Stefan Esser

An out-of-bounds write issue occurs when processing a maliciously crafted font, which can lead to corrupt process memory or unexpected application termination. An out-of-bounds write is a condition where the program writes data past the end of the intended buffer, potentially overwriting adjacent memory.

A permissions issue exists where a malicious application may be able to gain root privileges, which are the highest level of administrative access on the system.

An out-of-bounds read issue existed, leading to the disclosure of kernel memory. This issue was addressed with improved input validation. A malicious application may be able to determine kernel memory layout.

The issue is related to a CWE-20 Input Validation problem in thumbnail processing, which can lead to remote code execution. This can be exploited via thumbnail upload by an authenticated user. It may require additional plugins to be exploited, although this has not been confirmed.

The issue involves the Kernel component and is related to a race condition. This condition allows attackers to bypass intended memory-read restrictions via a crafted app.

The issue is caused by an integer underflow in the GD Graphics Library, which may allow remote attackers to have an unspecified impact. This can be achieved through vectors related to decrementing variables, potentially by manipulating the number of horizontal and vertical elements in an image.

The issue concerns the Graphics Drivers subsystem and can be exploited by local users to gain privileges or cause a denial of service due to memory corruption. The exploitation is possible via unspecified vectors. The vulnerability is also described as a buffer overflow in the Graphics Drivers subsystem.

The issue allows attackers to access the process list via a crafted app that makes an API call.

The issue is related to errors in pointer dereferencing in the IOHIDFamily component. It can be exploited by a local attacker to gain privileges or cause a denial of service (NULL pointer dereference) via unspecified vectors.

The issue is related to insufficient access control in the CoreStorage component of the Mac OS X operating system. This allows an attacker to execute arbitrary code in a privileged context via a crafted app.

The issue concerns the kernel in Apple OS X, which does not properly manage memory in kernel-extension APIs. This allows attackers to obtain sensitive memory-layout information via a crafted app.

The issue is related to a "type confusion" vulnerability in the phpinfo implementation, which might allow context-dependent attackers to obtain sensitive information from process memory by using the integer data type with crafted values for the `PHP AUTH PW`, `PHP AUTH TYPE`, `PHP AUTH USER`, and `PHP SELF` variables. This could potentially be exploited in an Apache HTTP Server web-hosting environment with mod ssl and a PHP mod php, as demonstrated by reading a private SSL key.

The issue arises from incorrect anticipation of data structure types after unserialization in the SPL component, leading to potential remote code execution through crafted strings that trigger the use of a Hashtable destructor. This is related to "type confusion" issues in ArrayObject and SPLObjectStorage.

The issue arises from the improper parsing of notBefore and notAfter timestamps in X.509 certificates by the asn1 time to time t function. This can lead to memory corruption, allowing remote attackers to execute arbitrary code or cause a denial of service. The vulnerability is caused by a buffer overflow in the OpenSSL library used by PHP.

The issue allows remote attackers to trigger the installation of arbitrary applications via a download-manifest `itms-services://` URL. This is possible because the software does not follow redirects during the determination of the hostname to display in an installation dialog, leveraging an open redirect vulnerability within a trusted domain.

The issue is related to the posix spawn system call in the XNU kernel, which does not properly validate data for file actions and port actions. This allows local users to cause a denial of service (panic) by providing a size value that is inconsistent with a header count field. Additionally, it enables local users to obtain sensitive information from kernel heap memory by using a certain size value in conjunction with a crafted buffer.

The issue is related to the `get xattrinfo` function in the XNU kernel, which does not properly validate the header of an AppleDouble file. This could allow local users to cause a denial of service, potentially resulting in memory corruption, or have other unspecified impacts by using an invalid file on an msdosfs filesystem.

A stack-based buffer overflow issue exists in the openSharedCacheFile function in dyld.cpp, which can be exploited by attackers using a long string in the `DYLD SHARED CACHE DIR` environment variable, making it easier to conduct untethering attacks.

The issue concerns the mach port space info function in the XNU kernel, which fails to initialize a certain structure member. This allows local users to obtain sensitive information from kernel heap memory by making a crafted call.

The issue allows local users to bypass cookie randomization by executing a program with a call-path beginning with the stack-guard= substring. This can be demonstrated by an iOS untethering attack or an attack against a setuid Mac OS X program.