The Vigil@nce team watches public vulnerabilities impacting your computers, and then offers security solutions, a database and tools to fix them.

Computer vulnerabilities of Apple Mac OS X

vulnerability 28650

MacOS: privilege escalation via copy-on-write

Synthesis of the vulnerability

An attacker can bypass restrictions via copy-on-write of MacOS, in order to escalate his privileges.
Impacted products: Mac OS X.
Severity: 2/4.
Consequences: administrator access/rights, data creation/edition.
Provenance: user shell.
Creation date: 05/03/2019.
Identifiers: VIGILANCE-VUL-28650.

Description of the vulnerability

An attacker can bypass restrictions via copy-on-write of MacOS, in order to escalate his privileges.
Full Vigil@nce bulletin... (Free trial)

computer vulnerability alert CVE-2018-5383

Bluetooth Firmware: information disclosure via Weak Elliptic Curve Parameters

Synthesis of the vulnerability

An attacker can bypass access restrictions to data via Weak Elliptic Curve Parameters of Bluetooth Firmware, in order to obtain sensitive information.
Impacted products: iOS by Apple, iPhone, Mac OS X, Debian, Android OS, openSUSE Leap, SUSE Linux Enterprise Desktop, SLES.
Severity: 2/4.
Consequences: data reading.
Provenance: radio connection.
Creation date: 19/02/2019.
Identifiers: CERTFR-2019-AVI-188, CVE-2018-5383, DLA-1747-1, HT208848, HT208849, HT208937, HT209139, openSUSE-SU-2019:0275-1, SUSE-SU-2019:0422-1, SUSE-SU-2019:0427-1, SUSE-SU-2019:0427-2, SUSE-SU-2019:0466-1, VIGILANCE-VUL-28536.

Description of the vulnerability

An attacker can bypass access restrictions to data via Weak Elliptic Curve Parameters of Bluetooth Firmware, in order to obtain sensitive information.
Full Vigil@nce bulletin... (Free trial)

computer vulnerability alert CVE-2017-2520

SQLite: buffer overflow via sqlite3_value_text

Synthesis of the vulnerability

An attacker can trigger a buffer overflow via sqlite3_value_text() of SQLite, in order to trigger a denial of service, and possibly to run code.
Impacted products: iOS by Apple, iPhone, Mac OS X, SQLite.
Severity: 2/4.
Consequences: user access/rights, denial of service on service, denial of service on client.
Provenance: document.
Creation date: 14/01/2019.
Identifiers: 384, CVE-2017-2520, HT207797, HT207798, VIGILANCE-VUL-28256.

Description of the vulnerability

An attacker can trigger a buffer overflow via sqlite3_value_text() of SQLite, in order to trigger a denial of service, and possibly to run code.
Full Vigil@nce bulletin... (Free trial)

computer vulnerability CVE-2017-2519

SQLite: memory corruption via Table Objects

Synthesis of the vulnerability

An attacker can trigger a memory corruption via Table Objects of SQLite, in order to trigger a denial of service, and possibly to run code.
Impacted products: iOS by Apple, iPhone, Mac OS X, SQLite.
Severity: 2/4.
Consequences: user access/rights, denial of service on service, denial of service on client.
Provenance: document.
Creation date: 14/01/2019.
Identifiers: 288, CVE-2017-2519, HT207797, HT207798, VIGILANCE-VUL-28255.

Description of the vulnerability

An attacker can trigger a memory corruption via Table Objects of SQLite, in order to trigger a denial of service, and possibly to run code.
Full Vigil@nce bulletin... (Free trial)

vulnerability note CVE-2017-2518

SQLite: use after free via Query Optimizer

Synthesis of the vulnerability

An attacker can force the usage of a freed memory area via Query Optimizer of SQLite, in order to trigger a denial of service, and possibly to run code.
Impacted products: iOS by Apple, iPhone, Mac OS X, SQLite.
Severity: 2/4.
Consequences: user access/rights, denial of service on service, denial of service on client.
Provenance: user account.
Creation date: 14/01/2019.
Identifiers: 199, CVE-2017-2518, HT207797, HT207798, VIGILANCE-VUL-28254.

Description of the vulnerability

An attacker can force the usage of a freed memory area via Query Optimizer of SQLite, in order to trigger a denial of service, and possibly to run code.
Full Vigil@nce bulletin... (Free trial)

computer vulnerability bulletin CVE-2018-18313

Perl Core: out-of-bounds memory reading via S_grok_bslash_N

Synthesis of the vulnerability

An attacker can force a read at an invalid address via S_grok_bslash_N() of Perl Core, in order to trigger a denial of service, or to obtain sensitive information.
Impacted products: Mac OS X, Debian, Fedora, Snap Creator Framework, OpenBSD, openSUSE Leap, Solaris, Perl Core, RHEL, SLES, Ubuntu.
Severity: 2/4.
Consequences: data reading, denial of service on service, denial of service on client.
Provenance: document.
Creation date: 30/11/2018.
Identifiers: 133192, bulletinapr2019, CVE-2018-18313, DSA-4347-1, FEDORA-2018-9dbe983805, FEDORA-2018-ca03363d57, HT209600, NTAP-20190221-0003, openSUSE-SU-2018:4258-1, RHSA-2019:0001-01, RHSA-2019:0010-01, SUSE-SU-2018:4187-1, USN-3834-1, USN-3834-2, VIGILANCE-VUL-27918.

Description of the vulnerability

An attacker can force a read at an invalid address via S_grok_bslash_N() of Perl Core, in order to trigger a denial of service, or to obtain sensitive information.
Full Vigil@nce bulletin... (Free trial)

computer vulnerability alert CVE-2018-18311

Perl Core: integer overflow via Perl_my_setenv

Synthesis of the vulnerability

An attacker can generate an integer overflow via Perl_my_setenv() of Perl Core, in order to trigger a denial of service, and possibly to run code.
Impacted products: Mac OS X, Debian, Fedora, McAfee Web Gateway, Snap Creator Framework, OpenBSD, openSUSE Leap, Solaris, Perl Core, RHEL, SLES, Ubuntu.
Severity: 2/4.
Consequences: user access/rights, denial of service on service, denial of service on client.
Provenance: document.
Creation date: 30/11/2018.
Identifiers: 133204, bulletinjan2019, CVE-2018-18311, DLA-1601-1, DSA-4347-1, FEDORA-2018-9dbe983805, FEDORA-2018-ca03363d57, HT209600, NTAP-20190221-0003, openSUSE-SU-2018:4258-1, RHSA-2019:0001-01, RHSA-2019:0010-01, RHSA-2019:0109-01, SB10276, SB10278, SUSE-SU-2018:4187-1, USN-3834-1, USN-3834-2, VIGILANCE-VUL-27916.

Description of the vulnerability

An attacker can generate an integer overflow via Perl_my_setenv() of Perl Core, in order to trigger a denial of service, and possibly to run code.
Full Vigil@nce bulletin... (Free trial)

vulnerability announce CVE-2018-4178 CVE-2018-4248 CVE-2018-4259

Apple macOS: multiple vulnerabilities

Synthesis of the vulnerability

An attacker can use several vulnerabilities of Apple macOS.
Impacted products: Mac OS X.
Severity: 3/4.
Consequences: unknown consequence, administrator access/rights, privileged access/rights, user access/rights, client access/rights, data reading, data creation/edition, data deletion, data flow, denial of service on server, denial of service on service, denial of service on client, disguisement.
Provenance: document.
Number of vulnerabilities in this bulletin: 16.
Creation date: 10/07/2018.
Revision date: 31/10/2018.
Identifiers: CERTFR-2018-AVI-329, CVE-2018-4178, CVE-2018-4248, CVE-2018-4259, CVE-2018-4268, CVE-2018-4269, CVE-2018-4276, CVE-2018-4277, CVE-2018-4280, CVE-2018-4283, CVE-2018-4285, CVE-2018-4286, CVE-2018-4287, CVE-2018-4288, CVE-2018-4289, CVE-2018-4291, CVE-2018-4293, HT208937, VIGILANCE-VUL-26662, ZDI-18-1291, ZDI-18-602, ZDI-18-607.

Description of the vulnerability

An attacker can use several vulnerabilities of Apple macOS.
Full Vigil@nce bulletin... (Free trial)

computer vulnerability note CVE-2018-3646

Intel processors: information disclosure via Foreshadow L1TF Virtualization

Synthesis of the vulnerability

An attacker can bypass access restrictions to data via L1TF Virtualization on Intel processors, in order to obtain sensitive information.
Impacted products: SNS, Mac OS X, Arkoon FAST360, Cisco ASR, Nexus by Cisco, NX-OS, Cisco UCS, XenServer, Debian, NetWorker, Unisphere EMC, BIG-IP Hardware, TMOS, Fedora, FreeBSD, HP ProLiant, QRadar SIEM, Juniper EX-Series, Juniper J-Series, Junos OS, SRX-Series, Windows 10, Windows 2008 R0, Windows 2008 R2, Windows 2012, Windows 2016, Windows 7, Windows 8, Windows (platform) ~ not comprehensive, Windows RT, OpenBSD, openSUSE Leap, Oracle Communications, Solaris, pfSense, RHEL, SIMATIC, SUSE Linux Enterprise Desktop, SLES, Synology DSM, Ubuntu, Unix (platform) ~ not comprehensive, ESXi, vCenter Server, VMware vSphere Hypervisor, VMware Workstation, Xen.
Severity: 2/4.
Consequences: data reading.
Provenance: user shell.
Creation date: 16/08/2018.
Identifiers: 525211, 528031, ADV180018, CERTFR-2018-AVI-385, CERTFR-2018-AVI-386, CERTFR-2018-AVI-387, CERTFR-2018-AVI-388, CERTFR-2018-AVI-390, CERTFR-2018-AVI-391, CERTFR-2018-AVI-392, CERTFR-2018-AVI-416, CERTFR-2018-AVI-419, CERTFR-2018-AVI-426, CERTFR-2018-AVI-557, CERTFR-2018-AVI-584, CERTFR-2019-AVI-169, cisco-sa-20180814-cpusidechannel, cpuapr2019, cpujan2019, CTX236548, CVE-2018-3646, DLA-1481-1, DLA-1506-1, DSA-2018-170, DSA-2018-217, DSA-4274-1, DSA-4279-1, DSA-4279-2, FEDORA-2018-1c80fea1cd, FEDORA-2018-f8cba144ae, Foreshadow, FreeBSD-SA-18:09.l1tf, HPESBHF03874, HT209139, HT209193, ibm10742755, INTEL-SA-00161, JSA10937, K31300402, openSUSE-SU-2018:2399-1, openSUSE-SU-2018:2404-1, openSUSE-SU-2018:2407-1, openSUSE-SU-2018:2434-1, openSUSE-SU-2018:2436-1, openSUSE-SU-2018:4304-1, RHSA-2018:2384-01, RHSA-2018:2387-01, RHSA-2018:2388-01, RHSA-2018:2389-01, RHSA-2018:2390-01, RHSA-2018:2391-01, RHSA-2018:2392-01, RHSA-2018:2393-01, RHSA-2018:2394-01, RHSA-2018:2395-01, RHSA-2018:2396-01, RHSA-2018:2602-01, RHSA-2018:2603-01, SSA-254686, STORM-2018-005, SUSE-SU-2018:2328-1, SUSE-SU-2018:2331-1, SUSE-SU-2018:2332-1, SUSE-SU-2018:2335-1, SUSE-SU-2018:2338-1, SUSE-SU-2018:2344-1, SUSE-SU-2018:2362-1, SUSE-SU-2018:2366-1, SUSE-SU-2018:2374-1, SUSE-SU-2018:2380-1, SUSE-SU-2018:2381-1, SUSE-SU-2018:2384-1, SUSE-SU-2018:2394-1, SUSE-SU-2018:2401-1, SUSE-SU-2018:2409-1, SUSE-SU-2018:2410-1, SUSE-SU-2018:2480-1, SUSE-SU-2018:2482-1, SUSE-SU-2018:2483-1, SUSE-SU-2018:2528-1, SUSE-SU-2018:2596-1, SUSE-SU-2018:2637-1, SUSE-SU-2018:3490-1, SUSE-SU-2018:4300-1, Synology-SA-18:45, USN-3740-1, USN-3740-2, USN-3741-1, USN-3741-2, USN-3741-3, USN-3742-1, USN-3742-2, USN-3742-3, USN-3756-1, USN-3823-1, VIGILANCE-VUL-26999, VMSA-2018-0020, VU#982149, XSA-273, XSA-289.

Description of the vulnerability

An attacker can bypass access restrictions to data via L1TF Virtualization on Intel processors, in order to obtain sensitive information.
Full Vigil@nce bulletin... (Free trial)

vulnerability bulletin CVE-2018-3665

Intel Microprocessors: information disclosure via Lazy FP State Restore

Synthesis of the vulnerability

An attacker can bypass access restrictions to data via Lazy FP State Restore of Intel Microprocessors, in order to obtain sensitive information.
Impacted products: Mac OS X, XenServer, Debian, BIG-IP Hardware, TMOS, Fedora, FreeBSD, QRadar SIEM, Junos Space, Linux, Windows 10, Windows 2008 R0, Windows 2008 R2, Windows 2012, Windows 2016, Windows 7, Windows 8, Windows RT, OpenBSD, openSUSE Leap, RHEL, SUSE Linux Enterprise Desktop, SLES, Synology DSM, Synology DS***, Synology RS***, Ubuntu, Xen.
Severity: 2/4.
Consequences: data reading.
Provenance: user shell.
Creation date: 14/06/2018.
Identifiers: ADV180016, CERTFR-2018-AVI-290, CERTFR-2018-AVI-292, CERTFR-2018-AVI-295, CERTFR-2018-AVI-296, CERTFR-2018-AVI-299, CERTFR-2018-AVI-301, CERTFR-2018-AVI-308, CERTFR-2018-AVI-312, CERTFR-2018-AVI-319, CERTFR-2018-AVI-321, CERTFR-2018-AVI-330, CERTFR-2018-AVI-584, CTX235745, CVE-2018-3665, DLA-1422-1, DLA-1422-2, DSA-4232-1, FEDORA-2018-d3cb6f113c, FreeBSD-SA-18:07.lazyfpu, HT208937, ibm10742755, INTEL-SA-00145, JSA10917, K21344224, openSUSE-SU-2018:1773-1, openSUSE-SU-2018:2116-1, openSUSE-SU-2018:2211-1, RHSA-2018:1852-01, RHSA-2018:1944-01, RHSA-2018:2164-01, RHSA-2018:2165-01, RHSA-2019:1170-01, RHSA-2019:1190-01, SUSE-SU-2018:1761-1, SUSE-SU-2018:1762-1, SUSE-SU-2018:1772-1, SUSE-SU-2018:1816-1, SUSE-SU-2018:1821-1, SUSE-SU-2018:1846-1, SUSE-SU-2018:1849-1, SUSE-SU-2018:1855-1, SUSE-SU-2018:1981-1, SUSE-SU-2018:2037-1, SUSE-SU-2018:2056-1, SUSE-SU-2018:2059-1, SUSE-SU-2018:2069-1, SUSE-SU-2018:2081-1, SUSE-SU-2018:2528-1, Synology-SA-18:31, USN-3696-1, USN-3696-2, USN-3698-1, USN-3698-2, VIGILANCE-VUL-26423, XSA-267.

Description of the vulnerability

An attacker can bypass access restrictions to data via Lazy FP State Restore of Intel Microprocessors, in order to obtain sensitive information.
Full Vigil@nce bulletin... (Free trial)
Our database contains other pages. You can request a free trial to read them.

Display information about Apple Mac OS X: