# CVEs published 2014-10-18 25 CVEs were published on October 18, 2014: 0 critical, 0 high. Days are UTC. - [CVE-2014-4351](https://cve.now/CVE-2014-4351.md): Buffer overflow in QuickTime in Apple OS X before 10.10 allows remote attackers to execute arbitrary code or cause a denial of service (appl (no CVSS) - [CVE-2014-4391](https://cve.now/CVE-2014-4391.md): The Code Signing feature in Apple OS X before 10.10 does not properly handle incomplete resource envelopes in signed bundles, which allows r (no CVSS) - [CVE-2014-4417](https://cve.now/CVE-2014-4417.md): Safari in Apple OS X before 10.10 allows remote attackers to cause a denial of service (universal Push Notification outage) via a web site t (no CVSS) - [CVE-2014-4425](https://cve.now/CVE-2014-4425.md): CFPreferences in Apple OS X before 10.10 does not properly enforce the "require password after sleep or screen saver begins" setting, which (no CVSS) - [CVE-2014-4426](https://cve.now/CVE-2014-4426.md): AFP File Server in Apple OS X before 10.10 allows remote attackers to discover the network addresses of all interfaces via an unspecified co (no CVSS) - [CVE-2014-4427](https://cve.now/CVE-2014-4427.md): App Sandbox in Apple OS X before 10.10 allows attackers to bypass a sandbox protection mechanism via the accessibility API. (no CVSS) - [CVE-2014-4428](https://cve.now/CVE-2014-4428.md): Bluetooth in Apple OS X before 10.10 does not require encryption for HID Low Energy devices, which allows remote attackers to spoof a device (no CVSS) - [CVE-2014-4430](https://cve.now/CVE-2014-4430.md): CoreStorage in Apple OS X before 10.10 retains a volume's encryption keys upon an eject action in the unlocked state, which makes it easier (no CVSS) - [CVE-2014-4431](https://cve.now/CVE-2014-4431.md): Dock in Apple OS X before 10.10 does not properly manage the screen-lock state, which allows physically proximate attackers to view windows (no CVSS) - [CVE-2014-4432](https://cve.now/CVE-2014-4432.md): fdesetup in Apple OS X before 10.10 does not properly display the encryption status in between a setting-update action and a reboot action, (no CVSS) - [CVE-2014-4433](https://cve.now/CVE-2014-4433.md): Heap-based buffer overflow in the kernel in Apple OS X before 10.10 allows physically proximate attackers to execute arbitrary code via craf (no CVSS) - [CVE-2014-4434](https://cve.now/CVE-2014-4434.md): The kernel in Apple OS X before 10.10 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and syste (no CVSS) - [CVE-2014-4435](https://cve.now/CVE-2014-4435.md): The "iCloud Find My Mac" feature in Apple OS X before 10.10 does not properly enforce rate limiting of lost-mode PIN entry, which makes it e (no CVSS) - [CVE-2014-4436](https://cve.now/CVE-2014-4436.md): IOHIDFamily in Apple OS X before 10.10 allows attackers to cause denial of service (out-of-bounds read operation) via a crafted application. (no CVSS) - [CVE-2014-4437](https://cve.now/CVE-2014-4437.md): LaunchServices in Apple OS X before 10.10 allows attackers to bypass intended sandbox restrictions via an application that specifies a craft (no CVSS) - [CVE-2014-4438](https://cve.now/CVE-2014-4438.md): Race condition in LoginWindow in Apple OS X before 10.10 allows physically proximate attackers to obtain access by leveraging an unattended (no CVSS) - [CVE-2014-4439](https://cve.now/CVE-2014-4439.md): Mail in Apple OS X before 10.10 does not properly recognize the removal of a recipient address from a message, which makes it easier for rem (no CVSS) - [CVE-2014-4440](https://cve.now/CVE-2014-4440.md): The MCX Desktop Config Profiles implementation in Apple OS X before 10.10 retains web-proxy settings from uninstalled mobile-configuration p (no CVSS) - [CVE-2014-4441](https://cve.now/CVE-2014-4441.md): NetFS Client Framework in Apple OS X before 10.10 does not ensure that the disabling of File Sharing is always possible, which allows remote (no CVSS) - [CVE-2014-4442](https://cve.now/CVE-2014-4442.md): The kernel in Apple OS X before 10.10 allows local users to cause a denial of service (panic) via a message to a system control socket. (no CVSS) - [CVE-2014-4443](https://cve.now/CVE-2014-4443.md): Apple OS X before 10.10 allows remote attackers to cause a denial of service (NULL pointer dereference) via crafted ASN.1 data. (no CVSS) - [CVE-2014-4444](https://cve.now/CVE-2014-4444.md): SecurityAgent in Apple OS X before 10.10 does not ensure that a Kerberos ticket is in the cache for the correct user, which allows local use (no CVSS) - [CVE-2014-4446](https://cve.now/CVE-2014-4446.md): Mail Service in Apple OS X Server before 4.0 does not enforce SACL changes until after a service restart, which allows remote authenticated (no CVSS) - [CVE-2014-4447](https://cve.now/CVE-2014-4447.md): Profile Manager in Apple OS X Server before 4.0 allows local users to discover cleartext passwords by reading a file after a (1) profile set (no CVSS) - [CVE-2014-3573](https://cve.now/CVE-2014-3573.md): The oVirt Engine backend module, as used in Red Hat Enterprise Virtualization Manager before 3.4.2, uses an "insecure DocumentBuilderFactory (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2014-10-18 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.