Brian Mastenbrook

The issue is related to the implementation of the RPMB command status, allowing an attacker to write to the Write Protect Configuration Block. This may lead to denial of service or escalation of privileges.

A security issue has been identified in the Replay Protected Memory Block (RPMB) protocol, which is used by storage devices to secure trusted firmware. This issue can be exploited in several scenarios, potentially allowing an attacker to affect the RPMB state without the knowledge of the trusted component. The issue can lead to authentication bypass via a capture-replay attack.

The issue concerns the User Documentation component in Apple Mac OS X, which uses http sessions for updates to App Store help information. This allows man-in-the-middle attackers to execute arbitrary code by spoofing the http server.

The issue allows remote attackers to execute arbitrary code via a package file type in an internet-enabled disk image. This is due to the lack of a warning for an unsafe file type, making it easier for attackers to exploit.

The issue concerns the Help Viewer in Apple Mac OS X, which does not use a secure HTTPS connection to retrieve content from a website. This allows man-in-the-middle attackers to send a crafted `help:runscript` link, potentially executing arbitrary code via a spoofed response.

Name of the Vulnerable Software and Affected Versions: Ruby on Rails versions 2.x prior to 2.2.3 Ruby on Rails versions 2.3.x prior to 2.3.4 Description: A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML by placing malformed Unicode strings into a form helper. Recommendations: For Ruby on Rails versions 2.x prior to 2.2.3, update to version 2.2.3 or later. For Ruby on Rails versions 2.3.x prior to 2.3.4, update to version 2.3.4 or later.

Name of the Vulnerable Software and Affected Versions: Apple Mac OS X versions 10.5 through 10.5.7 Description: The issue allows user-assisted remote attackers to execute arbitrary JavaScript via a web page, making it easier to exploit. This occurs because of an incomplete blacklist vulnerability in CoreTypes in Apple Mac OS X. The vulnerability is exploited when a web page offers a download with a Content-Type value that is not on the list of possibly unsafe content types for Safari. Recommendations: For Apple Mac OS X versions 10.5 through 10.5.7, update to version 10.5.8 to resolve the issue.

The issue allows remote attackers to execute arbitrary code via a help: URL that triggers invocation of AppleScript files, due to the Help Viewer not verifying that HTML pathnames are located in a registered help book.

The issue allows remote attackers to execute arbitrary code via a help: URL that triggers invocation of AppleScript files, due to the Help Viewer not verifying that certain Cascading Style Sheets (CSS) are located in a registered help book.

The issue is related to input validation problems, allowing remote attackers to execute arbitrary JavaScript in the local security zone via a crafted feed URL.

The issue allows user-assisted remote attackers to execute arbitrary code via specific content types for downloadable objects. This can occur through various applications, including Automator, Help, Safari, or Terminal, when a downloadable object does not trigger a warning message in the Download Validation feature in Mac OS X 10.4 or the Quarantine feature in Mac OS X 10.5.

The issue allows remote attackers to execute arbitrary code via unspecified URL schemes in Terminal.app.