# CVEs published 2011-10-14

47 CVEs were published on October 14, 2011: 0 critical, 0 high. Days are UTC.

- [CVE-2011-0185](https://cve.now/CVE-2011-0185.md): Format string vulnerability in the debug-logging feature in Application Firewall in Apple Mac OS X before 10.7.2 allows local users to gain (no CVSS)
- [CVE-2011-0224](https://cve.now/CVE-2011-0224.md): CoreMedia in Apple Mac OS X through 10.6.8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption (no CVSS)
- [CVE-2011-0229](https://cve.now/CVE-2011-0229.md): Apple Type Services (ATS) in Apple Mac OS X through 10.6.8 does not properly handle embedded Type 1 fonts, which allows remote attackers to (no CVSS)
- [CVE-2011-0230](https://cve.now/CVE-2011-0230.md): Buffer overflow in the ATSFontDeactivate API in Apple Type Services (ATS) in Apple Mac OS X before 10.7.2 allows remote attackers to execute (no CVSS)
- [CVE-2011-0231](https://cve.now/CVE-2011-0231.md): CFNetwork in Apple Mac OS X before 10.7.2 does not properly follow an intended cookie-storage policy, which makes it easier for remote web s (no CVSS)
- [CVE-2011-0260](https://cve.now/CVE-2011-0260.md): The CoreProcesses component in Apple Mac OS X 10.7 before 10.7.2 does not prevent a system window from receiving keystrokes in the locked-sc (no CVSS)
- [CVE-2011-3212](https://cve.now/CVE-2011-3212.md): CoreStorage in Apple Mac OS X 10.7 before 10.7.2 does not ensure that all disk data is encrypted during the enabling of FileVault, which mak (no CVSS)
- [CVE-2011-3213](https://cve.now/CVE-2011-3213.md): The File Systems component in Apple Mac OS X before 10.7.2 does not properly track the specific X.509 certificate that a user manually accep (no CVSS)
- [CVE-2011-3214](https://cve.now/CVE-2011-3214.md): IOGraphics in Apple Mac OS X through 10.6.8 does not properly handle a locked-screen state in display sleep mode for an Apple Cinema Display (no CVSS)
- [CVE-2011-3215](https://cve.now/CVE-2011-3215.md): The kernel in Apple Mac OS X before 10.7.2 does not properly prevent FireWire DMA in the absence of a login, which allows physically proxima (no CVSS)
- [CVE-2011-3216](https://cve.now/CVE-2011-3216.md): The kernel in Apple Mac OS X before 10.7.2 does not properly implement the sticky bit for directories, which might allow local users to bypa (no CVSS)
- [CVE-2011-3217](https://cve.now/CVE-2011-3217.md): MediaKit in Apple Mac OS X through 10.6.8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption (no CVSS)
- [CVE-2011-3218](https://cve.now/CVE-2011-3218.md): The "Save for Web" selection in QuickTime Player in Apple Mac OS X through 10.6.8 exports HTML documents that contain an http link to a scri (no CVSS)
- [CVE-2011-3220](https://cve.now/CVE-2011-3220.md): QuickTime in Apple Mac OS X before 10.7.2 does not properly process URL data handlers in movie files, which allows remote attackers to obtai (no CVSS)
- [CVE-2011-3221](https://cve.now/CVE-2011-3221.md): QuickTime in Apple Mac OS X before 10.7.2 does not properly handle the atom hierarchy in movie files, which allows remote attackers to execu (no CVSS)
- [CVE-2011-3222](https://cve.now/CVE-2011-3222.md): Buffer overflow in QuickTime in Apple Mac OS X before 10.7.2 allows remote attackers to execute arbitrary code or cause a denial of service (no CVSS)
- [CVE-2011-3223](https://cve.now/CVE-2011-3223.md): Buffer overflow in QuickTime in Apple Mac OS X before 10.7.2 allows remote attackers to execute arbitrary code or cause a denial of service (no CVSS)
- [CVE-2011-3224](https://cve.now/CVE-2011-3224.md): The User Documentation component in Apple Mac OS X through 10.6.8 uses http sessions for updates to App Store help information, which allows (no CVSS)
- [CVE-2011-3225](https://cve.now/CVE-2011-3225.md): The SMB File Server component in Apple Mac OS X 10.7 before 10.7.2 does not prevent all guest users from accessing the share point record of (no CVSS)
- [CVE-2011-3226](https://cve.now/CVE-2011-3226.md): Open Directory in Apple Mac OS X 10.7 before 10.7.2, when an LDAPv3 server is used with RFC 2307 or custom mappings, allows remote attackers (no CVSS)
- [CVE-2011-3227](https://cve.now/CVE-2011-3227.md): libsecurity in Apple Mac OS X before 10.7.2 does not properly handle errors during processing of a nonstandard extension in a Certificate Re (no CVSS)
- [CVE-2011-3228](https://cve.now/CVE-2011-3228.md): QuickTime in Apple Mac OS X before 10.7.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption (no CVSS)
- [CVE-2011-3229](https://cve.now/CVE-2011-3229.md): Directory traversal vulnerability in Apple Safari before 5.1.1 allows remote attackers to execute arbitrary JavaScript code, in a Safari Ext (no CVSS)
- [CVE-2011-3230](https://cve.now/CVE-2011-3230.md): Apple Safari before 5.1.1 on Mac OS X does not enforce an intended policy for file: URLs, which allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2011-3231](https://cve.now/CVE-2011-3231.md): The SSL implementation in Apple Safari before 5.1.1 on Mac OS X before 10.7 accesses uninitialized memory during the processing of X.509 cer (no CVSS)
- [CVE-2011-3242](https://cve.now/CVE-2011-3242.md): The Private Browsing feature in Apple Safari before 5.1.1 on Mac OS X does not properly recognize the Always value of the Block Cookies sett (no CVSS)
- [CVE-2011-3243](https://cve.now/CVE-2011-3243.md): Cross-site scripting (XSS) vulnerability in WebKit, as used in Apple iOS before 5 and Safari before 5.1.1, allows remote attackers to inject (no CVSS)
- [CVE-2011-3245](https://cve.now/CVE-2011-3245.md): The Keyboards component in Apple iOS before 5 displays the final character of an entered password during a subsequent use of a keyboard, whi (no CVSS)
- [CVE-2011-3246](https://cve.now/CVE-2011-3246.md): CFNetwork in Apple iOS before 5.0.1 and Mac OS X 10.7 before 10.7.2 does not properly parse URLs, which allows remote attackers to trigger v (no CVSS)
- [CVE-2011-3253](https://cve.now/CVE-2011-3253.md): CalDAV in Apple iOS before 5 does not validate X.509 certificates for SSL sessions, which allows man-in-the-middle attackers to spoof calend (no CVSS)
- [CVE-2011-3254](https://cve.now/CVE-2011-3254.md): Cross-site scripting (XSS) vulnerability in Calendar in Apple iOS before 5 allows remote attackers to inject arbitrary web script or HTML vi (no CVSS)
- [CVE-2011-3255](https://cve.now/CVE-2011-3255.md): CFNetwork in Apple iOS before 5 stores AppleID credentials in an unspecified file, which makes it easier for remote attackers to obtain sens (no CVSS)
- [CVE-2011-3256](https://cve.now/CVE-2011-3256.md): FreeType 2 before 2.4.7, as used in CoreGraphics in Apple iOS before 5, Mandriva Enterprise Server 5, and possibly other products, allows re (no CVSS)
- [CVE-2011-3257](https://cve.now/CVE-2011-3257.md): The Data Access component in Apple iOS before 5 does not properly handle the existence of multiple user accounts on the same mail server, wh (no CVSS)
- [CVE-2011-3259](https://cve.now/CVE-2011-3259.md): The kernel in Apple iOS before 5 and Apple TV before 4.4 does not properly recover memory allocated for incomplete TCP connections, which al (no CVSS)
- [CVE-2011-3260](https://cve.now/CVE-2011-3260.md): Buffer overflow in OfficeImport in Apple iOS before 5 allows remote attackers to execute arbitrary code or cause a denial of service (applic (no CVSS)
- [CVE-2011-3261](https://cve.now/CVE-2011-3261.md): Double free vulnerability in OfficeImport in Apple iOS before 5 allows remote attackers to execute arbitrary code or cause a denial of servi (no CVSS)
- [CVE-2011-3426](https://cve.now/CVE-2011-3426.md): Cross-site scripting (XSS) vulnerability in Safari in Apple iOS before 5 allows remote web servers to inject arbitrary web script or HTML vi (no CVSS)
- [CVE-2011-3427](https://cve.now/CVE-2011-3427.md): The Data Security component in Apple iOS before 5 and Apple TV before 4.4 does not properly restrict use of the MD5 hash algorithm within X. (no CVSS)
- [CVE-2011-3429](https://cve.now/CVE-2011-3429.md): The Settings component in Apple iOS before 5 stores a cleartext parental-restrictions passcode in an unspecified file, which might allow phy (no CVSS)
- [CVE-2011-3430](https://cve.now/CVE-2011-3430.md): The Settings component in Apple iOS before 5, when a configuration profile is used for a locale other than English, does not properly implem (no CVSS)
- [CVE-2011-3431](https://cve.now/CVE-2011-3431.md): The Home screen component in Apple iOS before 5 does not properly support a certain application-switching gesture, which might allow physica (no CVSS)
- [CVE-2011-3432](https://cve.now/CVE-2011-3432.md): The UIKit Alerts component in Apple iOS before 5 allows remote attackers to cause a denial of service (device hang) via a long tel: URL that (no CVSS)
- [CVE-2011-3434](https://cve.now/CVE-2011-3434.md): The WiFi component in Apple iOS before 5 stores WiFi credentials in an unspecified file, which makes it easier for remote attackers to obtai (no CVSS)
- [CVE-2011-3435](https://cve.now/CVE-2011-3435.md): Open Directory in Apple Mac OS X 10.7 before 10.7.2 allows local users to read the password data of arbitrary users via unspecified vectors. (no CVSS)
- [CVE-2011-3436](https://cve.now/CVE-2011-3436.md): Open Directory in Apple Mac OS X 10.7 before 10.7.2 does not require a user to provide the current password before changing this password, w (no CVSS)
- [CVE-2011-3437](https://cve.now/CVE-2011-3437.md): Integer signedness error in Apple Type Services (ATS) in Apple Mac OS X 10.7 before 10.7.2 allows remote attackers to execute arbitrary code (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2011-10-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.