deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-8447
Published: 2015-12-10
Description: Use-after-free vulnerability in the Color object implementation in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via crafted setTransform arguments, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
CVSS Score: 9.3 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00008.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00012.html
CVE: CVE-2015-8448
Published: 2015-12-10
Description: Use-after-free vulnerability in the DisplacementMapFilter object implementation in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via a crafted mapBitmap property value, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
CVSS Score: 9.3 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00008.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00012.html
CVE: CVE-2015-8449
Published: 2015-12-10
Description: Use-after-free vulnerability in the MovieClip object implementation in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via a crafted lineTo method call, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
CVSS Score: 9.3 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00008.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00012.html
CVE: CVE-2015-8450
Published: 2015-12-10
Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via a crafted filters property value in a TextField object, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8452, and CVE-2015-8454.
CVSS Score: 9.3 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00008.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00012.html
CVE: CVE-2015-8451
Published: 2015-12-10
Description: Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-8045, CVE-2015-8047, CVE-2015-8060, CVE-2015-8408, CVE-2015-8416, CVE-2015-8417, CVE-2015-8418, CVE-2015-8419, CVE-2015-8443, CVE-2015-8444, and CVE-2015-8455.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00008.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00012.html
CVE: CVE-2015-8452
Published: 2015-12-10
Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, and CVE-2015-8454.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00008.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00012.html
CVE: CVE-2015-8453
Published: 2015-12-10
Description: Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allow attackers to bypass the ASLR protection mechanism via JIT data, a different vulnerability than CVE-2015-8409 and CVE-2015-8440.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00008.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00012.html
CVE: CVE-2015-8454
Published: 2015-12-10
Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, and CVE-2015-8452.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00008.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00012.html
CVE: CVE-2015-8455
Published: 2015-12-10
Description: Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-8045, CVE-2015-8047, CVE-2015-8060, CVE-2015-8408, CVE-2015-8416, CVE-2015-8417, CVE-2015-8418, CVE-2015-8419, CVE-2015-8443, CVE-2015-8444, and CVE-2015-8451.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00008.html; http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00012.html
CVE: CVE-2015-8456
Published: 2015-12-10
Description: Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-8439.
CVSS Score: 9.3 (HIGH)
References: http://www.securityfocus.com/bid/78802; http://www.securitytracker.com/id/1034318; https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05356388
CVE: CVE-2015-8457
Published: 2015-12-10
Description: Stack-based buffer overflow in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8407.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/78802; http://www.securitytracker.com/id/1034318; http://www.zerodayinitiative.com/advisories/ZDI-15-636
CVE: CVE-2015-7001
Published: 2015-12-11
Description: AppSandbox in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 mishandles hard links, which allows attackers to bypass Contacts access revocation via a crafted app.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2015/Dec/msg00000.html; http://lists.apple.com/archives/security-announce/2015/Dec/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Dec/msg00002.html
CVE: CVE-2015-7037
Published: 2015-12-11
Description: Directory traversal vulnerability in Mobile Backup in Photos in Apple iOS before 9.2 allows attackers to read arbitrary files via a crafted pathname.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://lists.apple.com/archives/security-announce/2015/Dec/msg00000.html; http://www.securitytracker.com/id/1034348; https://support.apple.com/HT205635
CVE: CVE-2015-7038
Published: 2015-12-11
Description: Buffer overflow in libc in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows remote attackers to execute arbitrary code via a crafted package, a different vulnerability than CVE-2015-7039.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Dec/msg00000.html; http://lists.apple.com/archives/security-announce/2015/Dec/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Dec/msg00002.html
CVE: CVE-2015-7039
Published: 2015-12-11
Description: Buffer overflow in libc in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows remote attackers to execute arbitrary code via a crafted package, a different vulnerability than CVE-2015-7038.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Dec/msg00000.html; http://lists.apple.com/archives/security-announce/2015/Dec/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Dec/msg00002.html
CVE: CVE-2015-7040
Published: 2015-12-11
Description: The kernel in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows attackers to cause a denial of service via a crafted app, a different vulnerability than CVE-2015-7041, CVE-2015-7042, and CVE-2015-7043.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2015/Dec/msg00000.html; http://lists.apple.com/archives/security-announce/2015/Dec/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Dec/msg00002.html
CVE: CVE-2015-7041
Published: 2015-12-11
Description: The kernel in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows attackers to cause a denial of service via a crafted app, a different vulnerability than CVE-2015-7040, CVE-2015-7042, and CVE-2015-7043.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2015/Dec/msg00000.html; http://lists.apple.com/archives/security-announce/2015/Dec/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Dec/msg00002.html
CVE: CVE-2015-7042
Published: 2015-12-11
Description: The kernel in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows attackers to cause a denial of service via a crafted app, a different vulnerability than CVE-2015-7040, CVE-2015-7041, and CVE-2015-7043.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2015/Dec/msg00000.html; http://lists.apple.com/archives/security-announce/2015/Dec/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Dec/msg00002.html
CVE: CVE-2015-7043
Published: 2015-12-11
Description: The kernel in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows attackers to cause a denial of service via a crafted app, a different vulnerability than CVE-2015-7040, CVE-2015-7041, and CVE-2015-7042.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2015/Dec/msg00000.html; http://lists.apple.com/archives/security-announce/2015/Dec/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Dec/msg00002.html
CVE: CVE-2015-7044
Published: 2015-12-11
Description: The System Integrity Protection feature in Apple OS X before 10.11.2 mishandles union mounts, which allows attackers to execute arbitrary code in a privileged context via a crafted app with root privileges.
CVSS Score: 7.6 (HIGH)
CWE: CWE-254
References: http://lists.apple.com/archives/security-announce/2015/Dec/msg00005.html; http://www.securitytracker.com/id/1034344; https://support.apple.com/HT205637
CVE: CVE-2015-7045
Published: 2015-12-11
Description: Keychain Access in Apple OS X before 10.11.2 and tvOS before 9.1 improperly interacts with Keychain Agent, which allows attackers to spoof the Keychain Server via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-17
References: http://lists.apple.com/archives/security-announce/2015/Dec/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Dec/msg00005.html; http://www.securitytracker.com/id/1034344
CVE: CVE-2015-7046
Published: 2015-12-11
Description: The Sandbox feature in xnu in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 does not properly implement privilege separation, which allows attackers to bypass the ASLR protection mechanism via a crafted app with root privileges.
CVSS Score: 2.6 (LOW)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2015/Dec/msg00000.html; http://lists.apple.com/archives/security-announce/2015/Dec/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Dec/msg00002.html
CVE: CVE-2015-7047
Published: 2015-12-11
Description: The kernel in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows local users to gain privileges via a crafted mach message that is misparsed.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2015/Dec/msg00000.html; http://lists.apple.com/archives/security-announce/2015/Dec/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Dec/msg00002.html
CVE: CVE-2015-7048
Published: 2015-12-11
Description: WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-7095, CVE-2015-7096, CVE-2015-7097, CVE-2015-7098, CVE-2015-7099, CVE-2015-7100, CVE-2015-7101, CVE-2015-7102, and CVE-2015-7103.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Dec/msg00000.html; http://lists.apple.com/archives/security-announce/2015/Dec/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Dec/msg00003.html
CVE: CVE-2015-7049
Published: 2015-12-11
Description: otools in Apple Xcode before 7.2 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted mach-o file, a different vulnerability than CVE-2015-7057.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Dec/msg00004.html; http://www.securitytracker.com/id/1034340; https://support.apple.com/HT205642
CVE: CVE-2015-7050
Published: 2015-12-11
Description: WebKit in Apple iOS before 9.2 and Safari before 9.0.2 misparses content extensions, which allows remote attackers to obtain sensitive browsing-history information via a crafted web site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2015/Dec/msg00000.html; http://lists.apple.com/archives/security-announce/2015/Dec/msg00003.html; http://www.securityfocus.com/bid/78722
CVE: CVE-2015-7051
Published: 2015-12-11
Description: MobileStorageMounter in Apple iOS before 9.2 and tvOS before 9.1 mishandles the timing of trust-cache loading, which allows attackers to execute arbitrary code in a privileged context via a crafted app.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2015/Dec/msg00000.html; http://lists.apple.com/archives/security-announce/2015/Dec/msg00001.html; http://www.securitytracker.com/id/1034348
CVE: CVE-2015-7052
Published: 2015-12-11
Description: kext tools in Apple OS X before 10.11.2 mishandles kernel-extension loading, which allows local users to gain privileges via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2015/Dec/msg00005.html; http://www.securitytracker.com/id/1034344; https://support.apple.com/HT205637
CVE: CVE-2015-7053
Published: 2015-12-11
Description: ImageIO in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted image.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Dec/msg00000.html; http://lists.apple.com/archives/security-announce/2015/Dec/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Dec/msg00002.html
CVE: CVE-2015-7054
Published: 2015-12-11
Description: zlib in the Compression component in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 does not initialize memory for an unspecified data structure, which allows remote attackers to execute arbitrary code via a crafted web site.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-19
References: http://lists.apple.com/archives/security-announce/2015/Dec/msg00000.html; http://lists.apple.com/archives/security-announce/2015/Dec/msg00001.html; http://lists.apple.com/archives/security-announce/2015/Dec/msg00002.html
CVE: CVE-2015-7055
Published: 2015-12-11
Description: AppleMobileFileIntegrity in Apple iOS before 9.2 and tvOS before 9.1 does not prevent changes to access-control structures, which allows attackers to execute arbitrary code in a privileged context via a crafted app.
CVSS Score: 9.3 (HIGH)
CWE: CWE-284
References: http://lists.apple.com/archives/security-announce/2015/Dec/msg00000.html; http://lists.apple.com/archives/security-announce/2015/Dec/msg00001.html; http://www.securitytracker.com/id/1034348
CVE: CVE-2015-7056
Published: 2015-12-11
Description: IDE SCM in Apple Xcode before 7.2 does not recognize .gitignore files, which allows remote attackers to obtain sensitive information in opportunistic circumstances by leveraging the presence of a file matching an ignore pattern.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2015/Dec/msg00004.html; http://www.securitytracker.com/id/1034340; https://support.apple.com/HT205642
CVE: CVE-2015-7057
Published: 2015-12-11
Description: otools in Apple Xcode before 7.2 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted mach-o file, a different vulnerability than CVE-2015-7049.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Dec/msg00004.html; http://www.securitytracker.com/id/1034340; https://support.apple.com/HT205642