deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-7686
Published: 2015-10-06
Description: Algorithmic complexity vulnerability in Address.pm in the Email-Address module 1.908 and earlier for Perl allows remote attackers to cause a denial of service (CPU consumption) via a crafted string containing a list of e-mail addresses in conjunction with parenthesis characters that can be associated with nested comments. NOTE: the default configuration in 1.908 mitigates this vulnerability but misparses certain realistic comments.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-399
References: http://www.openwall.com/lists/oss-security/2015/09/27/1; http://www.openwall.com/lists/oss-security/2015/10/02/13; https://forum.bestpractical.com/t/security-vulnerabilities-in-rt-2017-06-15/32016
CVE: CVE-2015-3823
Published: 2015-10-06
Description: libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 21335999.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: https://groups.google.com/forum/message/raw?msg=android-security-updates/_Rm-lKnS2M8/dGTcilt0CAAJ; https://groups.google.com/forum/message/raw?msg=android-security-updates/_Rm-lKnS2M8/dGTcilt0CAAJ
CVE: CVE-2015-3847
Published: 2015-10-06
Description: Bluetooth in Android before 5.1.1 LMY48T allows attackers to remove stored SMS messages via a crafted application, aka internal bug 22343270.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: https://groups.google.com/forum/message/raw?msg=android-security-updates/_Rm-lKnS2M8/dGTcilt0CAAJ; https://groups.google.com/forum/message/raw?msg=android-security-updates/_Rm-lKnS2M8/dGTcilt0CAAJ
CVE: CVE-2015-3862
Published: 2015-10-06
Description: mediaserver in Android before 5.1.1 LMY48T allows attackers to cause a denial of service (process crash) via unspecified vectors, aka internal bug 22954006.
CVSS Score: 5.0 (MEDIUM)
References: https://groups.google.com/forum/message/raw?msg=android-security-updates/_Rm-lKnS2M8/dGTcilt0CAAJ; https://groups.google.com/forum/message/raw?msg=android-security-updates/_Rm-lKnS2M8/dGTcilt0CAAJ
CVE: CVE-2015-3865
Published: 2015-10-06
Description: The Runtime subsystem in Android before 5.1.1 LMY48T allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 23050463.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: https://groups.google.com/forum/message/raw?msg=android-security-updates/_Rm-lKnS2M8/dGTcilt0CAAJ; https://groups.google.com/forum/message/raw?msg=android-security-updates/_Rm-lKnS2M8/dGTcilt0CAAJ
CVE: CVE-2015-3867
Published: 2015-10-06
Description: libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23213430.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: https://groups.google.com/forum/message/raw?msg=android-security-updates/_Rm-lKnS2M8/dGTcilt0CAAJ; https://groups.google.com/forum/message/raw?msg=android-security-updates/_Rm-lKnS2M8/dGTcilt0CAAJ
CVE: CVE-2015-3868
Published: 2015-10-06
Description: libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23270724.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://packetstormsecurity.com/files/134132/Libstagefright-Saio-Tag-Integer-Overflow-Heap-Corruption.html; https://groups.google.com/forum/message/raw?msg=android-security-updates/_Rm-lKnS2M8/dGTcilt0CAAJ; http://packetstormsecurity.com/files/134132/Libstagefright-Saio-Tag-Integer-Overflow-Heap-Corruption.html
CVE: CVE-2015-3869
Published: 2015-10-06
Description: libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23036083.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: https://groups.google.com/forum/message/raw?msg=android-security-updates/_Rm-lKnS2M8/dGTcilt0CAAJ; https://groups.google.com/forum/message/raw?msg=android-security-updates/_Rm-lKnS2M8/dGTcilt0CAAJ
CVE: CVE-2015-3870
Published: 2015-10-06
Description: libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 22771132.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: https://groups.google.com/forum/message/raw?msg=android-security-updates/_Rm-lKnS2M8/dGTcilt0CAAJ; https://groups.google.com/forum/message/raw?msg=android-security-updates/_Rm-lKnS2M8/dGTcilt0CAAJ
CVE: CVE-2015-3871
Published: 2015-10-06
Description: libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23031033.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: https://groups.google.com/forum/message/raw?msg=android-security-updates/_Rm-lKnS2M8/dGTcilt0CAAJ; https://groups.google.com/forum/message/raw?msg=android-security-updates/_Rm-lKnS2M8/dGTcilt0CAAJ
CVE: CVE-2015-3872
Published: 2015-10-06
Description: libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23346388.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: https://groups.google.com/forum/message/raw?msg=android-security-updates/_Rm-lKnS2M8/dGTcilt0CAAJ; https://groups.google.com/forum/message/raw?msg=android-security-updates/_Rm-lKnS2M8/dGTcilt0CAAJ
CVE: CVE-2015-3873
Published: 2015-10-06
Description: libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bugs 23016072, 23248776, 23247055, 22845824, 22008959, 21814993, 21048776, 20718524, 20674674, 22388975, 20674086, 21443020, and 22077698, a different vulnerability than CVE-2015-7716.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: https://groups.google.com/forum/message/raw?msg=android-security-updates/_Rm-lKnS2M8/dGTcilt0CAAJ; https://groups.google.com/forum/message/raw?msg=android-security-updates/_Rm-lKnS2M8/dGTcilt0CAAJ
CVE: CVE-2015-3874
Published: 2015-10-06
Description: The Sonivox components in Android before 5.1.1 LMY48T allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bugs 23335715, 23307276, and 23286323.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: https://groups.google.com/forum/message/raw?msg=android-security-updates/_Rm-lKnS2M8/dGTcilt0CAAJ; https://groups.google.com/forum/message/raw?msg=android-security-updates/_Rm-lKnS2M8/dGTcilt0CAAJ
CVE: CVE-2015-3875
Published: 2015-10-06
Description: libutils in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted audio file, aka internal bug 22952485.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: https://groups.google.com/forum/message/raw?msg=android-security-updates/_Rm-lKnS2M8/dGTcilt0CAAJ; https://groups.google.com/forum/message/raw?msg=android-security-updates/_Rm-lKnS2M8/dGTcilt0CAAJ
CVE: CVE-2015-3877
Published: 2015-10-06
Description: Skia, as used in Android before 5.1.1 LMY48T, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 20723696.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: https://groups.google.com/forum/message/raw?msg=android-security-updates/_Rm-lKnS2M8/dGTcilt0CAAJ; https://groups.google.com/forum/message/raw?msg=android-security-updates/_Rm-lKnS2M8/dGTcilt0CAAJ
CVE: CVE-2015-3878
Published: 2015-10-06
Description: Media Projection in Android 5.x before 5.1.1 LMY48T and 6.0 before 2015-10-01 allows attackers to bypass an intended screen-recording warning feature and obtain sensitive screen-snapshot information via a crafted application that references a long application name, aka internal bug 23345192.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: https://groups.google.com/forum/message/raw?msg=android-security-updates/_Rm-lKnS2M8/dGTcilt0CAAJ; https://groups.google.com/forum/message/raw?msg=android-security-updates/_Rm-lKnS2M8/dGTcilt0CAAJ
CVE: CVE-2015-3879
Published: 2015-10-06
Description: Media Player Framework in Android before 5.1.1 LMY48T allows attackers to gain privileges via a crafted application, aka internal bug 23223325.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: https://groups.google.com/forum/message/raw?msg=android-security-updates/_Rm-lKnS2M8/dGTcilt0CAAJ; https://groups.google.com/forum/message/raw?msg=android-security-updates/_Rm-lKnS2M8/dGTcilt0CAAJ
CVE: CVE-2015-6596
Published: 2015-10-06
Description: mediaserver in Android before 5.1.1 LMY48T allows attackers to gain privileges via a crafted application, aka internal bugs 20731946 and 20719651, a different vulnerability than CVE-2015-7717.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: https://groups.google.com/forum/message/raw?msg=android-security-updates/_Rm-lKnS2M8/dGTcilt0CAAJ; https://groups.google.com/forum/message/raw?msg=android-security-updates/_Rm-lKnS2M8/dGTcilt0CAAJ
CVE: CVE-2015-6598
Published: 2015-10-06
Description: libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23306638.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: https://groups.google.com/forum/message/raw?msg=android-security-updates/_Rm-lKnS2M8/dGTcilt0CAAJ; https://groups.google.com/forum/message/raw?msg=android-security-updates/_Rm-lKnS2M8/dGTcilt0CAAJ
CVE: CVE-2015-6599
Published: 2015-10-06
Description: libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23416608.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: https://groups.google.com/forum/message/raw?msg=android-security-updates/_Rm-lKnS2M8/dGTcilt0CAAJ; https://groups.google.com/forum/message/raw?msg=android-security-updates/_Rm-lKnS2M8/dGTcilt0CAAJ
CVE: CVE-2015-6600
Published: 2015-10-06
Description: libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 22882938.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: https://groups.google.com/forum/message/raw?msg=android-security-updates/_Rm-lKnS2M8/dGTcilt0CAAJ; https://groups.google.com/forum/message/raw?msg=android-security-updates/_Rm-lKnS2M8/dGTcilt0CAAJ
CVE: CVE-2015-6601
Published: 2015-10-06
Description: libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 22935234.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: https://groups.google.com/forum/message/raw?msg=android-security-updates/_Rm-lKnS2M8/dGTcilt0CAAJ; https://groups.google.com/forum/message/raw?msg=android-security-updates/_Rm-lKnS2M8/dGTcilt0CAAJ
CVE: CVE-2015-6603
Published: 2015-10-06
Description: libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23227354.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: https://groups.google.com/forum/message/raw?msg=android-security-updates/_Rm-lKnS2M8/dGTcilt0CAAJ; https://groups.google.com/forum/message/raw?msg=android-security-updates/_Rm-lKnS2M8/dGTcilt0CAAJ
CVE: CVE-2015-6604
Published: 2015-10-06
Description: libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23129786.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: https://groups.google.com/forum/message/raw?msg=android-security-updates/_Rm-lKnS2M8/dGTcilt0CAAJ; https://groups.google.com/forum/message/raw?msg=android-security-updates/_Rm-lKnS2M8/dGTcilt0CAAJ
CVE: CVE-2015-6605
Published: 2015-10-06
Description: mediaserver in Android before 5.1.1 LMY48T allows attackers to cause a denial of service (process crash) via unspecified vectors, aka internal bugs 20915134 and 23142203, a different vulnerability than CVE-2015-7718.
CVSS Score: 5.0 (MEDIUM)
References: https://groups.google.com/forum/message/raw?msg=android-security-updates/_Rm-lKnS2M8/dGTcilt0CAAJ; https://groups.google.com/forum/message/raw?msg=android-security-updates/_Rm-lKnS2M8/dGTcilt0CAAJ
CVE: CVE-2015-6606
Published: 2015-10-06
Description: The Secure Element Evaluation Kit (aka SEEK or SmartCard API) plugin in Android before 5.1.1 LMY48T allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 22301786.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: https://groups.google.com/forum/message/raw?msg=android-security-updates/_Rm-lKnS2M8/dGTcilt0CAAJ; https://groups.google.com/forum/message/raw?msg=android-security-updates/_Rm-lKnS2M8/dGTcilt0CAAJ
CVE: CVE-2015-6607
Published: 2015-10-06
Description: SQLite before 3.8.9, as used in Android before 5.1.1 LMY48T, allows attackers to gain privileges via a crafted application, aka internal bug 20099586.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://www.securityfocus.com/bid/76970; https://android-review.googlesource.com/#/c/145961/; https://groups.google.com/forum/message/raw?msg=android-security-updates/_Rm-lKnS2M8/dGTcilt0CAAJ
CVE: CVE-2015-7600
Published: 2015-10-06
Description: Cisco VPN Client 5.x through 5.0.07.0440 uses weak permissions for vpnclient.ini, which allows local users to gain privileges by entering an arbitrary program name in the Command field of the ApplicationLauncher section.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://www.securitytracker.com/id/1033750; https://www.nettitude.co.uk/vulnerability-discovered-in-unsupported-cisco-systems-vpn-client/; http://www.securitytracker.com/id/1033750
CVE: CVE-2015-7716
Published: 2015-10-06
Description: libstagefright in Android 5.x before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 20721050, a different vulnerability than CVE-2015-3873.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: https://groups.google.com/forum/message/raw?msg=android-security-updates/_Rm-lKnS2M8/dGTcilt0CAAJ; https://groups.google.com/forum/message/raw?msg=android-security-updates/_Rm-lKnS2M8/dGTcilt0CAAJ
CVE: CVE-2015-7717
Published: 2015-10-06
Description: mediaserver in Android 5.x before 5.1.1 LMY48T and 6.0 before 2015-10-01 allows attackers to gain privileges via a crafted application, aka internal bug 19573085, a different vulnerability than CVE-2015-6596.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: https://groups.google.com/forum/message/raw?msg=android-security-updates/_Rm-lKnS2M8/dGTcilt0CAAJ; https://groups.google.com/forum/message/raw?msg=android-security-updates/_Rm-lKnS2M8/dGTcilt0CAAJ
CVE: CVE-2015-7718
Published: 2015-10-06
Description: mediaserver in Android 5.x before 5.1.1 LMY48T and 6.0 before 2015-10-01 allows attackers to cause a denial of service (process crash) via unspecified vectors, aka internal bug 22278703, a different vulnerability than CVE-2015-6605.
CVSS Score: 5.0 (MEDIUM)
References: https://groups.google.com/forum/message/raw?msg=android-security-updates/_Rm-lKnS2M8/dGTcilt0CAAJ; https://groups.google.com/forum/message/raw?msg=android-security-updates/_Rm-lKnS2M8/dGTcilt0CAAJ
CVE: CVE-2015-5128
Published: 2015-10-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2015-5649
Published: 2015-10-08
Description: Cybozu Garoon 3.x through 3.7.5 and 4.x through 4.0.3 mishandles authentication requests, which allows remote authenticated users to conduct LDAP injection attacks, and consequently bypass intended login restrictions or obtain sensitive information, by leveraging certain group-administration privileges.
CVSS Score: 7.0 (HIGH)
CWE: CWE-287
References: http://jvn.jp/en/jp/JVN38369032/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2015-000152; https://support.cybozu.com/ja-jp/article/9176
CVE: CVE-2015-6310
Published: 2015-10-08
Description: The REST interface in Cisco Unified Communications Manager IM and Presence Service 11.5(1) allows remote attackers to cause a denial of service (SIP proxy service restart) via a crafted HTTP request, aka Bug ID CSCuw31632.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=41242; http://www.securitytracker.com/id/1033732; http://tools.cisco.com/security/center/viewAlert.x?alertId=41242
CVE: CVE-2015-6311
Published: 2015-10-08
Description: Cisco Wireless LAN Controller (WLC) devices with software 7.0(240.0), 7.3(101.0), and 7.4(1.19) allow remote attackers to cause a denial of service (device outage) by sending malformed 802.11i management data to a managed access point, aka Bug ID CSCub65236.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/viewAlert.x?alertId=41249; http://www.securitytracker.com/id/1033731; http://tools.cisco.com/security/center/viewAlert.x?alertId=41249
CVE: CVE-2015-3785
Published: 2015-10-09
Description: The Telephony component in Apple OS X before 10.11, when the Continuity feature is enabled, allows local users to bypass intended telephone-call restrictions via unspecified vectors.
CVSS Score: 1.9 (LOW)
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html; http://www.securityfocus.com/bid/76908; http://www.securitytracker.com/id/1033703
CVE: CVE-2015-5780
Published: 2015-10-09
Description: The Safari Extensions implementation in Apple Safari before 9 does not require user confirmation before replacing an installed extension, which has unspecified impact and attack vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00007.html; http://www.securitytracker.com/id/1033688; https://support.apple.com/HT205265
CVE: CVE-2015-5828
Published: 2015-10-09
Description: The API in the WebKit Plug-ins component in Apple Safari before 9 does not provide notification of an HTTP Redirection (aka 3xx) status code to a plugin, which allows remote attackers to bypass intended request restrictions via a crafted web site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00007.html; http://lists.opensuse.org/opensuse-updates/2016-03/msg00054.html; http://www.securityfocus.com/bid/79707
CVE: CVE-2015-5830
Published: 2015-10-09
Description: The Intel Graphics Driver component in Apple OS X before 10.11 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5877.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html; http://www.securitytracker.com/id/1033703; https://support.apple.com/HT205267
CVE: CVE-2015-5833
Published: 2015-10-09
Description: The Login Window component in Apple OS X before 10.11 does not ensure that the screen is locked at the intended time, which allows physically proximate attackers to obtain access by visiting an unattended workstation.
CVSS Score: 7.2 (HIGH)
CWE: CWE-254
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html; http://www.securityfocus.com/bid/76908; http://www.securitytracker.com/id/1033703
CVE: CVE-2015-5836
Published: 2015-10-09
Description: Apple Online Store Kit in Apple OS X before 10.11 improperly validates iCloud keychain item ACLs, which allows attackers to obtain access to keychain items via a crafted app.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html; http://www.securitytracker.com/id/1033703; https://support.apple.com/HT205267
CVE: CVE-2015-5849
Published: 2015-10-09
Description: The filtering implementation in AppleEvents in Apple OS X before 10.11 mishandles attempts to send events to a different user, which allows attackers to bypass intended access restrictions by leveraging a screen-sharing connection.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html; http://www.securitytracker.com/id/1033703; https://support.apple.com/HT205267
CVE: CVE-2015-5853
Published: 2015-10-09
Description: AirScan in Apple OS X before 10.11 allows man-in-the-middle attackers to obtain eSCL packet payload data via unspecified vectors.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html; http://www.securitytracker.com/id/1033703; https://support.apple.com/HT205267
CVE: CVE-2015-5854
Published: 2015-10-09
Description: The backup implementation in Time Machine in Apple OS X before 10.11 allows local users to obtain access to keychain items via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html; http://www.securityfocus.com/bid/76908; http://www.securitytracker.com/id/1033703
CVE: CVE-2015-5864
Published: 2015-10-09
Description: IOAudioFamily in Apple OS X before 10.11 allows local users to obtain sensitive kernel memory-layout information via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html; http://www.securitytracker.com/id/1033703; https://support.apple.com/HT205267
CVE: CVE-2015-5865
Published: 2015-10-09
Description: IOGraphics in Apple OS X before 10.11 allows attackers to obtain sensitive kernel memory-layout information via a crafted app.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html; http://www.securitytracker.com/id/1033703; https://support.apple.com/HT205267
CVE: CVE-2015-5866
Published: 2015-10-09
Description: IOHIDFamily in Apple OS X before 10.11 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html; http://www.securityfocus.com/bid/76908; http://www.securitytracker.com/id/1033703
CVE: CVE-2015-5870
Published: 2015-10-09
Description: The debugging interfaces in the kernel in Apple OS X before 10.11 allow local users to obtain sensitive memory-layout information via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html; http://www.securityfocus.com/bid/76908; http://www.securitytracker.com/id/1033703
CVE: CVE-2015-5871
Published: 2015-10-09
Description: IOGraphics in Apple OS X before 10.11 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5872, CVE-2015-5873, and CVE-2015-5890.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html; http://www.securitytracker.com/id/1033703; https://support.apple.com/HT205267