MO
Product
Mac OS X Server
655
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 10High 18Medium 8Low 0
Watch
Add Mac OS X Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2010-1378 | 9.8 | Nov 15 | OpenSSL in Apple Mac OS X 10.6.x before 10.6.5 does not properly perform arithmetic, which allows remote attackers to bypass X.509 certificate authentication via an arbitrary… Affected: 10.6.0 before 10.6.5 |
| CVE-2010-2941 | 9.8 | Nov 5 | ipp.c in cupsd in CUPS 1.4.4 and earlier does not properly allocate memory for attribute values with invalid string data types, which allows remote attackers to cause a denial of… Affected: before 10.5.8; 10.6.0 through 10.6.4 |
| CVE-2010-0211 | 9.8 | Jul 28 | The slap_modrdn2mods function in modrdn.c in OpenLDAP 2.4.22 does not check the return value of a call to the smr_normalize function, which allows remote attackers to cause a… Affected: 10.6.0 before 10.6.5 |
| CVE-2010-1205 | 9.8 | Jun 30 | Buffer overflow in pngpread.c in libpng before 1.2.44 and 1.4.x before 1.4.3, as used in progressive applications, might allow remote attackers to execute arbitrary code via a PNG… Affected: 10.6.0 before 10.6.4 |
| CVE-2009-2422 | 9.8 | Jul 10 | The example code for the digest authentication functionality (http_authentication.rb) in Ruby on Rails before 2.3.3 defines an authenticate_or_request_with_http_digest block that… Affected: 10.6.0 before 10.6.3; 10.5.8 |
| CVE-2008-0599 | 9.8 | May 5 | The init_request_info function in sapi/cgi/cgi_main.c in PHP before 5.2.6 does not properly consider operator precedence when calculating the length of PATH_TRANSLATED, which… Affected: before 10.5.4 |
| CVE-2007-3798 | 9.8 | Jul 16 | Integer overflow in print-bgp.c in the BGP dissector in tcpdump 3.9.6 and earlier allows remote attackers to execute arbitrary code via crafted TLVs in a BGP packet, related to an… Affected: 10.0.0 before 10.4.11 |
| CVE-2005-1689 | 9.8 | Jul 18 | Double free vulnerability in the krb5_recvauth function in MIT Kerberos 5 (krb5) 1.4.1 and earlier allows remote attackers to execute arbitrary code via certain error conditions Affected: before 10.4.2 |
| CVE-2003-0466 | 9.8 | Aug 27 | Off-by-one error in the fb_realpath() function, as derived from the realpath function in BSD, may allow attackers to execute arbitrary code, as demonstrated in wu-ftpd 2.5.0… Affected: 10.2.6 |
| CVE-2002-1347 | 9.8 | Dec 18 | Multiple buffer overflows in Cyrus SASL library 2.1.9 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via (1) long inputs… Affected: before 10.3.8 |
| CVE-2010-0037 | 8.8 | Jan 20 | Buffer overflow in Image RAW in Apple Mac OS X 10.5.8 and 10.6.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted… Affected: 10.5.8; 10.6.2 |
| CVE-2008-3637 | 8.8 | Sep 26 | The Hash-based Message Authentication Code (HMAC) provider in Java on Apple Mac OS X 10.4.11, 10.5.4, and 10.5.5 uses an uninitialized variable, which allows remote attackers to… Affected: 10.4.11; 10.5.4; 10.5.5 |
| CVE-2006-5051 | 8.1 | Sep 27 | Signal handler race condition in OpenSSH before 4.4 allows remote attackers to cause a denial of service (crash), and possibly execute arbitrary code if GSSAPI authentication is… Affected: before 10.3.9; 10.4 through 10.4.8 |
| CVE-2010-1821 | 7.8 | Apr 13 | Apple Mac OS X 10.6 through 10.6.3 and Mac OS X Server 10.6 through 10.6.3 allows local users to obtain system privileges Affected: 10.6.0; 10.6.1; 10.6.2; 10.6.3 |
| CVE-2010-1816 | 7.8 | Apr 13 | Buffer overflow in ImageIO in Apple Mac OS X 10.6 through 10.6.3 and Mac OS X Server 10.6 through 10.6.3 allows remote attackers to execute arbitrary code or cause a denial of… Affected: 10.6.0; 10.6.1; 10.6.2; 10.6.3 |
| CVE-2010-0036 | 7.8 | Jan 20 | Buffer overflow in CoreAudio in Apple Mac OS X 10.5.8 and 10.6.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted… Affected: 10.5.8; 10.6.2 |
| CVE-2016-1777 | 7.5 | Mar 24 | Web Server in Apple OS X Server before 5.1 supports the RC4 algorithm, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified… Affected: through 5.0.15 |
| CVE-2011-1755 | 7.5 | Jun 21 | jabberd2 before 2.2.14 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a… Affected: before 10.6.8; 10.7.0 before 10.7.2 |
| CVE-2010-0302 | 7.5 | Mar 5 | Use-after-free vulnerability in the abstract file-descriptor handling interface in the cupsdDoSelect function in scheduler/select.c in the scheduler in cupsd in CUPS before 1.4.4,… Affected: before 10.5.8; 10.6.0 before 10.6.4 |
| CVE-2009-3553 | 7.5 | Nov 20 | Use-after-free vulnerability in the abstract file-descriptor handling interface in the cupsdDoSelect function in scheduler/select.c in the scheduler in cupsd in CUPS 1.3.7 and… Affected: before 10.5.8; 10.6.0 before 10.6.2 |
| CVE-2009-0949 | 7.5 | Jun 9 | The ippReadIO function in cups/ipp.c in cupsd in CUPS before 1.3.10 does not properly initialize memory for IPP request packets, which allows remote attackers to cause a denial of… Affected: 10.0.0 before 10.4.11; 10.5.0 before 10.5.8 |
| CVE-2009-0152 | 7.5 | May 13 | iChat in Apple Mac OS X 10.5 before 10.5.7 disables SSL for AOL Instant Messenger (AIM) communication in certain circumstances that are inconsistent with the Require SSL setting,… Affected: 10.5.0 before 10.5.7 |
| CVE-2008-5183 | 7.5 | Nov 21 | cupsd in CUPS 1.3.9 and earlier allows local users, and possibly remote attackers, to cause a denial of service (daemon crash) by adding a large number of RSS Subscriptions, which… Affected: before 10.5.6 |
| CVE-2008-0063 | 7.5 | Mar 19 | The Kerberos 4 support in KDC in MIT Kerberos 5 (krb5kdc) does not properly clear the unused portion of a buffer when generating an error message, which might allow remote… Affected: before 10.4.11; 10.5.0 before 10.5.2 |
| CVE-2007-0897 | 7.5 | Feb 16 | Clam AntiVirus ClamAV before 0.90 does not close open file descriptors under certain conditions, which allows remote attackers to cause a denial of service (file descriptor… Affected: before 10.4.11 |
| CVE-2006-4095 | 7.5 | Sep 6 | BIND before 9.2.6-P1 and 9.3.x before 9.3.2-P1 allows remote attackers to cause a denial of service (crash) via certain SIG queries, which cause an assertion failure when multiple… Affected: before 10.3.9; 10.4.0 before 10.4.9 |
| CVE-2004-1083 | 7.5 | Dec 3 | Apache for Apple Mac OS X 10.2.8 and 10.3.6 restricts access to files in a case sensitive manner, but the Apple HFS+ filesystem accesses files in a case insensitive manner, which… Affected: 10.2; 10.2.1; 10.2.2; 10.2.3; 10.2.4; 10.2.5; +10 more |
| CVE-2004-0079 | 7.5 | Nov 23 | The do_change_cipher_spec function in OpenSSL 0.9.6c to 0.9.6k, and 0.9.7a to 0.9.7c, allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake… Affected: 10.3.3 |
| CVE-2012-3489 | 6.5 | Oct 3 | The xml_parse function in the libxml2 support in the core server component in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 allows remote… Affected: 10.7.0 through 10.7.5; 10.6.8 |
| CVE-2010-1637 | 6.5 | Jun 22 | The Mail Fetch plugin in SquirrelMail 1.4.20 and earlier allows remote authenticated users to bypass firewall restrictions and use SquirrelMail as a proxy to scan internal… Affected: before 10.6.8 |
| CVE-2009-2416 | 6.5 | Aug 11 | Multiple use-after-free vulnerabilities in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml 1.8.17, allow context-dependent attackers to cause a denial of service… Affected: before 10.4.11; 10.5.0 before 10.5.8; 10.6.0 before 10.6.2 |
| CVE-2011-0199 | 5.9 | Jun 24 | The Certificate Trust Policy component in Apple Mac OS X before 10.6.8 does not perform CRL checking for Extended Validation (EV) certificates that lack OCSP URLs, which might… Affected: 10.6.0 before 10.6.8 |
| CVE-2009-0141 | 5.5 | Feb 13 | XTerm in Apple Mac OS X 10.4.11 and 10.5.6, when used with luit, creates tty devices with insecure world-writable permissions, which allows local users to write to the Xterm of… Affected: 10.4.11; 10.5.6 |
| CVE-2016-1787 | 5.3 | Mar 24 | Wiki Server in Apple OS X Server before 5.1 allows remote attackers to obtain sensitive information from Wiki pages via unspecified vectors Affected: through 5.0.15 |
| CVE-2016-1776 | 5.3 | Mar 24 | Web Server in Apple OS X Server before 5.1 does not properly restrict access to .DS_Store and .htaccess files, which allows remote attackers to obtain sensitive configuration… Affected: through 5.0.15 |
| CVE-2016-1774 | 5.3 | Mar 24 | The Time Machine server in Server App in Apple OS X Server before 5.1 does not notify the user about ignored permissions during a backup, which makes it easier for remote… Affected: through 5.0.15 |
| CVE-2015-7031 | – | Oct 23 | The Web Service component in Apple OS X Server before 5.0.15 omits an unspecified HTTP header configuration, which allows remote attackers to bypass intended access restrictions… Affected: through 5.0.14 |
| CVE-2015-5911 | – | Sep 18 | Multiple unspecified vulnerabilities in Twisted in Wiki Server in Apple OS X Server before 5.0.3 allow attackers to have an unknown impact via an XML document Affected: through 5.0.2 |
| CVE-2015-5986 | – | Sep 5 | openpgpkey_61.c in named in ISC BIND 9.9.7 before 9.9.7-P3 and 9.10.x before 9.10.2-P4 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon… Affected: 5.0.15 |
| CVE-2015-5722 | – | Sep 5 | buffer.c in named in ISC BIND 9.x before 9.9.7-P3 and 9.10.x before 9.10.2-P4 allows remote attackers to cause a denial of service (assertion failure and daemon exit) by creating… Affected: 5.0.15 |
| CVE-2015-3185 | – | Jul 20 | The ap_some_auth_required function in server/request.c in the Apache HTTP Server 2.4.x before 2.4.14 does not consider that a Require directive may be associated with an… Affected: 5.0.3 |
| CVE-2015-0253 | – | Jul 20 | The read_request_line function in server/protocol.c in the Apache HTTP Server 2.4.12 does not initialize the protocol structure member, which allows remote attackers to cause a… Affected: 5.0.3 |
| CVE-2015-3165 | – | May 28 | Double free vulnerability in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 allows remote attackers to cause a… Affected: 5.0.2 |
| CVE-2015-0228 | – | Mar 8 | The lua_websocket_read function in lua_request.c in the mod_lua module in the Apache HTTP Server through 2.4.12 allows remote attackers to cause a denial of service (child-process… Affected: 5.0.3 |
| CVE-2014-4350 | – | Sep 19 | Buffer overflow in QT Media Foundation in Apple OS X before 10.9.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted… Affected: 10.7.5 |
| CVE-2014-1391 | – | Sep 19 | QT Media Foundation in Apple OS X before 10.9.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a… Affected: 10.7.5 |
| CVE-2014-1371 | – | Jul 1 | Array index error in Dock in Apple OS X before 10.9.4 allows attackers to execute arbitrary code or cause a denial of service (incorrect function-pointer dereference and… Affected: 10.7.0; 10.7.1; 10.7.2; 10.7.3; 10.7.4; 10.7.5 |
| CVE-2014-1370 | – | Jul 1 | The byte-swapping implementation in copyfile in Apple OS X before 10.9.4 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds memory… Affected: 10.7.0; 10.7.1; 10.7.2; 10.7.3; 10.7.4; 10.7.5 |
| CVE-2014-1296 | – | Apr 23 | CFNetwork in Apple iOS before 7.1.1, Apple OS X through 10.9.2, and Apple TV before 6.1.1 does not ensure that a Set-Cookie HTTP header is complete before interpreting the… Affected: 10.7.0; 10.7.1; 10.7.2; 10.7.3; 10.7.4; 10.7.5 |
| CVE-2013-5704 | – | Apr 15 | The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent… Affected: before 5.0.3 |
The 500 most important CVEs for this product (exploited first, then by severity)