ByteOS

Resource:

third-party-advisory

x_refsource_SECUNIA

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
http://support.apple.com/kb/HT6296	x_refsource_CONFIRM x_transferred
http://www.securitytracker.com/id/1030505	vdb-entry x_refsource_SECTRACK x_transferred
http://archives.neohapsis.com/archives/bugtraq/2014-06/0172.html	vendor-advisory x_refsource_APPLE x_transferred
https://code.google.com/p/google-security-research/issues/detail?id=17	x_refsource_MISC x_transferred
http://secunia.com/advisories/59475	third-party-advisory x_refsource_SECUNIA x_transferred

Hyperlink: http://support.apple.com/kb/HT6296

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: http://www.securitytracker.com/id/1030505

Resource:

vdb-entry

x_refsource_SECTRACK

x_transferred

Hyperlink: http://archives.neohapsis.com/archives/bugtraq/2014-06/0172.html

Resource:

vendor-advisory

x_refsource_APPLE

x_transferred

Hyperlink: https://code.google.com/p/google-security-research/issues/detail?id=17

Resource:

x_refsource_MISC

x_transferred

Resource:

third-party-advisory

x_refsource_SECUNIA

x_transferred

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:product-security@apple.com

Published At:01 Jul, 2014 | 10:17

Updated At:12 Apr, 2025 | 10:46

Array index error in IOAcceleratorFamily in Apple OS X before 10.9.4 allows attackers to execute arbitrary code via a crafted application.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	2.0	10.0	HIGH	AV:N/AC:L/Au:N/C:C/I:C/A:C

Type: Primary

Version: 2.0

Base score: 10.0

Base severity: HIGH

Vector:

AV:N/AC:L/Au:N/C:C/I:C/A:C

CPE Matches

cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*

>>mac_os_x>>Versions up to 10.9.3(inclusive)

cpe:2.3:o:apple:mac_os_x:10.8.0:*:*:*:*:*:*:*

>>mac_os_x>>10.8.0

cpe:2.3:o:apple:mac_os_x:10.8.1:*:*:*:*:*:*:*

>>mac_os_x>>10.8.1

cpe:2.3:o:apple:mac_os_x:10.8.2:*:*:*:*:*:*:*

>>mac_os_x>>10.8.2

cpe:2.3:o:apple:mac_os_x:10.8.3:*:*:*:*:*:*:*

>>mac_os_x>>10.8.3

cpe:2.3:o:apple:mac_os_x:10.8.4:*:*:*:*:*:*:*

>>mac_os_x>>10.8.4

cpe:2.3:o:apple:mac_os_x:10.8.5:*:*:*:*:*:*:*

>>mac_os_x>>10.8.5

cpe:2.3:o:apple:mac_os_x:10.8.5:supplemental_update:*:*:*:*:*:*

>>mac_os_x>>10.8.5

cpe:2.3:o:apple:mac_os_x:10.9:*:*:*:*:*:*:*

>>mac_os_x>>10.9

cpe:2.3:o:apple:mac_os_x:10.9.1:*:*:*:*:*:*:*

>>mac_os_x>>10.9.1

cpe:2.3:o:apple:mac_os_x:10.9.2:*:*:*:*:*:*:*

>>mac_os_x>>10.9.2

Weaknesses

CWE ID	Type	Source
NVD-CWE-Other	Primary	nvd@nist.gov

CWE ID: NVD-CWE-Other

Type: Primary

Source: nvd@nist.gov

Evaluator Description

Per: http://cwe.mitre.org/data/definitions/129.html "CWE-129: Improper Validation of Array Index"

References

Hyperlink	Source	Resource
http://archives.neohapsis.com/archives/bugtraq/2014-06/0172.html	product-security@apple.com	N/A
http://secunia.com/advisories/59475	product-security@apple.com	N/A
http://support.apple.com/kb/HT6296	product-security@apple.com	N/A
http://www.securitytracker.com/id/1030505	product-security@apple.com	N/A
https://code.google.com/p/google-security-research/issues/detail?id=17	product-security@apple.com	Exploit
http://archives.neohapsis.com/archives/bugtraq/2014-06/0172.html	af854a3a-2127-422b-91ae-364da2661108	N/A
http://secunia.com/advisories/59475	af854a3a-2127-422b-91ae-364da2661108	N/A
http://support.apple.com/kb/HT6296	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.securitytracker.com/id/1030505	af854a3a-2127-422b-91ae-364da2661108	N/A
https://code.google.com/p/google-security-research/issues/detail?id=17	af854a3a-2127-422b-91ae-364da2661108	Exploit

Hyperlink: http://archives.neohapsis.com/archives/bugtraq/2014-06/0172.html

Source: product-security@apple.com

Resource: N/A

Source: product-security@apple.com

Resource: N/A

Hyperlink: http://support.apple.com/kb/HT6296

Source: product-security@apple.com

Resource: N/A

Hyperlink: http://www.securitytracker.com/id/1030505

Source: product-security@apple.com

Resource: N/A

Hyperlink: https://code.google.com/p/google-security-research/issues/detail?id=17

Source: product-security@apple.com

Resource:

Exploit

Hyperlink: http://archives.neohapsis.com/archives/bugtraq/2014-06/0172.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: http://support.apple.com/kb/HT6296

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: http://www.securitytracker.com/id/1030505

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: https://code.google.com/p/google-security-research/issues/detail?id=17

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Exploit

Similar CVEs

1120Records found

CVE-2012-5678

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-7.57% / 91.65%

7 Day CHG~0.00%

Published-12 Dec, 2012 | 11:00

Updated-11 Apr, 2025 | 00:51

Adobe Flash Player before 10.3.183.48 and 11.x before 11.5.502.135 on Windows, before 10.3.183.48 and 11.x before 11.5.502.136 on Mac OS X, before 10.3.183.48 and 11.x before 11.2.202.258 on Linux, before 11.1.111.29 on Android 2.x and 3.x, and before 11.1.115.34 on Android 4.x; Adobe AIR before 3.5.0.880 on Windows and before 3.5.0.890 on Mac OS X; and Adobe AIR SDK before 3.5.0.880 on Windows and before 3.5.0.890 on Mac OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.

Vendor-n/a Microsoft Corporation Google LLC Adobe Inc.Apple Inc.Linux Kernel Organization, Inc

Product-air android air_sdk flash_player windows mac_os_x linux_kernel n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2015-5541

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-9.52% / 92.67%

7 Day CHG~0.00%

Published-14 Aug, 2015 | 01:00

Updated-12 Apr, 2025 | 10:46

Heap-based buffer overflow in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5129.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel air_sdk air_sdk_\&_compiler windows mac_os_x n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2015-5547

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-46.08% / 97.56%

7 Day CHG~0.00%

Published-14 Aug, 2015 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5544, CVE-2015-5545, CVE-2015-5546, CVE-2015-5548, CVE-2015-5549, CVE-2015-5552, and CVE-2015-5553.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel air_sdk air_sdk_\&_compiler windows mac_os_x n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2012-5249

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-6.41% / 90.83%

7 Day CHG~0.00%

Published-09 Oct, 2012 | 10:00

Updated-11 Apr, 2025 | 00:51

Buffer overflow in Adobe Flash Player before 10.3.183.29 and 11.x before 11.4.402.287 on Windows and Mac OS X, before 10.3.183.29 and 11.x before 11.2.202.243 on Linux, before 11.1.111.19 on Android 2.x and 3.x, and before 11.1.115.20 on Android 4.x; Adobe AIR before 3.4.0.2710; and Adobe AIR SDK before 3.4.0.2710 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than other Flash Player buffer overflow CVEs listed in APSB12-22.

Vendor-n/a Microsoft Corporation Google LLC Adobe Inc.Apple Inc.Linux Kernel Organization, Inc

Product-android flash_player windows adobe_air mac_os_x flash_player_for_android linux_kernel adobe_air_sdk n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2021-1829

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.84% / 74.35%

7 Day CHG~0.00%

Published-08 Sep, 2021 | 14:43

Updated-03 Aug, 2024 | 16:25

A type confusion issue was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.3. An application may be able to execute arbitrary code with kernel privileges.

Vendor-Apple Inc.

Product-macos macOS

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2015-5563

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-58.18% / 98.14%

7 Day CHG~0.00%

Published-14 Aug, 2015 | 01:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5127, CVE-2015-5130, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5550, CVE-2015-5551, CVE-2015-5556, CVE-2015-5557, CVE-2015-5559, CVE-2015-5561, CVE-2015-5564, and CVE-2015-5565.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel air_sdk air_sdk_\&_compiler windows mac_os_x n/a

CVE-2015-5887

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-10||HIGH

EPSS-0.75% / 72.80%

7 Day CHG~0.00%

Published-09 Oct, 2015 | 01:00

Updated-12 Apr, 2025 | 10:46

The TLS Handshake Protocol implementation in Secure Transport in Apple OS X before 10.11 accepts a Certificate Request message within a session in which no Server Key Exchange message has been sent, which allows remote attackers to have an unspecified impact via crafted TLS data.

Vendor-n/a Apple Inc.

Product-mac_os_x n/a

CVE-2015-5569

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-6.01% / 90.50%

7 Day CHG~0.00%

Published-14 Oct, 2015 | 23:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 improperly implement the Flash broker API, which has unspecified impact and attack vectors.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel air_sdk air_sdk_\&_compiler windows mac_os_x android n/a

CVE-2015-5564

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-3.24% / 86.80%

7 Day CHG~0.00%

Published-14 Aug, 2015 | 01:00

Updated-12 Apr, 2025 | 10:46

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel air_sdk air_sdk_\&_compiler windows mac_os_x n/a

CVE-2015-5559

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-3.82% / 87.86%

7 Day CHG~0.00%

Published-14 Aug, 2015 | 01:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5127, CVE-2015-5130, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5550, CVE-2015-5551, CVE-2015-5556, CVE-2015-5557, CVE-2015-5561, CVE-2015-5563, CVE-2015-5564, and CVE-2015-5565.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel air_sdk air_sdk_\&_compiler windows mac_os_x n/a

CVE-2015-5557

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-47.02% / 97.60%

7 Day CHG~0.00%

Published-14 Aug, 2015 | 01:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5127, CVE-2015-5130, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5550, CVE-2015-5551, CVE-2015-5556, CVE-2015-5559, CVE-2015-5561, CVE-2015-5563, CVE-2015-5564, and CVE-2015-5565.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel air_sdk air_sdk_\&_compiler windows mac_os_x n/a

CVE-2015-5575

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-4.30% / 88.63%

7 Day CHG~0.00%

Published-22 Sep, 2015 | 10:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5577, CVE-2015-5578, CVE-2015-5580, CVE-2015-5582, CVE-2015-5588, and CVE-2015-6677.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel air_sdk air_sdk_\&_compiler windows mac_os_x android n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2020-9918

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-9.8||CRITICAL

EPSS-1.42% / 80.33%

7 Day CHG~0.00%

Published-16 Oct, 2020 | 16:48

Updated-04 Aug, 2024 | 10:43

An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8. A remote attacker may be able to cause unexpected system termination or corrupt kernel memory.

Vendor-Apple Inc.

Product-mac_os_x watchos tvos tvOS macOS watchOS

CWE ID-CWE-125

Out-of-bounds Read

CVE-2015-5539

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-51.16% / 97.80%

7 Day CHG~0.00%

Published-14 Aug, 2015 | 01:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5127, CVE-2015-5130, CVE-2015-5134, CVE-2015-5540, CVE-2015-5550, CVE-2015-5551, CVE-2015-5556, CVE-2015-5557, CVE-2015-5559, CVE-2015-5561, CVE-2015-5563, CVE-2015-5564, and CVE-2015-5565.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel air_sdk air_sdk_\&_compiler windows mac_os_x n/a

CVE-2018-7493

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.34% / 56.22%

7 Day CHG~0.00%

Published-05 Mar, 2018 | 20:00

Updated-05 Aug, 2024 | 06:31

CactusVPN through 6.0 for macOS suffers from a root privilege escalation vulnerability in its privileged helper tool. The privileged helper tool implements an XPC interface, which allows arbitrary applications to execute system commands as root.

Vendor-cactusvpn n/a Apple Inc.

Product-macos cactusvpn n/a

CVE-2015-5922

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-10||HIGH

EPSS-1.99% / 83.30%

7 Day CHG~0.00%

Published-09 Oct, 2015 | 01:00

Updated-12 Apr, 2025 | 10:46

Unspecified vulnerability in International Components for Unicode (ICU) before 53.1.0, as used in Apple OS X before 10.11 and watchOS before 2, has unknown impact and attack vectors.

Vendor-icu-project n/a Apple Inc.

Product-mac_os_x watchos international_components_for_unicode n/a

CVE-2015-5573

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-3.82% / 87.88%

7 Day CHG~0.00%

Published-22 Sep, 2015 | 10:00

Updated-12 Apr, 2025 | 10:46

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel air_sdk air_sdk_\&_compiler windows mac_os_x android n/a

CVE-2012-0751

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-12.03% / 93.62%

7 Day CHG~0.00%

Published-16 Feb, 2012 | 19:00

Updated-11 Apr, 2025 | 00:51

The ActiveX control in Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.

Vendor-n/a Microsoft Corporation Linux Kernel Organization, Inc Apple Inc.Adobe Inc.

Product-linux_kernel windows mac_os_x flash_player n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2015-5587

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-9.90% / 92.84%

7 Day CHG~0.00%

Published-22 Sep, 2015 | 10:00

Updated-12 Apr, 2025 | 10:46

Stack-based buffer overflow in Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allows attackers to execute arbitrary code via unspecified vectors.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel air_sdk air_sdk_\&_compiler windows mac_os_x android n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2015-5581

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-1.66% / 81.77%

7 Day CHG~0.00%

Published-22 Sep, 2015 | 10:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5570, CVE-2015-5574, CVE-2015-5584, and CVE-2015-6682.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel air_sdk air_sdk_\&_compiler windows mac_os_x android n/a

CVE-2015-5584

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-1.66% / 81.77%

7 Day CHG~0.00%

Published-22 Sep, 2015 | 10:00

Updated-12 Apr, 2025 | 10:46

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel air_sdk air_sdk_\&_compiler windows mac_os_x android n/a

CVE-2015-5556

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-47.02% / 97.60%

7 Day CHG~0.00%

Published-14 Aug, 2015 | 01:00

Updated-12 Apr, 2025 | 10:46

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5127, CVE-2015-5130, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5550, CVE-2015-5551, CVE-2015-5557, CVE-2015-5559, CVE-2015-5561, CVE-2015-5563, CVE-2015-5564, and CVE-2015-5565.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel air_sdk air_sdk_\&_compiler windows mac_os_x n/a

CVE-2015-5577

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-4.30% / 88.63%

7 Day CHG~0.00%

Published-22 Sep, 2015 | 10:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5575, CVE-2015-5578, CVE-2015-5580, CVE-2015-5582, CVE-2015-5588, and CVE-2015-6677.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel air_sdk air_sdk_\&_compiler windows mac_os_x android n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2015-5568

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-31.84% / 96.69%

7 Day CHG~0.00%

Published-22 Sep, 2015 | 10:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allow attackers to cause a denial of service (vector-length corruption) or possibly have unspecified other impact via unknown vectors.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel air_sdk air_sdk_\&_compiler windows mac_os_x android n/a

CWE ID-CWE-20

Improper Input Validation

CVE-2009-2204

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-10||HIGH

EPSS-18.69% / 95.12%

7 Day CHG~0.00%

Published-03 Aug, 2009 | 18:00

Updated-07 Aug, 2024 | 05:44

Unspecified vulnerability in the CoreTelephony component in Apple iPhone OS before 3.0.1 allows remote attackers to execute arbitrary code, obtain GPS coordinates, or enable the microphone via an SMS message that triggers memory corruption, as demonstrated by Charlie Miller at SyScan '09 Singapore.

Vendor-n/a Apple Inc.

Product-iphone_os n/a

CVE-2015-5565

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-4.80% / 89.27%

7 Day CHG~0.00%

Published-14 Aug, 2015 | 01:00

Updated-12 Apr, 2025 | 10:46

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel air_sdk air_sdk_\&_compiler windows mac_os_x n/a

CVE-2015-5554

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-47.02% / 97.60%

7 Day CHG~0.00%

Published-14 Aug, 2015 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-5555, CVE-2015-5558, and CVE-2015-5562.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel air_sdk air_sdk_\&_compiler windows mac_os_x n/a

CVE-2015-5903

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-10||HIGH

EPSS-2.02% / 83.46%

7 Day CHG~0.00%

Published-18 Sep, 2015 | 10:00

Updated-12 Apr, 2025 | 10:46

The kernel in Apple iOS before 9 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5868 and CVE-2015-5896.

Vendor-n/a Apple Inc.

Product-mac_os_x iphone_os watchos n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2009-1236

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-10||HIGH

EPSS-5.05% / 89.56%

7 Day CHG~0.00%

Published-02 Apr, 2009 | 17:00

Updated-07 Aug, 2024 | 05:04

Heap-based buffer overflow in the AppleTalk networking stack in XNU 1228.3.13 and earlier on Apple Mac OS X 10.5.6 and earlier allows remote attackers to cause a denial of service (system crash) via a ZIP NOTIFY (aka ZIPOP_NOTIFY) packet that overwrites a certain ifPort structure member.

Vendor-n/a Apple Inc.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2009-0138

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-10||HIGH

EPSS-2.50% / 85.01%

7 Day CHG~0.00%

Published-13 Feb, 2009 | 00:00

Updated-07 Aug, 2024 | 04:24

servermgrd (Server Manager) in Apple Mac OS X 10.5.6 does not properly validate authentication credentials, which allows remote attackers to modify the system configuration.

Vendor-n/a Apple Inc.

CWE ID-CWE-287

Improper Authentication

CVE-2015-5549

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-46.08% / 97.56%

7 Day CHG~0.00%

Published-14 Aug, 2015 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5544, CVE-2015-5545, CVE-2015-5546, CVE-2015-5547, CVE-2015-5548, CVE-2015-5552, and CVE-2015-5553.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel air_sdk air_sdk_\&_compiler windows mac_os_x n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2015-7071

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-10||HIGH

EPSS-0.39% / 59.60%

7 Day CHG~0.00%

Published-11 Dec, 2015 | 11:00

Updated-12 Apr, 2025 | 10:46

The File Bookmark component in Apple OS X before 10.11.2 allows attackers to bypass a sandbox protection mechanism for app scoped bookmarks via a crafted pathname.

Vendor-n/a Apple Inc.

Product-mac_os_x n/a

CVE-2009-0137

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-10||HIGH

EPSS-0.51% / 66.02%

7 Day CHG~0.00%

Published-13 Feb, 2009 | 00:00

Updated-07 Aug, 2024 | 04:24

Multiple unspecified vulnerabilities in Safari RSS in Apple Mac OS X 10.4.11 and 10.5.6, and Windows XP and Vista, allow remote attackers to execute arbitrary JavaScript in the local security zone via a crafted feed: URL, related to "input validation issues."

Vendor-n/a Apple Inc.Microsoft Corporation

Product-windows_vista safari windows_xp mac_os_x mac_os_x_server n/a

CWE ID-CWE-20

Improper Input Validation

CVE-2009-0846

Matching Score-8

Assigner-MITRE Corporation

Vendor-n/a Apple Inc.MIT (Massachusetts Institute of Technology)Red Hat, Inc.Canonical Ltd.Fedora Project

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-10||HIGH

EPSS-56.35% / 98.05%

7 Day CHG~0.00%

Published-09 Apr, 2009 | 00:00

Updated-07 Aug, 2024 | 04:48

The asn1_decode_generaltime function in lib/krb5/asn.1/asn1_decode.c in the ASN.1 GeneralizedTime decoder in MIT Kerberos 5 (aka krb5) before 1.6.4 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via vectors involving an invalid DER encoding that triggers a free of an uninitialized pointer.

Product-enterprise_linux_server ubuntu_linux enterprise_linux_workstation fedora enterprise_linux mac_os_x enterprise_linux_eus kerberos_5 enterprise_linux_desktop n/a

CWE ID-CWE-824

Access of Uninitialized Pointer

CVE-2009-3953

Matching Score-8

Matching Score-8

CVSS Score-8.8||HIGH

EPSS-90.51% / 99.59%

7 Day CHG~0.00%

Published-13 Jan, 2010 | 19:00

Updated-22 Oct, 2025 | 01:15

Known KEV||Action Due Date - 2022-06-22||Apply updates per vendor instructions.

The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration "array boundary issue," a different vulnerability than CVE-2009-2994.

Vendor-n/a SUSE Microsoft Corporation openSUSE Apple Inc.Adobe Inc.

Product-mac_os_x windows opensuse linux_enterprise linux_enterprise_debuginfo acrobat n/a Acrobat and Reader

CWE ID-CWE-787

Out-of-bounds Write

CVE-2003-0421

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-10||HIGH

EPSS-1.51% / 80.89%

7 Day CHG~0.00%

Published-25 Jul, 2003 | 04:00

Updated-03 Apr, 2025 | 01:03

Apple QuickTime / Darwin Streaming Server before 4.1.3f allows remote attackers to cause a denial of service (crash) via an MS-DOS device name (e.g. AUX) in a request to HTTP port 1220, a different vulnerability than CVE-2003-0502.

Vendor-n/a Apple Inc.

Product-darwin_streaming_server n/a

CVE-2008-4221

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-10||HIGH

EPSS-0.89% / 75.12%

7 Day CHG~0.00%

Published-17 Dec, 2008 | 01:00

Updated-07 Aug, 2024 | 10:08

The strptime API in Libsystem in Apple Mac OS X before 10.5.6 allows context-dependent attackers to cause a denial of service (memory corruption and application crash) or execute arbitrary code via a crafted date string, related to improper memory allocation.

Vendor-n/a Apple Inc.

CWE ID-CWE-399

Not Available

CVE-2008-5184

Matching Score-8

Assigner-Canonical Ltd.

Matching Score-8

Assigner-Canonical Ltd.

CVSS Score-10||HIGH

EPSS-0.29% / 51.45%

7 Day CHG~0.00%

Published-21 Nov, 2008 | 02:00

Updated-07 Aug, 2024 | 10:40

The web interface (cgi-bin/admin.c) in CUPS before 1.3.8 uses the guest username when a user is not logged on to the web server, which makes it easier for remote attackers to bypass intended policy and conduct CSRF attacks via the (1) add and (2) cancel RSS subscription functions.

Vendor-n/a Apple Inc.

Product-cups n/a

CWE ID-CWE-255

Not Available

CVE-2008-4237

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-10||HIGH

EPSS-0.52% / 66.41%

7 Day CHG~0.00%

Published-17 Dec, 2008 | 01:00

Updated-07 Aug, 2024 | 10:08

Managed Client in Apple Mac OS X before 10.5.6 sometimes misidentifies a system when installing per-host configuration settings, which allows context-dependent attackers to have an unspecified impact by leveraging unintended settings, as demonstrated by the screen saver lock setting.

Vendor-n/a Apple Inc.

CVE-2008-4223

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-10||HIGH

EPSS-1.67% / 81.77%

7 Day CHG~0.00%

Published-17 Dec, 2008 | 01:00

Updated-07 Aug, 2024 | 10:08

Podcast Producer in Apple Mac OS X 10.5 before 10.5.6 allows remote attackers to bypass authentication and gain administrative access via unspecified vectors.

Vendor-n/a Apple Inc.

Product-mac_os_x_server n/a

CWE ID-CWE-287

Improper Authentication

CVE-2008-3616

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-10||HIGH

EPSS-1.06% / 77.30%

7 Day CHG~0.00%

Published-16 Sep, 2008 | 23:00

Updated-07 Aug, 2024 | 09:45

Multiple integer overflows in the SearchKit API in Apple Mac OS X 10.4.11 and 10.5 through 10.5.4 allow context-dependent attackers to cause a denial of service (application crash) or execute arbitrary code via vectors associated with "passing untrusted input" to unspecified API functions.

Vendor-n/a Apple Inc.

CWE ID-CWE-189

Not Available

CVE-2008-3529

Matching Score-8

Assigner-Red Hat, Inc.

Matching Score-8

Assigner-Red Hat, Inc.

CVSS Score-10||HIGH

EPSS-56.63% / 98.06%

7 Day CHG~0.00%

Published-12 Sep, 2008 | 16:00

Updated-07 Aug, 2024 | 09:45

Heap-based buffer overflow in the xmlParseAttValueComplex function in parser.c in libxml2 before 2.7.0 allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via a long XML entity name.

Vendor-n/a Apple Inc.Debian GNU/Linux Canonical Ltd.libxml2 (XMLSoft)

Product-ubuntu_linux iphone_os debian_linux safari mac_os_x libxml2 n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2011-2415

Matching Score-8

Matching Score-8

Vendor-n/a Microsoft Corporation Linux Kernel Organization, Inc Google LLC Sun Microsystems (Oracle Corporation)Apple Inc.Adobe Inc.

CVSS Score-10||HIGH

EPSS-12.17% / 93.66%

7 Day CHG~0.00%

Published-10 Aug, 2011 | 22:00

Updated-11 Apr, 2025 | 00:51

Buffer overflow in Adobe Flash Player before 10.3.183.5 on Windows, Mac OS X, Linux, and Solaris and before 10.3.186.3 on Android, and Adobe AIR before 2.7.1 on Windows and Mac OS X and before 2.7.1.1961 on Android, allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2011-2130, CVE-2011-2134, CVE-2011-2137, and CVE-2011-2414.

Product-linux_kernel windows android flash_player sunos adobe_air mac_os_x n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2011-2414

Matching Score-8

Matching Score-8

Vendor-n/a Microsoft Corporation Linux Kernel Organization, Inc Google LLC Sun Microsystems (Oracle Corporation)Apple Inc.Adobe Inc.

CVSS Score-10||HIGH

EPSS-12.17% / 93.66%

7 Day CHG~0.00%

Published-10 Aug, 2011 | 22:00

Updated-11 Apr, 2025 | 00:51

Product-linux_kernel windows android flash_player sunos adobe_air mac_os_x n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2015-5574

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-71.01% / 98.67%

7 Day CHG~0.00%

Published-22 Sep, 2015 | 10:00

Updated-12 Apr, 2025 | 10:46

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel air_sdk air_sdk_\&_compiler windows mac_os_x android n/a

CVE-2011-2451

Matching Score-8

Matching Score-8

Vendor-n/a Microsoft Corporation Linux Kernel Organization, Inc Google LLC Sun Microsystems (Oracle Corporation)Apple Inc.Adobe Inc.

CVSS Score-10||HIGH

EPSS-1.77% / 82.34%

7 Day CHG~0.00%

Published-11 Nov, 2011 | 16:00

Updated-11 Apr, 2025 | 00:51

Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux, and Solaris and before 11.1.102.59 on Android, and Adobe AIR before 3.1.0.4880, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2445, CVE-2011-2452, CVE-2011-2453, CVE-2011-2454, CVE-2011-2455, CVE-2011-2459, and CVE-2011-2460.

Product-linux_kernel windows solaris android flash_player adobe_air mac_os_x n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2011-2450

Matching Score-8

Matching Score-8

Vendor-n/a Microsoft Corporation Linux Kernel Organization, Inc Google LLC Sun Microsystems (Oracle Corporation)Apple Inc.Adobe Inc.

CVSS Score-10||HIGH

EPSS-3.04% / 86.37%

7 Day CHG~0.00%

Published-11 Nov, 2011 | 16:00

Updated-11 Apr, 2025 | 00:51

Product-linux_kernel windows solaris android flash_player adobe_air mac_os_x n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2015-5560

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-53.14% / 97.89%

7 Day CHG~0.00%

Published-14 Aug, 2015 | 01:00

Updated-12 Apr, 2025 | 10:46

Integer overflow in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel air_sdk air_sdk_\&_compiler windows mac_os_x n/a

CVE-2015-5582

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-4.30% / 88.63%

7 Day CHG~0.00%

Published-22 Sep, 2015 | 10:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5575, CVE-2015-5577, CVE-2015-5578, CVE-2015-5580, CVE-2015-5588, and CVE-2015-6677.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-air flash_player linux_kernel air_sdk air_sdk_\&_compiler windows mac_os_x android n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2015-5567

Matching Score-8

Matching Score-8