MO
Product
Mac OS X
On CISA KEVExploited in the wildRansomware-linked
3,208
CVEs
24
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 140High 357Medium 3Low 0
Watch
Add Mac OS X to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2017-7125 | 9.8 | Oct 23 | An issue was discovered in certain Apple products Affected: through 10.12.6 |
| CVE-2017-7124 | 9.8 | Oct 23 | An issue was discovered in certain Apple products Affected: through 10.12.6 |
| CVE-2017-7123 | 9.8 | Oct 23 | An issue was discovered in certain Apple products Affected: through 10.12.6 |
| CVE-2017-7122 | 9.8 | Oct 23 | An issue was discovered in certain Apple products Affected: through 10.12.6 |
| CVE-2017-7121 | 9.8 | Oct 23 | An issue was discovered in certain Apple products Affected: through 10.12.6 |
| CVE-2017-7062 | 9.8 | Jul 20 | An issue was discovered in certain Apple products Affected: through 10.12.5 |
| CVE-2017-3167 | 9.8 | Jun 20 | In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to… Affected: before 10.13.1 |
| CVE-2016-9843 | 9.8 | May 23 | The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation Affected: 10.0.0 before 10.13.0 |
| CVE-2016-9841 | 9.8 | May 23 | inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic Affected: 10.0.0 before 10.13.0 |
| CVE-2017-2527 | 9.8 | May 22 | An issue was discovered in certain Apple products Affected: through 10.12.4 |
| CVE-2017-2524 | 9.8 | May 22 | An issue was discovered in certain Apple products Affected: before 10.12.5 |
| CVE-2017-2523 | 9.8 | May 22 | An issue was discovered in certain Apple products Affected: before 10.12.5 |
| CVE-2017-2522 | 9.8 | May 22 | An issue was discovered in certain Apple products Affected: before 10.12.5 |
| CVE-2017-2520 | 9.8 | May 22 | An issue was discovered in certain Apple products Affected: before 10.12.5 |
| CVE-2017-2519 | 9.8 | May 22 | An issue was discovered in certain Apple products Affected: before 10.12.5 |
| CVE-2017-2518 | 9.8 | May 22 | An issue was discovered in certain Apple products Affected: before 10.12.5 |
| CVE-2017-2513 | 9.8 | May 22 | An issue was discovered in certain Apple products Affected: through 10.12.4 |
| CVE-2017-2477 | 9.8 | Apr 2 | An issue was discovered in certain Apple products Affected: through 10.12.3 |
| CVE-2017-2428 | 9.8 | Apr 2 | An issue was discovered in certain Apple products Affected: through 10.12.3 |
| CVE-2017-2423 | 9.8 | Apr 2 | An issue was discovered in certain Apple products Affected: through 10.12.3 |
| CVE-2017-2402 | 9.8 | Apr 2 | An issue was discovered in certain Apple products Affected: through 10.12.3 |
| CVE-2016-7663 | 9.8 | Feb 20 | An issue was discovered in certain Apple products Affected: through 10.12.1 |
| CVE-2016-4702 | 9.8 | Sep 25 | Audio in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows remote attackers to execute arbitrary code or cause a denial of service (memory… Affected: before 10.12.0 |
| CVE-2016-4658 | 9.8 | Sep 25 | xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbid namespace nodes in… Affected: before 10.12 |
| CVE-2016-4629 | 9.8 | Jul 22 | ImageIO in Apple OS X before 10.11.6 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted xStride and yStride values in… Affected: through 10.11.5 |
| CVE-2016-4616 | 9.8 | Jul 22 | libxml2 in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote… Affected: before 10.11.6 |
| CVE-2016-4615 | 9.8 | Jul 22 | libxml2 in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote… Affected: before 10.11.6 |
| CVE-2016-4614 | 9.8 | Jul 22 | libxml2 in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote… Affected: before 10.11.6 |
| CVE-2016-4609 | 9.8 | Jul 22 | libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote… Affected: before 10.11.6 |
| CVE-2016-4607 | 9.8 | Jul 22 | libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote… Affected: before 10.11.6 |
| CVE-2016-4598 | 9.8 | Jul 22 | QuickTime in Apple OS X before 10.11.6 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted image Affected: through 10.11.5 |
| CVE-2015-7988 | 9.8 | Jun 26 | The handle_regservice_request function in mDNSResponder before 625.41.2 allows remote attackers to execute arbitrary code or cause a denial of service (NULL pointer dereference)… Affected: 10.9 before 10.9.5; 10.10.0 before 10.10.5; 10.11.0 before 10.11.1 |
| CVE-2015-7987 | 9.8 | Jun 26 | Multiple buffer overflows in mDNSResponder before 625.41.2 allow remote attackers to read or write to out-of-bounds memory locations via vectors involving the (1)… Affected: 10.9 before 10.9.5; 10.10.0 before 10.10.5; 10.11.0 before 10.11.1 |
| CVE-2016-4448 | 9.8 | Jun 9 | Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vectors Affected: before 10.11.6 |
| CVE-2016-0718 | 9.8 | May 26 | Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow Affected: 10.11.0 through 10.11.5 |
| CVE-2016-4073 | 9.8 | May 20 | Multiple integer overflows in the mbfl_strcut function in ext/mbstring/libmbfl/mbfl/mbfilter.c in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allow remote… Affected: through 10.11.3 |
| CVE-2016-4072 | 9.8 | May 20 | The Phar extension in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allows remote attackers to execute arbitrary code via a crafted filename, as demonstrated by… Affected: through 10.11.4 |
| CVE-2016-4071 | 9.8 | May 20 | Format string vulnerability in the php_snmp_error function in ext/snmp/snmp.c in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allows remote attackers to execute… Affected: through 10.11.4 |
| CVE-2016-3141 | 9.8 | Mar 31 | Use-after-free vulnerability in wddx.c in the WDDX extension in PHP before 5.5.33 and 5.6.x before 5.6.19 allows remote attackers to cause a denial of service (memory corruption… Affected: through 10.11.4 |
| CVE-2016-1761 | 9.8 | Mar 24 | libxml2 in Apple iOS before 9.3, OS X before 10.11.4, and watchOS before 2.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via… Affected: through 10.11.3 |
| CVE-2016-1741 | 9.8 | Mar 24 | The NVIDIA driver in the Graphics Drivers subsystem in Apple OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service… Affected: through 10.11.3 |
| CVE-2016-0801 | 9.8 | Feb 7 | The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows remote attackers to execute arbitrary code or cause… Affected: through 10.11.3 |
| CVE-2010-1378 | 9.8 | Nov 15 | OpenSSL in Apple Mac OS X 10.6.x before 10.6.5 does not properly perform arithmetic, which allows remote attackers to bypass X.509 certificate authentication via an arbitrary… Affected: 10.6.0 before 10.6.5 |
| CVE-2010-2941 | 9.8 | Nov 5 | ipp.c in cupsd in CUPS 1.4.4 and earlier does not properly allocate memory for attribute values with invalid string data types, which allows remote attackers to cause a denial of… Affected: before 10.5.8; 10.6.0 through 10.6.4 |
| CVE-2010-0211 | 9.8 | Jul 28 | The slap_modrdn2mods function in modrdn.c in OpenLDAP 2.4.22 does not check the return value of a call to the smr_normalize function, which allows remote attackers to cause a… Affected: 10.6.0 before 10.6.5 |
| CVE-2010-1205 | 9.8 | Jun 30 | Buffer overflow in pngpread.c in libpng before 1.2.44 and 1.4.x before 1.4.3, as used in progressive applications, might allow remote attackers to execute arbitrary code via a PNG… Affected: 10.6.0 before 10.6.4 |
| CVE-2009-2422 | 9.8 | Jul 10 | The example code for the digest authentication functionality (http_authentication.rb) in Ruby on Rails before 2.3.3 defines an authenticate_or_request_with_http_digest block that… Affected: 10.6.0 before 10.6.3; 10.5.8 |
| CVE-2008-0599 | 9.8 | May 5 | The init_request_info function in sapi/cgi/cgi_main.c in PHP before 5.2.6 does not properly consider operator precedence when calculating the length of PATH_TRANSLATED, which… Affected: before 10.5.4 |
| CVE-2007-3798 | 9.8 | Jul 16 | Integer overflow in print-bgp.c in the BGP dissector in tcpdump 3.9.6 and earlier allows remote attackers to execute arbitrary code via crafted TLVs in a BGP packet, related to an… Affected: 10.0.0 before 10.4.11 |
| CVE-2005-1689 | 9.8 | Jul 18 | Double free vulnerability in the krb5_recvauth function in MIT Kerberos 5 (krb5) 1.4.1 and earlier allows remote attackers to execute arbitrary code via certain error conditions Affected: before 10.4.2 |
The 500 most important CVEs for this product (exploited first, then by severity)