75493
CVE: CVE-2015-3674
Published: 2015-07-03
Description: afpserver in Apple OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://support.apple.com/kb/HT204942; http://www.securityfocus.com/bid/75493
CVE: CVE-2015-3675
Published: 2015-07-03
Description: The default configuration of the Apache HTTP Server on Apple OS X before 10.10.4 does not enable the mod_hfs_apple module, which allows remote attackers to bypass HTTP authentication via a crafted URL.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-284
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://support.apple.com/kb/HT204942; http://www.securityfocus.com/bid/75493
CVE: CVE-2015-3676
Published: 2015-07-03
Description: AppleGraphicsControl in Apple OS X before 10.10.4 allows attackers to obtain sensitive memory-layout information via a crafted app.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://support.apple.com/kb/HT204942; http://www.securityfocus.com/bid/75493
CVE: CVE-2015-3677
Published: 2015-07-03
Description: The LZVN compression feature in AppleFSCompression in Apple OS X before 10.10.4 allows attackers to obtain sensitive memory-layout information for the kernel via a crafted app.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://support.apple.com/kb/HT204942; http://www.securityfocus.com/bid/75493
CVE: CVE-2015-3678
Published: 2015-07-03
Description: AppleThunderboltEDMService in Apple OS X before 10.10.4 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified Thunderbolt commands.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://support.apple.com/kb/HT204942; http://www.securityfocus.com/bid/75493
CVE: CVE-2015-3679
Published: 2015-07-03
Description: Apple Type Services (ATS) in Apple OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-3680, CVE-2015-3681, and CVE-2015-3682.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://support.apple.com/kb/HT204942; http://www.securityfocus.com/bid/75493
CVE: CVE-2015-3680
Published: 2015-07-03
Description: Apple Type Services (ATS) in Apple OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-3679, CVE-2015-3681, and CVE-2015-3682.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://support.apple.com/kb/HT204942; http://www.securityfocus.com/bid/75493
CVE: CVE-2015-3681
Published: 2015-07-03
Description: Apple Type Services (ATS) in Apple OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-3679, CVE-2015-3680, and CVE-2015-3682.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://support.apple.com/kb/HT204942; http://www.securityfocus.com/bid/75493
CVE: CVE-2015-3682
Published: 2015-07-03
Description: Apple Type Services (ATS) in Apple OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-3679, CVE-2015-3680, and CVE-2015-3681.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://support.apple.com/kb/HT204942; http://www.securityfocus.com/bid/75493
CVE: CVE-2015-3683
Published: 2015-07-03
Description: The Bluetooth HCI interface implementation in Apple OS X before 10.10.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://support.apple.com/kb/HT204942; http://www.securityfocus.com/bid/75493
CVE: CVE-2015-3684
Published: 2015-07-03
Description: The HTTPAuthentication implementation in CFNetwork in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted credentials in a URL.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://support.apple.com/kb/HT204941
CVE: CVE-2015-3685
Published: 2015-07-03
Description: CoreText in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted text file, a different vulnerability than CVE-2015-3686, CVE-2015-3687, CVE-2015-3688, and CVE-2015-3689.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://support.apple.com/kb/HT204941
CVE: CVE-2015-3686
Published: 2015-07-03
Description: CoreText in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted text file, a different vulnerability than CVE-2015-3685, CVE-2015-3687, CVE-2015-3688, and CVE-2015-3689.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://lists.apple.com/archives/security-announce/2015/Sep/msg00003.html
CVE: CVE-2015-3687
Published: 2015-07-03
Description: CoreText in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted text file, a different vulnerability than CVE-2015-3685, CVE-2015-3686, CVE-2015-3688, and CVE-2015-3689.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://lists.apple.com/archives/security-announce/2015/Sep/msg00003.html
CVE: CVE-2015-3688
Published: 2015-07-03
Description: CoreText in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted text file, a different vulnerability than CVE-2015-3685, CVE-2015-3686, CVE-2015-3687, and CVE-2015-3689.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://lists.apple.com/archives/security-announce/2015/Sep/msg00003.html
CVE: CVE-2015-3689
Published: 2015-07-03
Description: CoreText in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted text file, a different vulnerability than CVE-2015-3685, CVE-2015-3686, CVE-2015-3687, and CVE-2015-3688.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://support.apple.com/kb/HT204941
CVE: CVE-2015-3690
Published: 2015-07-03
Description: The DiskImages subsystem in Apple iOS before 8.4 and OS X before 10.10.4 allows attackers to obtain sensitive memory-layout information for the kernel via a crafted app.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://support.apple.com/kb/HT204941
CVE: CVE-2015-3691
Published: 2015-07-03
Description: The Monitor Control Command Set kernel extension in the Display Drivers subsystem in Apple OS X before 10.10.4 allows attackers to execute arbitrary code in a privileged context via a crafted app that leverages control of a function pointer.
CVSS Score: 9.3 (HIGH)
CWE: CWE-284
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://support.apple.com/kb/HT204942; http://www.securityfocus.com/bid/75493
CVE: CVE-2015-3692
Published: 2015-07-03
Description: Apple Mac EFI before 2015-001, as used in OS X before 10.10.4 and other products, does not enforce a locking protection mechanism upon being woken from sleep, which allows local users to conduct EFI flash attacks by leveraging root privileges.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-284
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://lists.apple.com/archives/security-announce/2015/Jun/msg00003.html; http://support.apple.com/kb/HT204934
CVE: CVE-2015-3693
Published: 2015-07-03
Description: Apple Mac EFI before 2015-001, as used in OS X before 10.10.4 and other products, does not properly set refresh rates for DDR3 RAM, which might make it easier for remote attackers to conduct row-hammer attacks, and consequently gain privileges or cause a denial of service (memory corruption), by triggering certain patterns of access to memory locations.
CVSS Score: 9.3 (HIGH)
CWE: CWE-254
References: http://googleprojectzero.blogspot.com/2015/03/exploiting-dram-rowhammer-bug-to-gain.html; http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://lists.apple.com/archives/security-announce/2015/Jun/msg00003.html
CVE: CVE-2015-3694
Published: 2015-07-03
Description: FontParser in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-3719.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://support.apple.com/kb/HT204941
CVE: CVE-2015-3695
Published: 2015-07-03
Description: Buffer overflow in the Intel Graphics Driver in Apple OS X before 10.10.4 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-3696, CVE-2015-3697, CVE-2015-3698, CVE-2015-3699, CVE-2015-3700, CVE-2015-3701, and CVE-2015-3702.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://support.apple.com/kb/HT204942; http://www.securityfocus.com/bid/75493
CVE: CVE-2015-3696
Published: 2015-07-03
Description: Buffer overflow in the Intel Graphics Driver in Apple OS X before 10.10.4 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-3695, CVE-2015-3697, CVE-2015-3698, CVE-2015-3699, CVE-2015-3700, CVE-2015-3701, and CVE-2015-3702.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://support.apple.com/kb/HT204942; http://www.securityfocus.com/bid/75493
CVE: CVE-2015-3697
Published: 2015-07-03
Description: Buffer overflow in the Intel Graphics Driver in Apple OS X before 10.10.4 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-3695, CVE-2015-3696, CVE-2015-3698, CVE-2015-3699, CVE-2015-3700, CVE-2015-3701, and CVE-2015-3702.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://support.apple.com/kb/HT204942; http://www.securityfocus.com/bid/75493
CVE: CVE-2015-3698
Published: 2015-07-03
Description: Buffer overflow in the Intel Graphics Driver in Apple OS X before 10.10.4 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-3695, CVE-2015-3696, CVE-2015-3697, CVE-2015-3699, CVE-2015-3700, CVE-2015-3701, and CVE-2015-3702.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://support.apple.com/kb/HT204942; http://www.securityfocus.com/bid/75493
CVE: CVE-2015-3699
Published: 2015-07-03
Description: Buffer overflow in the Intel Graphics Driver in Apple OS X before 10.10.4 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-3695, CVE-2015-3696, CVE-2015-3697, CVE-2015-3698, CVE-2015-3700, CVE-2015-3701, and CVE-2015-3702.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://support.apple.com/kb/HT204942; http://www.securityfocus.com/bid/75493
CVE: CVE-2015-3700
Published: 2015-07-03
Description: Buffer overflow in the Intel Graphics Driver in Apple OS X before 10.10.4 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-3695, CVE-2015-3696, CVE-2015-3697, CVE-2015-3698, CVE-2015-3699, CVE-2015-3701, and CVE-2015-3702.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://support.apple.com/kb/HT204942; http://www.securityfocus.com/bid/75493
CVE: CVE-2015-3701
Published: 2015-07-03
Description: Buffer overflow in the Intel Graphics Driver in Apple OS X before 10.10.4 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-3695, CVE-2015-3696, CVE-2015-3697, CVE-2015-3698, CVE-2015-3699, CVE-2015-3700, and CVE-2015-3702.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://support.apple.com/kb/HT204942; http://www.securityfocus.com/bid/75493
CVE: CVE-2015-3702
Published: 2015-07-03
Description: Buffer overflow in the Intel Graphics Driver in Apple OS X before 10.10.4 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-3695, CVE-2015-3696, CVE-2015-3697, CVE-2015-3698, CVE-2015-3699, CVE-2015-3700, and CVE-2015-3701.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://support.apple.com/kb/HT204942; http://www.securityfocus.com/bid/75493
CVE: CVE-2015-3703
Published: 2015-07-03
Description: ImageIO in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted TIFF image.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://support.apple.com/kb/HT204941
CVE: CVE-2015-3704
Published: 2015-07-03
Description: runner in Install.framework in the Install Framework Legacy subsystem in Apple OS X before 10.10.4 does not properly drop privileges, which allows attackers to execute arbitrary code in a privileged context via a crafted app.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://packetstormsecurity.com/files/133547/OS-X-Privilege-Escalation.html; http://support.apple.com/kb/HT204942
CVE: CVE-2015-3705
Published: 2015-07-03
Description: IOAcceleratorFamily in Apple OS X before 10.10.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2015-3706.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://support.apple.com/kb/HT204942; http://www.securityfocus.com/bid/75493
CVE: CVE-2015-3706
Published: 2015-07-03
Description: IOAcceleratorFamily in Apple OS X before 10.10.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2015-3705.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html; http://support.apple.com/kb/HT204942; http://www.securityfocus.com/bid/75493