Aaron Sigel

The issue allows remote attackers to trigger a refresh operation and cause a visit to an arbitrary web site via a crafted HTML e-mail message.

A race condition in kext tools allows local users to bypass intended signature requirements for kernel extensions by leveraging improper pathname validation.

The issue allows user-assisted remote attackers to execute arbitrary applications by triggering a log entry with a crafted attached URL. This is related to the Console in Apple Mac OS X.

The issue allows remote attackers to bypass the FaceTime call-confirmation prompt via a crafted FaceTime: URL. This could potentially lead to unauthorized access to the device's camera and microphone.

The issue arises from improper handling of the Quarantine attribute of HTML documents. This allows remote attackers to read arbitrary files on a user's system by leveraging the presence of a downloaded document, but it requires user assistance.

The issue allows user-assisted remote attackers to obtain sensitive information about full pathnames via a crafted web site, due to improper handling of drag-and-drop events by WebKit in Apple Safari.

The issue allows remote attackers to bypass intended sandbox restrictions and read arbitrary files by leveraging a WebProcess compromise. This is due to improper handling of file: URLs in WebKit.

The issue allows remote attackers to read arbitrary files via a feed:// URL.

The issue allows physically proximate attackers to bypass screen locking and launch a Safari process when the RSS Visualizer screensaver is enabled.

A race condition exists in the initialization routine in blued in Bluetooth in Apple Mac OS X, allowing local users to gain privileges via vectors involving a temporary file.

The issue allows man-in-the-middle attackers to conduct cross-site scripting (XSS) attacks. This occurs when the "Save for Web" selection in QuickTime Player exports HTML documents containing an http link to a script file, which can be spoofed by an attacker during local viewing of an exported document.

The issue concerns the User Documentation component in Apple Mac OS X, which uses http sessions for updates to App Store help information. This allows man-in-the-middle attackers to execute arbitrary code by spoofing the http server.

The issue allows remote attackers to execute arbitrary code via a crafted web site, due to the failure to enforce an intended policy for file: URLs.

The issue is related to the installer in Google Chrome, which does not properly handle lock files. This has an unspecified impact and attack vectors.

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. This could potentially lead to unauthorized access or control of the affected devices.

The issue affects the SNMP component on certain HP printer models, allowing remote attackers to obtain sensitive information or modify data. This is related to vectors involving the Embedded Web Server (EWS).

The issue allows remote attackers to read documents on the scan surface of the affected printers via unspecified vectors.

The issue is related to the Install Helper in the Installer component, which does not properly process an unspecified URL. This could allow remote attackers to track user logins by logging network traffic from an agent intended to send traffic to an Apple server.

The issue allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service, specifically an application crash, via vectors related to interaction between Software Update and distribution scripts.

The issue allows man-in-the-middle attackers to make calls via a crafted URL in an ad, specifically affecting the iAd Content Display in Apple iOS.