RETIRED: Apple Mac OS X Prior to 10.6.5 Multiple Security Vulnerabilities

BID:44778

Info

RETIRED: Apple Mac OS X Prior to 10.6.5 Multiple Security Vulnerabilities

Bugtraq ID: 44778
Class: Unknown
CVE:
Remote: Yes
Local: Yes
Published: Nov 10 2010 12:00AM
Updated: Nov 15 2010 03:56PM
Credit: Apple, Jesse Ruderman of Mozilla Corporation, Marc Schoenefeld of Red Hat, and Christoph Diehl of Mozilla, Andrew Kiss. Rodrigo Rubira Branco from Check Point Vulnerability Discovery Team (VDT), and Rainer Mueller Marc Schoenefeld of Red Hat, Steven Fisher
Vulnerable: Apple Mac OS X Server 10.6.4
Apple Mac OS X Server 10.6.3
Apple Mac OS X Server 10.6.2
Apple Mac OS X Server 10.6.1
Apple Mac OS X Server 10.5.8
Apple Mac OS X Server 10.5.7
Apple Mac OS X Server 10.5.6
Apple Mac OS X Server 10.5.5
Apple Mac OS X Server 10.5.4
Apple Mac OS X Server 10.5.3
Apple Mac OS X Server 10.5.2
Apple Mac OS X Server 10.5.1
Apple Mac OS X Server 10.6
Apple Mac OS X Server 10.5
Apple Mac OS X 10.6.4
Apple Mac OS X 10.6.3
Apple Mac OS X 10.6.2
Apple Mac OS X 10.6.1
Apple Mac OS X 10.5.8
Apple Mac OS X 10.5.7
Apple Mac OS X 10.5.6
Apple Mac OS X 10.5.5
Apple Mac OS X 10.5.4
Apple Mac OS X 10.5.3
Apple Mac OS X 10.5.2
Apple Mac OS X 10.5.1
Apple Mac OS X 10.6
Apple Mac OS X 10.5
Not Vulnerable: Apple Mac OS X Server 10.6.5

Discussion

RETIRED: Apple Mac OS X Prior to 10.6.5 Multiple Security Vulnerabilities

Apple Mac OS X is prone to multiple security vulnerabilities that have been addressed in Security Update 2010-007.

The update addresses new vulnerabilities that affect: AFP Server, AppKit, ATS, CFNetwork, CoreGraphics, Apple Type Service, CoreGraphics, CoreText, Directory Service, Image Capture, ImageIO, Image RAW, Networking, Kernel, OpenSSL, Password Server, Printing, QuickLook, QuickTime, Safari RSS, Time Machine, and xar.

This BID is being retired. The following individual records exist to better document the issues:

44784 Apple Mac OS X Networking PIM IPv6 NULL Pointer Dereference Denial of Service Vulnerability
44785 Apple QuickTime GIF File Uninitialized Memory Remote Code Execution Vulnerability
44787 Apple QuickTime FlashPix Image File Uninitialized Memory Remote Code Execution Vulnerability
44789 Apple QuickTime Sorenson 3 Encoded Movie File Memory Corruption Vulnerability
44790 Apple QuickTime MPEG Encoded Movie Signedness Error Remote Code Execution Vulnerability
44792 Apple QuickTime MPEG Encoded Movie Buffer Overflow Vulnerability
44794 Apple QuickTime Movie File Memory Corruption Vulnerability
44795 Apple QuickTime JP2 Image Uninitialized Memory Remote Code Execution Vulnerability
44796 Apple QuickTime AVI File Memory Corruption Vulnerability
44798 Apple QuickTime JP2 Image Heap Buffer Overflow Vulnerability
44799 Apple Mobile OfficeImport Framework Excel Record Memory Corruption Vulnerability
44800 Apple Mac OS X AFP Server NULL Pointer Dereference Denial of Service Vulnerability
44802 Apple Mac OS X Apple Type Services Embedded Font Stack Buffer Overflow Vulnerability
44803 Apple AppKit String Containing Bidirectional Text Buffer Overflow Vulnerability
44804 Apple Mac OS X AFP Server Directory Traversal Vulnerability
44805 Apple Mac OS X Apple Type Services Memory Corruption Vulnerability
44806 Apple Mac OS X CoreGraphics (CVE-2010-1836) PDF File Stack Buffer Overflow Vulnerability
44807 Apple Mac OS X AFP Server Error Handling Security Vulnerability
44808 Apple Mac OS X CoreText (CVE-2010-1837) Memory Corruption Vulnerability
44811 Apple Mac OS X CFNetwork (CVE-2010-1834) Security Vulnerability
44812 Apple Mac OS X QuickLook Remote Buffer Overflow Vulnerability
44813 Apple Mac OS X Image Capture (CVE-2010-1844) Memory Corruption Vulnerability
44814 Apple Safari RSS Feed Information Disclosure Vulnerability
44815 Apple Mac OS X Disk Images (CVE-2010-1841) Memory Corruption Vulnerability
44816 Apple Mac OS X Directory Services Password Validation Stack Buffer Overflow Vulnerability
44817 Apple Mac OS X Directory Services (CVE-2010-1838) Security Bypass Vulnerability
44819 Apple Mac OS X ImageIO PSD File Handling Multiple Memory Corruption Vulnerabilities
44822 Apple Mac OS X Image RAW (CVE-2010-1846) Heap-Based Buffer Overflow Vulnerability
44828 xar Malformed xar Archive Extraction Heap Buffer Overflow Vulnerability
44829 Apple Mac OS X Wiki Server HTML Injection Vulnerability
44831 Apple Mac OS X OpenSSL Certificate Validation Security-Bypass Vulnerability
44832 Apple Mac OS X Apple Type Services Embedded Font Buffer Overflow Vulnerability
44833 Apple Mac OS X Password Server Replication Security Bypass Vulnerability
44834 Apple Mac OS X Time Machine (CVE-2010-1803) Security Bypass Vulnerability
44835 Apple Mac OS X Printing NULL Pointer Dereference Denial of Service Vulnerability
44840 Apple Mac OS X Kernel Component (CVE-2010-1847) Denial of Service Vulnerability

Exploit / POC

RETIRED: Apple Mac OS X Prior to 10.6.5 Multiple Security Vulnerabilities

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

NOTE: Some of these issues will not require specific exploit code and may be trivial to exploit.

Solution / Fix

RETIRED: Apple Mac OS X Prior to 10.6.5 Multiple Security Vulnerabilities

Solution:
Vendor updates are available. Please see the references for more information.


Apple Mac OS X Server 10.6

Apple Mac OS X 10.6

Apple Mac OS X Server 10.5.8

Apple Mac OS X 10.5.8

Apple Mac OS X Server 10.6.1

Apple Mac OS X 10.6.1

Apple Mac OS X 10.6.2

Apple Mac OS X Server 10.6.2

Apple Mac OS X 10.6.3

Apple Mac OS X Server 10.6.3

Apple Mac OS X 10.6.4

Apple Mac OS X Server 10.6.4

References

RETIRED: Apple Mac OS X Prior to 10.6.5 Multiple Security Vulnerabilities

References:

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report