MO
Product
Mac OS X
On CISA KEVExploited in the wildRansomware-linked
3,208
CVEs
24
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 140High 357Medium 3Low 0
Watch
Add Mac OS X to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2016-7663 | 9.8 | Feb 20 | An issue was discovered in certain Apple products Affected: through 10.12.1 |
| CVE-2016-4702 | 9.8 | Sep 25 | Audio in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows remote attackers to execute arbitrary code or cause a denial of service (memory… Affected: before 10.12.0 |
| CVE-2016-4658 | 9.8 | Sep 25 | xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbid namespace nodes in… Affected: before 10.12 |
| CVE-2016-4629 | 9.8 | Jul 22 | ImageIO in Apple OS X before 10.11.6 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted xStride and yStride values in… Affected: through 10.11.5 |
| CVE-2016-4616 | 9.8 | Jul 22 | libxml2 in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote… Affected: before 10.11.6 |
| CVE-2016-4615 | 9.8 | Jul 22 | libxml2 in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote… Affected: before 10.11.6 |
| CVE-2016-4614 | 9.8 | Jul 22 | libxml2 in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote… Affected: before 10.11.6 |
| CVE-2016-4609 | 9.8 | Jul 22 | libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote… Affected: before 10.11.6 |
| CVE-2016-4607 | 9.8 | Jul 22 | libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote… Affected: before 10.11.6 |
| CVE-2016-4598 | 9.8 | Jul 22 | QuickTime in Apple OS X before 10.11.6 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted image Affected: through 10.11.5 |
| CVE-2015-7988 | 9.8 | Jun 26 | The handle_regservice_request function in mDNSResponder before 625.41.2 allows remote attackers to execute arbitrary code or cause a denial of service (NULL pointer dereference)… Affected: 10.9 before 10.9.5; 10.10.0 before 10.10.5; 10.11.0 before 10.11.1 |
| CVE-2015-7987 | 9.8 | Jun 26 | Multiple buffer overflows in mDNSResponder before 625.41.2 allow remote attackers to read or write to out-of-bounds memory locations via vectors involving the (1)… Affected: 10.9 before 10.9.5; 10.10.0 before 10.10.5; 10.11.0 before 10.11.1 |
| CVE-2016-4448 | 9.8 | Jun 9 | Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vectors Affected: before 10.11.6 |
| CVE-2016-0718 | 9.8 | May 26 | Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow Affected: 10.11.0 through 10.11.5 |
| CVE-2016-4073 | 9.8 | May 20 | Multiple integer overflows in the mbfl_strcut function in ext/mbstring/libmbfl/mbfl/mbfilter.c in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allow remote… Affected: through 10.11.3 |
| CVE-2016-4072 | 9.8 | May 20 | The Phar extension in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allows remote attackers to execute arbitrary code via a crafted filename, as demonstrated by… Affected: through 10.11.4 |
| CVE-2016-4071 | 9.8 | May 20 | Format string vulnerability in the php_snmp_error function in ext/snmp/snmp.c in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allows remote attackers to execute… Affected: through 10.11.4 |
| CVE-2016-3141 | 9.8 | Mar 31 | Use-after-free vulnerability in wddx.c in the WDDX extension in PHP before 5.5.33 and 5.6.x before 5.6.19 allows remote attackers to cause a denial of service (memory corruption… Affected: through 10.11.4 |
| CVE-2016-1761 | 9.8 | Mar 24 | libxml2 in Apple iOS before 9.3, OS X before 10.11.4, and watchOS before 2.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via… Affected: through 10.11.3 |
| CVE-2016-1741 | 9.8 | Mar 24 | The NVIDIA driver in the Graphics Drivers subsystem in Apple OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service… Affected: through 10.11.3 |
| CVE-2016-0801 | 9.8 | Feb 7 | The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows remote attackers to execute arbitrary code or cause… Affected: through 10.11.3 |
| CVE-2010-1378 | 9.8 | Nov 15 | OpenSSL in Apple Mac OS X 10.6.x before 10.6.5 does not properly perform arithmetic, which allows remote attackers to bypass X.509 certificate authentication via an arbitrary… Affected: 10.6.0 before 10.6.5 |
| CVE-2010-2941 | 9.8 | Nov 5 | ipp.c in cupsd in CUPS 1.4.4 and earlier does not properly allocate memory for attribute values with invalid string data types, which allows remote attackers to cause a denial of… Affected: before 10.5.8; 10.6.0 through 10.6.4 |
| CVE-2010-0211 | 9.8 | Jul 28 | The slap_modrdn2mods function in modrdn.c in OpenLDAP 2.4.22 does not check the return value of a call to the smr_normalize function, which allows remote attackers to cause a… Affected: 10.6.0 before 10.6.5 |
| CVE-2010-1205 | 9.8 | Jun 30 | Buffer overflow in pngpread.c in libpng before 1.2.44 and 1.4.x before 1.4.3, as used in progressive applications, might allow remote attackers to execute arbitrary code via a PNG… Affected: 10.6.0 before 10.6.4 |
| CVE-2009-2422 | 9.8 | Jul 10 | The example code for the digest authentication functionality (http_authentication.rb) in Ruby on Rails before 2.3.3 defines an authenticate_or_request_with_http_digest block that… Affected: 10.6.0 before 10.6.3; 10.5.8 |
| CVE-2008-0599 | 9.8 | May 5 | The init_request_info function in sapi/cgi/cgi_main.c in PHP before 5.2.6 does not properly consider operator precedence when calculating the length of PATH_TRANSLATED, which… Affected: before 10.5.4 |
| CVE-2007-3798 | 9.8 | Jul 16 | Integer overflow in print-bgp.c in the BGP dissector in tcpdump 3.9.6 and earlier allows remote attackers to execute arbitrary code via crafted TLVs in a BGP packet, related to an… Affected: 10.0.0 before 10.4.11 |
| CVE-2005-1689 | 9.8 | Jul 18 | Double free vulnerability in the krb5_recvauth function in MIT Kerberos 5 (krb5) 1.4.1 and earlier allows remote attackers to execute arbitrary code via certain error conditions Affected: before 10.4.2 |
| CVE-2003-0466 | 9.8 | Aug 27 | Off-by-one error in the fb_realpath() function, as derived from the realpath function in BSD, may allow attackers to execute arbitrary code, as demonstrated in wu-ftpd 2.5.0… Affected: 10.2.6 |
| CVE-2002-1347 | 9.8 | Dec 18 | Multiple buffer overflows in Cyrus SASL library 2.1.9 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via (1) long inputs… Affected: before 10.3.8 |
| CVE-2022-32847 | 9.1 | Sep 23 | This issue was addressed with improved checks Affected: 10.15.7; 10.15.7; 10.15.7; 10.15.7; 10.15.7; 10.15.7; +6 more |
| CVE-2022-22721 | 9.1 | Mar 14 | If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out of bounds writes Affected: 10.15 before 10.15.7; 10.15.7; 10.15.7; 10.15.7; 10.15.7; 10.15.7; +7 more |
| CVE-2020-9920 | 9.1 | Oct 22 | A path handling issue was addressed with improved validation Affected: before 10.15.6 |
| CVE-2020-9906 | 9.1 | Oct 22 | A memory corruption issue was addressed with improved input validation Affected: 10.13 before 10.13.6; 10.14 before 10.14.6; 10.15 before 10.15.6; 10.13.6; 10.13.6; 10.13.6; +20 more |
| CVE-2020-9868 | 9.1 | Oct 22 | A certificate validation issue existed when processing administrator added certificates Affected: before 10.15.6 |
| CVE-2019-8527 | 9.1 | Dec 18 | A buffer overflow was addressed with improved size validation Affected: before 10.14.4 |
| CVE-2018-18313 | 9.1 | Dec 7 | Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive information from process memory Affected: before 10.14.4 |
| CVE-2017-9788 | 9.1 | Jul 13 | In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between… Affected: before 10.13.1 |
| CVE-2016-4694 | 9.1 | Sep 25 | The Apache HTTP Server in Apple OS X before 10.12 and OS X Server before 5.2 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of… Affected: through 10.11.6 |
The 500 most important CVEs for this product (exploited first, then by severity)