ByteOS

Resource:

third-party-advisory

x_refsource_SECUNIA

Hyperlink: https://exchange.xforce.ibmcloud.com/vulnerabilities/42705

Resource:

vdb-entry

x_refsource_XF

Hyperlink: http://lists.apple.com/archives/security-announce/2008//May/msg00001.html

Resource:

vendor-advisory

x_refsource_APPLE

Hyperlink: http://www.securityfocus.com/bid/29487

Resource:

vdb-entry

x_refsource_BID

Hyperlink: http://www.vupen.com/english/advisories/2008/1697

Resource:

vdb-entry

x_refsource_VUPEN

Hyperlink: http://www.securityfocus.com/bid/29412

Resource:

vdb-entry

x_refsource_BID

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
http://securitytracker.com/id?1020131	vdb-entry x_refsource_SECTRACK x_transferred
http://www.us-cert.gov/cas/techalerts/TA08-150A.html	third-party-advisory x_refsource_CERT x_transferred
http://secunia.com/advisories/30430	third-party-advisory x_refsource_SECUNIA x_transferred
https://exchange.xforce.ibmcloud.com/vulnerabilities/42705	vdb-entry x_refsource_XF x_transferred
http://lists.apple.com/archives/security-announce/2008//May/msg00001.html	vendor-advisory x_refsource_APPLE x_transferred
http://www.securityfocus.com/bid/29487	vdb-entry x_refsource_BID x_transferred
http://www.vupen.com/english/advisories/2008/1697	vdb-entry x_refsource_VUPEN x_transferred
http://www.securityfocus.com/bid/29412	vdb-entry x_refsource_BID x_transferred

Hyperlink: http://securitytracker.com/id?1020131

Resource:

vdb-entry

x_refsource_SECTRACK

x_transferred

Hyperlink: http://www.us-cert.gov/cas/techalerts/TA08-150A.html

Resource:

third-party-advisory

x_refsource_CERT

x_transferred

cpe:2.3:o:apple:mac_os_x:10.4.11:*:*:*:*:*:*:*

Resource:

third-party-advisory

x_refsource_SECUNIA

x_transferred

Hyperlink: https://exchange.xforce.ibmcloud.com/vulnerabilities/42705

Resource:

vdb-entry

x_refsource_XF

x_transferred

Hyperlink: http://lists.apple.com/archives/security-announce/2008//May/msg00001.html

Resource:

vendor-advisory

x_refsource_APPLE

x_transferred

Hyperlink: http://www.securityfocus.com/bid/29487

Resource:

vdb-entry

x_refsource_BID

x_transferred

Hyperlink: http://www.vupen.com/english/advisories/2008/1697

Resource:

vdb-entry

x_refsource_VUPEN

x_transferred

Hyperlink: http://www.securityfocus.com/bid/29412

Resource:

vdb-entry

x_refsource_BID

x_transferred

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:cve@mitre.org

Published At:02 Jun, 2008 | 21:30

Updated At:23 Apr, 2026 | 00:35

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	2.0	9.3	HIGH	AV:N/AC:M/Au:N/C:C/I:C/A:C

Type: Primary

Version: 2.0

Base score: 9.3

Base severity: HIGH

Vector:

AV:N/AC:M/Au:N/C:C/I:C/A:C

CPE Matches

Apple Inc.

>>mac_os_x>>10.4.11

Apple Inc.

>>mac_os_x_server>>10.4.11

cpe:2.3:o:apple:mac_os_x_server:10.4.11:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-20	Primary	nvd@nist.gov
NVD-CWE-noinfo	Primary	nvd@nist.gov

CWE ID: CWE-20

Type: Primary

Source: nvd@nist.gov

CWE ID: NVD-CWE-noinfo

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
http://lists.apple.com/archives/security-announce/2008//May/msg00001.html	cve@mitre.org	N/A
http://secunia.com/advisories/30430	cve@mitre.org	Vendor Advisory
http://securitytracker.com/id?1020131	cve@mitre.org	N/A
http://www.securityfocus.com/bid/29412	cve@mitre.org	N/A
http://www.securityfocus.com/bid/29487	cve@mitre.org	N/A
http://www.us-cert.gov/cas/techalerts/TA08-150A.html	cve@mitre.org	US Government Resource
http://www.vupen.com/english/advisories/2008/1697	cve@mitre.org	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/42705	cve@mitre.org	N/A
http://lists.apple.com/archives/security-announce/2008//May/msg00001.html	af854a3a-2127-422b-91ae-364da2661108	N/A
http://secunia.com/advisories/30430	af854a3a-2127-422b-91ae-364da2661108	Vendor Advisory
http://securitytracker.com/id?1020131	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.securityfocus.com/bid/29412	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.securityfocus.com/bid/29487	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.us-cert.gov/cas/techalerts/TA08-150A.html	af854a3a-2127-422b-91ae-364da2661108	US Government Resource
http://www.vupen.com/english/advisories/2008/1697	af854a3a-2127-422b-91ae-364da2661108	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/42705	af854a3a-2127-422b-91ae-364da2661108	N/A

Hyperlink: http://lists.apple.com/archives/security-announce/2008//May/msg00001.html

Source: cve@mitre.org

Resource: N/A

Source: cve@mitre.org

Resource:

Vendor Advisory

Hyperlink: http://securitytracker.com/id?1020131

Source: cve@mitre.org

Resource: N/A

Hyperlink: http://www.securityfocus.com/bid/29412

Source: cve@mitre.org

Resource: N/A

Hyperlink: http://www.securityfocus.com/bid/29487

Source: cve@mitre.org

Resource: N/A

Hyperlink: http://www.us-cert.gov/cas/techalerts/TA08-150A.html

Source: cve@mitre.org

Resource:

US Government Resource

Hyperlink: http://www.vupen.com/english/advisories/2008/1697

Source: cve@mitre.org

Resource:

Vendor Advisory

Hyperlink: https://exchange.xforce.ibmcloud.com/vulnerabilities/42705

Source: cve@mitre.org

Resource: N/A

Hyperlink: http://lists.apple.com/archives/security-announce/2008//May/msg00001.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Vendor Advisory

Hyperlink: http://securitytracker.com/id?1020131

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: http://www.securityfocus.com/bid/29412

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: http://www.securityfocus.com/bid/29487

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: http://www.us-cert.gov/cas/techalerts/TA08-150A.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

US Government Resource

Hyperlink: http://www.vupen.com/english/advisories/2008/1697

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Vendor Advisory

Hyperlink: https://exchange.xforce.ibmcloud.com/vulnerabilities/42705

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Similar CVEs

3006Records found

CVE-2020-3893

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.30% / 53.90%

7 Day CHG~0.00%

Published-01 Apr, 2020 | 17:49

Updated-04 Aug, 2024 | 07:52

A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.4. A malicious application may be able to execute arbitrary code with kernel privileges.

Vendor-Apple Inc.

Product-mac_os_x macOS

CWE ID-CWE-787

Out-of-bounds Write

CWE ID-CWE-20

Improper Input Validation

CVE-2020-3905

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.30% / 53.90%

7 Day CHG~0.00%

Published-01 Apr, 2020 | 17:52

Updated-04 Aug, 2024 | 07:52

Vendor-Apple Inc.

Product-mac_os_x macOS

CWE ID-CWE-787

Out-of-bounds Write

CWE ID-CWE-20

Improper Input Validation

CVE-2021-44228

Matching Score-10

Assigner-Apache Software Foundation

Vendor-percussion snowsoftware NetApp, Inc.Siemens AG Cisco Systems, Inc.The Apache Software Foundation Intel Corporation Bentley Systems, Incorporated SonicWall Inc.Debian GNU/Linux Apple Inc.Fedora Project

Matching Score-10

Assigner-Apache Software Foundation

CVSS Score-10||CRITICAL

EPSS-94.36% / 99.96%

7 Day CHG~0.00%

Published-10 Dec, 2021 | 00:00

Updated-20 Feb, 2026 | 16:15

Known KEV||Action Due Date - 2021-12-24||For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

Product-firepower_4112 siveillance_vantage firepower_4125 sppa-t3000_ses3000 siveillance_command siguard_dsa packaged_contact_center_enterprise oneapi_sample_browser solidfire_enterprise_sds network_assurance_engine active_iq_unified_manager identity_services_engine paging_server smart_phy cx_cloud_agent mindsphere firepower_4115 industrial_edge_management unified_communications_manager_im_and_presence_service spectrum_power_7 xcode energyip_prepay 6bk1602-0aa52-0tp0_firmware virtual_topology_system computer_vision_annotation_tool ontap_tools teamcenter email_security unified_workforce_optimization fedora unified_contact_center_enterprise system_studio webex_meetings_server nexus_insights cloud_connect firepower_2130 operation_scheduler customer_experience_cloud_agent unified_customer_voice_portal unified_contact_center_management_portal vm_access_proxy enterprise_chat_and_email logo\!_soft_comfort 6bk1602-0aa32-0tp0_firmware rhythmyx siveillance_control_pro comos optical_network_controller cloud_secure_agent ucs_central_software 6bk1602-0aa12-0tp0 xpedition_enterprise firepower_1150 evolved_programmable_network_manager firepower_2120 6bk1602-0aa42-0tp0 cyber_vision_sensor_management_extension solid_edge_harness_design virtualized_infrastructure_manager 6bk1602-0aa12-0tp0_firmware crosswork_optimization_engine unified_computing_system solidfire_\&_hci_storage_node head-end_system_universal_device_integration_system mendix unified_communications_manager automated_subsea_tuning dna_center contact_center_domain_manager oncommand_insight energyip sppa-t3000_ses3000_firmware energy_engage firepower_4120 spectrum_power_4 firepower_2140 crosswork_network_controller e-car_operation_center finesse secure_device_onboard broadworks sentron_powermanager firepower_1140 network_services_orchestrator sd-wan_vmanage ucs_central fxos video_surveillance_operations_manager advanced_malware_protection_virtual_private_cloud_appliance solid_edge_cam_pro cloudcenter_suite_admin emergency_responder 6bk1602-0aa32-0tp0 snow_commander synchro siveillance_identity genomics_kernel_library 6bk1602-0aa22-0tp0_firmware cloudcenter mobility_services_engine virtualized_voice_browser firepower_4140 unity_connection log4j nx network_dashboard_fabric_controller unified_communications_manager_im_\&_presence_service iot_operations_dashboard firepower_4150 navigator crosswork_network_automation unified_intelligence_center fog_director firepower_1010 dna_spaces_connector data_center_network_manager desigo_cc_info_center firepower_4145 cyber_vision desigo_cc_advanced_reports xpedition_package_integrator capital crosswork_zero_touch_provisioning 6bk1602-0aa22-0tp0 integrated_management_controller_supervisor cloudcenter_suite firepower_2110 contact_center_management_portal synchro_4d dna_spaces video_surveillance_manager siveillance_viewpoint vesys workload_optimization_manager unified_contact_center_express ucs_director crosswork_platform_infrastructure cloud_manager unified_sip_proxy nexus_dashboard cloud_insights cloudcenter_cost_optimizer debian_linux brocade_san_navigator crosswork_data_gateway intersight_virtual_appliance snapcenter opcenter_intelligence dna_spaces\firepower_1120 firepower_threat_defense 6bk1602-0aa42-0tp0_firmware sipass_integrated prime_service_catalog business_process_automation common_services_platform_collector wan_automation_engine firepower_4110 cloudcenter_workload_manager gma-manager datacenter_manager connected_mobile_experiences firepower_9300 6bk1602-0aa52-0tp0 network_insights_for_data_center industrial_edge_management_hub Apache Log4j2 Log4j2

CWE ID-CWE-20

Improper Input Validation

CWE ID-CWE-400

Uncontrolled Resource Consumption

CWE ID-CWE-502

Deserialization of Untrusted Data

CWE ID-CWE-917

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

CVE-2012-2493

Matching Score-10

Assigner-Cisco Systems, Inc.

Vendor-n/a Apple Inc.Cisco Systems, Inc.Linux Kernel Organization, Inc Microsoft Corporation

Matching Score-10

Assigner-Cisco Systems, Inc.

CVSS Score-9.3||HIGH

EPSS-1.28% / 80.01%

7 Day CHG~0.00%

Published-20 Jun, 2012 | 20:00

Updated-29 Apr, 2026 | 01:13

The VPN downloader implementation in the WebLaunch feature in Cisco AnyConnect Secure Mobility Client 2.x before 2.5 MR6 on Windows, and 2.x before 2.5 MR6 and 3.x before 3.0 MR8 on Mac OS X and Linux, does not properly validate binaries that are received by the downloader process, which allows remote attackers to execute arbitrary code via vectors involving (1) ActiveX or (2) Java components, aka Bug ID CSCtw47523.

Product-anyconnect_secure_mobility_client windows linux_kernel mac_os_x n/a

CWE ID-CWE-20

Improper Input Validation

CVE-2016-4641

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-7.3||HIGH

EPSS-0.19% / 41.04%

7 Day CHG~0.00%

Published-22 Jul, 2016 | 01:00

Updated-06 May, 2026 | 22:30

Login Window in Apple OS X before 10.11.6 allows attackers to execute arbitrary code in a privileged context or obtain sensitive user information via a crafted app that leverages a "type confusion."

Vendor-n/a Apple Inc.

Product-mac_os_x n/a

CWE ID-CWE-20

Improper Input Validation

CVE-2019-8721

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-0.60% / 69.95%

7 Day CHG~0.00%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:24

Multiple issues in ld64 in the Xcode toolchains were addressed by updating to version ld64-507.4. This issue is fixed in Xcode 11.0. Compiling code without proper input validation could lead to arbitrary code execution with user privilege.

Vendor-Apple Inc.

Product-xcode Xcode

CWE ID-CWE-20

Improper Input Validation

CVE-2019-8503

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-0.86% / 75.41%

7 Day CHG~0.00%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:17

A logic issue was addressed with improved validation. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. A malicious website may be able to execute scripts in the context of another website.

Vendor-Apple Inc.

Product-itunes iphone_os tvos safari icloud iTunes for Windows iCloud for Windows Safari iOS tvOS

CWE ID-CWE-20

Improper Input Validation

CVE-2019-8724

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-0.60% / 69.95%

7 Day CHG~0.00%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:24

Vendor-Apple Inc.

Product-xcode Xcode

CWE ID-CWE-20

Improper Input Validation

CVE-2019-8549

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.26% / 49.30%

7 Day CHG~0.00%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:24

Multiple input validation issues existed in MIG generated code. These issues were addressed with improved validation. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2, watchOS 5.2. A malicious application may be able to execute arbitrary code with system privileges.

Vendor-Apple Inc.

Product-mac_os_x iphone_os watchos tvos tvOS macOS watchOS iOS

CWE ID-CWE-20

Improper Input Validation

CVE-2019-8723

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-0.60% / 69.95%

7 Day CHG~0.00%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:24

Vendor-Apple Inc.

Product-xcode Xcode

CWE ID-CWE-20

Improper Input Validation

CVE-2019-8637

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.16% / 36.78%

7 Day CHG~0.00%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:24

An input validation issue was addressed with improved input validation. This issue is fixed in iOS 12.3, tvOS 12.3, watchOS 5.2.1. A malicious application may be able to gain root privileges.

Vendor-Apple Inc.

Product-iphone_os watchos tvos tvOS watchOS iOS

CWE ID-CWE-20

Improper Input Validation

CVE-2016-1746

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.23% / 45.69%

7 Day CHG~0.00%

Published-24 Mar, 2016 | 01:00

Updated-06 May, 2026 | 22:30

IOGraphics in Apple OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2016-1747.

Vendor-n/a Apple Inc.

Product-mac_os_x n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE ID-CWE-20

Improper Input Validation

CVE-2016-1800

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-1.00% / 77.41%

7 Day CHG~0.00%

Published-20 May, 2016 | 10:00

Updated-06 May, 2026 | 22:30

Captive Network Assistant in Apple OS X before 10.11.5 mishandles a custom URL scheme, which allows user-assisted remote attackers to execute arbitrary code via unspecified vectors.

Vendor-n/a Apple Inc.

Product-mac_os_x n/a

CWE ID-CWE-20

Improper Input Validation

CVE-2016-1733

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.23% / 45.62%

7 Day CHG~0.00%

Published-24 Mar, 2016 | 01:00

Updated-06 May, 2026 | 22:30

AppleRAID in Apple OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

Vendor-n/a Apple Inc.

Product-mac_os_x n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE ID-CWE-20

Improper Input Validation

CVE-2019-8802

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.16% / 36.20%

7 Day CHG~0.00%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:31

A validation issue was addressed with improved logic. This issue is fixed in macOS Catalina 10.15.1. A malicious application may be able to gain root privileges.

Vendor-Apple Inc.

Product-mac_os_x macOS

CWE ID-CWE-20

Improper Input Validation

CVE-2011-0626

Matching Score-10

Matching Score-10

CVSS Score-9.3||HIGH

EPSS-4.49% / 89.35%

7 Day CHG~0.00%

Published-13 May, 2011 | 22:00

Updated-29 Apr, 2026 | 01:13

Adobe Flash Player before 10.3.181.14 on Windows, Mac OS X, Linux, and Solaris and before 10.3.185.21 on Android allows attackers to execute arbitrary code via unspecified vectors, related to a "bounds checking" issue, a different vulnerability than CVE-2011-0623, CVE-2011-0624, and CVE-2011-0625.

Vendor-n/a Apple Inc.Oracle Corporation Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-mac_os_x solaris windows flash_player android linux_kernel n/a

CWE ID-CWE-20

Improper Input Validation

CVE-2022-24098

Matching Score-10

Matching Score-10

CVSS Score-7.8||HIGH

EPSS-1.72% / 82.77%

7 Day CHG~0.00%

Published-06 May, 2022 | 17:03

Updated-23 Apr, 2025 | 18:29

Adobe Photoshop PCX File Parsing Memory Corruption Remote Code Execution Vulnerability

Adobe Photoshop versions 22.5.6 (and earlier)and 23.2.2 (and earlier) are affected by an improper input validation vulnerability when parsing a PCX file that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious PCX file.

Vendor-Adobe Inc.Apple Inc.Microsoft Corporation

Product-windows photoshop macos Photoshop

CWE ID-CWE-20

Improper Input Validation

CVE-2017-2410

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.18% / 39.74%

7 Day CHG~0.00%

Published-02 Apr, 2017 | 01:36

Updated-13 May, 2026 | 00:24

An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue involves the "Kernel" component. It allows attackers to execute arbitrary code in a privileged context via a crafted app.

Vendor-n/a Apple Inc.

Product-mac_os_x n/a

CWE ID-CWE-20

Improper Input Validation

CVE-2015-7652

Matching Score-8

Matching Score-8

CVSS Score-9.3||HIGH

EPSS-56.22% / 98.15%

7 Day CHG~0.00%

Published-11 Nov, 2015 | 11:00

Updated-06 May, 2026 | 22:30

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via a crafted gridFitType property value, a different vulnerability than CVE-2015-7651, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7660, CVE-2015-7661, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044, and CVE-2015-8046.

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-mac_os_x air_sdk_\&_compiler windows flash_player iphone_os air_sdk android air linux_kernel n/a

CVE-2015-6974

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-9.3||HIGH

EPSS-1.08% / 78.28%

7 Day CHG~0.00%

Published-23 Oct, 2015 | 21:00

Updated-06 May, 2026 | 22:30

IOHIDFamily in Apple iOS before 9.1, OS X before 10.11.1, and watchOS before 2.0.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

Vendor-n/a Apple Inc.

Product-iphone_os mac_os_x watchos n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2015-7656

Matching Score-8

Matching Score-8

CVSS Score-9.3||HIGH

EPSS-4.38% / 89.21%

7 Day CHG~0.00%

Published-11 Nov, 2015 | 11:00

Updated-06 May, 2026 | 22:30

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via crafted actionImplementsOp arguments, a different vulnerability than CVE-2015-7651, CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7657, CVE-2015-7658, CVE-2015-7660, CVE-2015-7661, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044, and CVE-2015-8046.

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-linux_kernel mac_os_x windows flash_player iphone_os air_sdk android air air_sdk_\&_compiler n/a

CVE-2015-7651

Matching Score-8

Matching Score-8

CVSS Score-9.3||HIGH

EPSS-4.38% / 89.21%

7 Day CHG~0.00%

Published-11 Nov, 2015 | 11:00

Updated-06 May, 2026 | 22:30

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via crafted DefineFunction atoms, a different vulnerability than CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7660, CVE-2015-7661, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044, and CVE-2015-8046.

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-mac_os_x air_sdk_\&_compiler windows flash_player iphone_os air_sdk android air linux_kernel n/a

CVE-2015-7659

Matching Score-8

Matching Score-8

CVSS Score-9.3||HIGH

EPSS-4.65% / 89.53%

7 Day CHG~0.00%

Published-11 Nov, 2015 | 11:00

Updated-06 May, 2026 | 22:30

Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion" in the NetConnection object implementation.

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-mac_os_x air_sdk_\&_compiler windows flash_player iphone_os air_sdk android air linux_kernel n/a

CVE-2015-7645

Matching Score-8

Matching Score-8

Product-evergreen linux_enterprise_desktop mac_os_x enterprise_linux_server enterprise_linux_workstation enterprise_linux_desktop enterprise_linux_server_from_rhui windows flash_player enterprise_linux_eus linux_kernel linux_enterprise_workstation_extension opensuse n/a Flash Player

CVSS Score-7.8||HIGH

EPSS-85.17% / 99.38%

7 Day CHG~0.00%

Published-15 Oct, 2015 | 10:00

Updated-22 Apr, 2026 | 12:22

Known KEV||Action Due Date - 2022-03-24||The impacted product is end-of-life and should be disconnected if still in use.

Adobe Flash Player 18.x through 18.0.0.252 and 19.x through 19.0.0.207 on Windows and OS X and 11.x through 11.2.202.535 on Linux allows remote attackers to execute arbitrary code via a crafted SWF file, as exploited in the wild in October 2015.

Vendor-n/a Microsoft Corporation Linux Kernel Organization, Inc SUSE Adobe Inc.openSUSE Red Hat, Inc.Apple Inc.

CVE-2015-7632

Matching Score-8

Matching Score-8

CVSS Score-9.3||HIGH

EPSS-6.99% / 91.64%

7 Day CHG~0.00%

Published-14 Oct, 2015 | 23:00

Updated-06 May, 2026 | 22:30

Buffer overflow in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via a Loader object with a crafted loaderBytes property.

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-mac_os_x air_sdk_\&_compiler windows flash_player air_sdk android air linux_kernel n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2015-7112

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-9.3||HIGH

EPSS-19.67% / 95.57%

7 Day CHG~0.00%

Published-11 Dec, 2015 | 11:00

Updated-06 May, 2026 | 22:30

The IOHIDFamily API in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2015-7111.

Vendor-n/a Apple Inc.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2015-7068

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-3.94% / 88.60%

7 Day CHG~0.00%

Published-11 Dec, 2015 | 11:00

Updated-06 May, 2026 | 22:30

IOKit SCSI in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via an app that provides an unspecified userclient type.

Vendor-n/a Apple Inc.

CWE ID-CWE-476

NULL Pointer Dereference

CVE-2015-7655

Matching Score-8

Matching Score-8

CVSS Score-9.3||HIGH

EPSS-4.38% / 89.21%

7 Day CHG~0.00%

Published-11 Nov, 2015 | 11:00

Updated-06 May, 2026 | 22:30

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via crafted actionExtends arguments, a different vulnerability than CVE-2015-7651, CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7660, CVE-2015-7661, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044, and CVE-2015-8046.

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-mac_os_x air_sdk_\&_compiler windows flash_player iphone_os air_sdk android air linux_kernel n/a

CVE-2015-7111

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-9.3||HIGH

EPSS-1.73% / 82.86%

7 Day CHG~0.00%

Published-11 Dec, 2015 | 11:00

Updated-06 May, 2026 | 22:30

Vendor-n/a Apple Inc.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2015-7055

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-9.3||HIGH

EPSS-0.84% / 75.21%

7 Day CHG~0.00%

Published-11 Dec, 2015 | 11:00

Updated-06 May, 2026 | 22:30

AppleMobileFileIntegrity in Apple iOS before 9.2 and tvOS before 9.1 does not prevent changes to access-control structures, which allows attackers to execute arbitrary code in a privileged context via a crafted app.

Vendor-n/a Apple Inc.

Product-tvos iphone_os n/a

CWE ID-CWE-284

Improper Access Control

CVE-2015-7657

Matching Score-8

Matching Score-8

CVSS Score-9.3||HIGH

EPSS-4.38% / 89.21%

7 Day CHG~0.00%

Published-11 Nov, 2015 | 11:00

Updated-06 May, 2026 | 22:30

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via crafted actionCallMethod arguments, a different vulnerability than CVE-2015-7651, CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7658, CVE-2015-7660, CVE-2015-7661, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044, and CVE-2015-8046.

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-mac_os_x air_sdk_\&_compiler windows flash_player iphone_os air_sdk android air linux_kernel n/a

CVE-2015-6979

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-9.3||HIGH

EPSS-1.47% / 81.30%

7 Day CHG~0.00%

Published-23 Oct, 2015 | 10:00

Updated-06 May, 2026 | 22:30

GasGauge in Apple iOS before 9.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

Vendor-n/a Apple Inc.

Product-iphone_os watchos n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2015-7643

Matching Score-8

Matching Score-8

CVSS Score-9.3||HIGH

EPSS-5.67% / 90.59%

7 Day CHG~0.00%

Published-14 Oct, 2015 | 23:00

Updated-06 May, 2026 | 22:30

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via a Video object with a crafted deblocking property, a different vulnerability than CVE-2015-7629, CVE-2015-7631, and CVE-2015-7644.

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-mac_os_x air_sdk_\&_compiler windows flash_player air_sdk android air linux_kernel n/a

CVE-2015-7629

Matching Score-8

Matching Score-8

CVSS Score-9.3||HIGH

EPSS-19.89% / 95.60%

7 Day CHG~0.00%

Published-14 Oct, 2015 | 23:00

Updated-06 May, 2026 | 22:30

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via a TextFormat object with a crafted tabStops property, a different vulnerability than CVE-2015-7631, CVE-2015-7643, and CVE-2015-7644.

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-mac_os_x air_sdk_\&_compiler windows flash_player air_sdk android air linux_kernel n/a

CVE-2015-7070

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-9.3||HIGH

EPSS-1.59% / 82.02%

7 Day CHG~0.00%

Published-11 Dec, 2015 | 11:00

Updated-06 May, 2026 | 22:30

Mobile Replayer in GPUTools Framework in Apple iOS before 9.2 allows attackers to execute arbitrary code in a privileged context via an app that provides a crafted pathname, a different vulnerability than CVE-2015-7069.

Vendor-n/a Apple Inc.

Product-iphone_os n/a

CVE-2015-7109

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-9.3||HIGH

EPSS-1.18% / 79.11%

7 Day CHG~0.00%

Published-11 Dec, 2015 | 11:00

Updated-06 May, 2026 | 22:30

IOAcceleratorFamily in Apple OS X before 10.11.2 and tvOS before 9.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

Vendor-n/a Apple Inc.

Product-iphone_os mac_os_x n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2015-7654

Matching Score-8

Matching Score-8

CVSS Score-9.3||HIGH

EPSS-4.38% / 89.21%

7 Day CHG~0.00%

Published-11 Nov, 2015 | 11:00

Updated-06 May, 2026 | 22:30

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via crafted attachSound arguments, a different vulnerability than CVE-2015-7651, CVE-2015-7652, CVE-2015-7653, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7660, CVE-2015-7661, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044, and CVE-2015-8046.

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-linux_kernel mac_os_x windows iphone_os flash_player air_sdk android air air_sdk_\&_compiler n/a

CVE-2015-7658

Matching Score-8

Matching Score-8

CVSS Score-9.3||HIGH

EPSS-4.38% / 89.21%

7 Day CHG~0.00%

Published-11 Nov, 2015 | 11:00

Updated-06 May, 2026 | 22:30

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via crafted actionInstanceOf arguments, a different vulnerability than CVE-2015-7651, CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7660, CVE-2015-7661, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044, and CVE-2015-8046.

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-linux_kernel mac_os_x windows iphone_os flash_player air_sdk android air air_sdk_\&_compiler n/a

CVE-2015-7653

Matching Score-8

Matching Score-8

CVSS Score-9.3||HIGH

EPSS-4.38% / 89.21%

7 Day CHG~0.00%

Published-11 Nov, 2015 | 11:00

Updated-06 May, 2026 | 22:30

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via crafted globalToLocal arguments, a different vulnerability than CVE-2015-7651, CVE-2015-7652, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7660, CVE-2015-7661, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044, and CVE-2015-8046.

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-mac_os_x air_sdk_\&_compiler windows flash_player iphone_os air_sdk android air linux_kernel n/a

CVE-2017-7155

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.23% / 45.85%

7 Day CHG~0.00%

Published-25 Dec, 2017 | 21:00

Updated-13 May, 2026 | 00:24

An issue was discovered in certain Apple products. macOS before 10.13.2 is affected. The issue involves the "Intel Graphics Driver" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

Vendor-n/a Apple Inc.

Product-mac_os_x n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2015-5754

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-9.3||HIGH

EPSS-26.89% / 96.48%

7 Day CHG~0.00%

Published-16 Aug, 2015 | 23:00

Updated-06 May, 2026 | 22:30

Race condition in runner in Install.framework in the Install Framework Legacy component in Apple OS X before 10.10.5 allows attackers to execute arbitrary code in a privileged context via a crafted app that leverages incorrect privilege dropping associated with a locking error.

Vendor-n/a Apple Inc.

Product-mac_os_x n/a

CWE ID-CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVE-2017-7069

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.17% / 37.93%

7 Day CHG~0.00%

Published-20 Jul, 2017 | 16:00

Updated-13 May, 2026 | 00:24

An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. macOS before 10.12.6 is affected. tvOS before 10.2.2 is affected. watchOS before 3.2.3 is affected. The issue involves the "Kernel" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

Vendor-n/a Apple Inc.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2017-7009

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.18% / 39.88%

7 Day CHG~0.00%

Published-20 Jul, 2017 | 16:00

Updated-13 May, 2026 | 00:24

An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. macOS before 10.12.6 is affected. tvOS before 10.2.2 is affected. watchOS before 3.2.3 is affected. The issue involves the "IOUSBFamily" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

Vendor-n/a Apple Inc.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2017-7026

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.18% / 39.88%

7 Day CHG~0.00%

Published-20 Jul, 2017 | 16:00

Updated-13 May, 2026 | 00:24

Vendor-n/a Apple Inc.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2015-4451

Matching Score-8

Matching Score-8

CVSS Score-9.3||HIGH

EPSS-3.13% / 87.15%

7 Day CHG~0.00%

Published-15 Jul, 2015 | 14:00

Updated-06 May, 2026 | 22:30

Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2015-4435, CVE-2015-4438, CVE-2015-4441, CVE-2015-4445, CVE-2015-4447, CVE-2015-4452, CVE-2015-5085, and CVE-2015-5086.

Vendor-n/a Apple Inc.Microsoft Corporation Adobe Inc.

Product-acrobat acrobat_reader acrobat_reader_dc windows macos acrobat_dc n/a

CVE-2017-2931

Matching Score-8

Matching Score-8

CVSS Score-8.8||HIGH

EPSS-68.19% / 98.62%

7 Day CHG+0.25%

Published-11 Jan, 2017 | 04:40

Updated-06 May, 2026 | 22:30

Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability related to the parsing of SWF metadata. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-windows_10 mac_os_x windows_8.1 windows flash_player linux_kernel chrome_os Adobe Flash Player 24.0.0.186 and earlier.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2017-3051

Matching Score-8

Matching Score-8

Product-acrobat mac_os_x acrobat_reader_dc reader windows acrobat_dc Adobe Acrobat Reader 11.0.19 and earlier, 15.006.30280 and earlier, 15.023.20070 and earlier.

CVSS Score-7.8||HIGH

EPSS-2.19% / 84.73%

7 Day CHG~0.00%

Published-12 Apr, 2017 | 14:00

Updated-13 May, 2026 | 00:24

Adobe Acrobat Reader versions 11.0.19 and earlier, 15.006.30280 and earlier, 15.023.20070 and earlier have an exploitable memory corruption vulnerability in the image conversion engine, related to parsing of JPEG files. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Apple Inc.Microsoft Corporation Adobe Inc.

CWE ID-CWE-125

Out-of-bounds Read

CVE-2017-3048

Matching Score-8

Matching Score-8

Product-acrobat mac_os_x acrobat_reader_dc reader windows acrobat_dc Adobe Acrobat Reader 11.0.19 and earlier, 15.006.30280 and earlier, 15.023.20070 and earlier.

CVSS Score-7.8||HIGH

EPSS-2.55% / 85.80%

7 Day CHG~0.00%

Published-12 Apr, 2017 | 14:00

Updated-13 May, 2026 | 00:24

Adobe Acrobat Reader versions 11.0.19 and earlier, 15.006.30280 and earlier, 15.023.20070 and earlier have an exploitable heap overflow vulnerability in the image conversion engine, related to internal scan line representation in TIFF files. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Apple Inc.Microsoft Corporation Adobe Inc.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2017-3028

Matching Score-8

Matching Score-8

Product-acrobat mac_os_x acrobat_reader_dc reader windows acrobat_dc Adobe Acrobat Reader 11.0.19 and earlier, 15.006.30280 and earlier, 15.023.20070 and earlier.

CVSS Score-7.8||HIGH

EPSS-2.19% / 84.73%

7 Day CHG~0.00%

Published-12 Apr, 2017 | 14:00

Updated-13 May, 2026 | 00:24

Adobe Acrobat Reader versions 11.0.19 and earlier, 15.006.30280 and earlier, 15.023.20070 and earlier have an exploitable memory corruption vulnerability in the image conversion module, related to processing of TIFF files. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Apple Inc.Microsoft Corporation Adobe Inc.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2017-3034

Matching Score-8

Matching Score-8