Alfredo Pesoli

A race condition exists where an application may be able to gain root privileges. This occurs when the system fails to properly validate operations during concurrent processing, allowing a window of opportunity for privilege escalation.

A use after free issue, which occurs when a program continues to use a pointer after it has been freed, was addressed with improved memory management. This flaw could allow an application to gain root privileges.

A logic issue exists where an application may be able to gain root privileges, which are the highest level of administrative access on the system. This was addressed by implementing improved checks.

An authorization issue exists due to improper state management. An attacker possessing the legacy VNC password for Screen Sharing may be able to copy files to the Mac.

A permissions issue exists where a malicious application may be able to gain root privileges, which are the highest level of administrative access on the system.

A format string issue in the Login Window of Mac OS X allows attackers to execute arbitrary code or cause an application crash via format string specifiers in an application name.

The issue allows remote attackers to execute arbitrary SQL commands via the `pageid` parameter in index.php. This can also be leveraged for path disclosure with an invalid `pageid` parameter.

The issue allows remote authenticated administrators to include and execute arbitrary local files via a .. (dot dot) in the `f` parameter. This can be demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by index.php.