# CVEs published 2015-04-10

79 CVEs were published on April 10, 2015: 0 critical, 1 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2015-2247](https://cve.now/CVE-2015-2247.md): Unspecified vulnerability in Boosted Boards skateboards allows physically proximate attackers to modify skateboard movement, cause human inj (no CVSS)
- [CVE-2013-7436](https://cve.now/CVE-2013-7436.md): noVNC before 0.5 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this c (no CVSS)
- [CVE-2015-1085](https://cve.now/CVE-2015-1085.md): AppleKeyStore in Apple iOS before 8.3 does not properly restrict a certain passcode-confirmation interface, which makes it easier for attack (no CVSS)
- [CVE-2015-1086](https://cve.now/CVE-2015-1086.md): The Audio Drivers subsystem in Apple iOS before 8.3 and Apple TV before 7.2 does not properly validate IOKit object metadata, which allows a (no CVSS)
- [CVE-2015-1087](https://cve.now/CVE-2015-1087.md): Directory traversal vulnerability in Backup in Apple iOS before 8.3 allows attackers to read arbitrary files via a crafted relative path. (no CVSS)
- [CVE-2015-1088](https://cve.now/CVE-2015-1088.md): CFURL in Apple iOS before 8.3 and Apple OS X before 10.10.3 does not properly validate URLs, which allows remote attackers to execute arbitr (no CVSS)
- [CVE-2015-1089](https://cve.now/CVE-2015-1089.md): CFNetwork in Apple iOS before 8.3 and Apple OS X before 10.10.3 does not properly handle cookies during processing of redirects in HTTP resp (no CVSS)
- [CVE-2015-1090](https://cve.now/CVE-2015-1090.md): CFNetwork in Apple iOS before 8.3 does not delete HTTP Strict Transport Security (HSTS) state information in response to a Safari history-cl (no CVSS)
- [CVE-2015-1091](https://cve.now/CVE-2015-1091.md): The CFNetwork Session component in Apple iOS before 8.3 and Apple OS X before 10.10.3 does not properly handle request headers during proces (no CVSS)
- [CVE-2015-1092](https://cve.now/CVE-2015-1092.md): NSXMLParser in Foundation in Apple iOS before 8.3 and Apple TV before 7.2 allows remote attackers to read arbitrary files via an external en (no CVSS)
- [CVE-2015-1093](https://cve.now/CVE-2015-1093.md): FontParser in Apple iOS before 8.3 and Apple OS X before 10.10.3 allows remote attackers to execute arbitrary code or cause a denial of serv (no CVSS)
- [CVE-2015-1094](https://cve.now/CVE-2015-1094.md): IOAcceleratorFamily in Apple iOS before 8.3 and Apple TV before 7.2 allows attackers to obtain sensitive information about kernel memory via (no CVSS)
- [CVE-2015-1095](https://cve.now/CVE-2015-1095.md): IOHIDFamily in Apple iOS before 8.3, Apple OS X before 10.10.3, and Apple TV before 7.2 allows physically proximate attackers to execute arb (no CVSS)
- [CVE-2015-1096](https://cve.now/CVE-2015-1096.md): IOHIDFamily in Apple iOS before 8.3, Apple OS X before 10.10.3, and Apple TV before 7.2 allows attackers to obtain sensitive information abo (no CVSS)
- [CVE-2015-1097](https://cve.now/CVE-2015-1097.md): IOMobileFramebuffer in Apple iOS before 8.3 and Apple TV before 7.2 allows attackers to obtain sensitive information about kernel memory via (no CVSS)
- [CVE-2015-1098](https://cve.now/CVE-2015-1098.md): iWork in Apple iOS before 8.3 and Apple OS X before 10.10.3 allows remote attackers to execute arbitrary code or cause a denial of service ( (no CVSS)
- [CVE-2015-1099](https://cve.now/CVE-2015-1099.md): Race condition in the setreuid system-call implementation in the kernel in Apple iOS before 8.3, Apple OS X before 10.10.3, and Apple TV bef (no CVSS)
- [CVE-2015-1100](https://cve.now/CVE-2015-1100.md): The kernel in Apple iOS before 8.3, Apple OS X before 10.10.3, and Apple TV before 7.2 allows attackers to cause a denial of service (out-of (no CVSS)
- [CVE-2015-1101](https://cve.now/CVE-2015-1101.md): The kernel in Apple iOS before 8.3, Apple OS X before 10.10.3, and Apple TV before 7.2 allows attackers to execute arbitrary code in a privi (no CVSS)
- [CVE-2015-1102](https://cve.now/CVE-2015-1102.md): The kernel in Apple iOS before 8.3, Apple OS X before 10.10.3, and Apple TV before 7.2 does not properly handle TCP headers, which allows ma (no CVSS)
- [CVE-2015-1103](https://cve.now/CVE-2015-1103.md): The kernel in Apple iOS before 8.3, Apple OS X before 10.10.3, and Apple TV before 7.2 makes routing changes in response to ICMP\_REDIRECT me (no CVSS)
- [CVE-2015-1104](https://cve.now/CVE-2015-1104.md): The kernel in Apple iOS before 8.3, Apple OS X before 10.10.3, and Apple TV before 7.2 does not properly determine whether an IPv6 packet ha (no CVSS)
- [CVE-2015-1105](https://cve.now/CVE-2015-1105.md): The TCP implementation in the kernel in Apple iOS before 8.3, Apple OS X before 10.10.3, and Apple TV before 7.2 does not properly implement (no CVSS)
- [CVE-2015-1106](https://cve.now/CVE-2015-1106.md): The QuickType feature in the Keyboards subsystem in Apple iOS before 8.3 allows physically proximate attackers to discover passcodes by read (no CVSS)
- [CVE-2015-1107](https://cve.now/CVE-2015-1107.md): The Lock Screen component in Apple iOS before 8.3 does not properly implement the erasure feature for incorrect passcode-authentication atte (no CVSS)
- [CVE-2015-1108](https://cve.now/CVE-2015-1108.md): The Lock Screen component in Apple iOS before 8.3 does not properly enforce the limit on incorrect passcode-authentication attempts, which m (no CVSS)
- [CVE-2015-1109](https://cve.now/CVE-2015-1109.md): NetworkExtension in Apple iOS before 8.3 stores credentials in VPN configuration logs, which makes it easier for physically proximate attack (no CVSS)
- [CVE-2015-1110](https://cve.now/CVE-2015-1110.md): The Podcasts component in Apple iOS before 8.3 and Apple TV before 7.2 allows remote attackers to discover unique identifiers by reading ass (no CVSS)
- [CVE-2015-1111](https://cve.now/CVE-2015-1111.md): Safari in Apple iOS before 8.3 does not delete Recently Closed Tabs data in response to a history-clearing action, which allows attackers to (no CVSS)
- [CVE-2015-1112](https://cve.now/CVE-2015-1112.md): Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, as used on iOS before 8.3 and other platforms, does not properly delete b (no CVSS)
- [CVE-2015-1113](https://cve.now/CVE-2015-1113.md): The Sandbox Profiles component in Apple iOS before 8.3 allows attackers to read the (1) telephone number or (2) e-mail address of a recent c (no CVSS)
- [CVE-2015-1114](https://cve.now/CVE-2015-1114.md): The Sandbox Profiles component in Apple iOS before 8.3 and Apple TV before 7.2 allows attackers to discover hardware identifiers via a craft (no CVSS)
- [CVE-2015-1115](https://cve.now/CVE-2015-1115.md): The Telephony component in Apple iOS before 8.3 allows attackers to bypass a sandbox protection mechanism and access unintended telephone ca (no CVSS)
- [CVE-2015-1116](https://cve.now/CVE-2015-1116.md): The UIKit View component in Apple iOS before 8.3 displays unblurred application snapshots in the Task Switcher, which makes it easier for ph (no CVSS)
- [CVE-2015-1117](https://cve.now/CVE-2015-1117.md): The (1) setreuid and (2) setregid system-call implementations in the kernel in Apple iOS before 8.3, Apple OS X before 10.10.3, and Apple TV (no CVSS)
- [CVE-2015-1118](https://cve.now/CVE-2015-1118.md): libnetcore in Apple iOS before 8.3, Apple OS X before 10.10.3, and Apple TV before 7.2 allows attackers to cause a denial of service (memory (no CVSS)
- [CVE-2015-1119](https://cve.now/CVE-2015-1119.md): WebKit, as used in Apple iOS before 8.3, Apple TV before 7.2, and Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, allows (no CVSS)
- [CVE-2015-1120](https://cve.now/CVE-2015-1120.md): WebKit, as used in Apple iOS before 8.3, Apple TV before 7.2, and Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, allows (no CVSS)
- [CVE-2015-1121](https://cve.now/CVE-2015-1121.md): WebKit, as used in Apple iOS before 8.3, Apple TV before 7.2, and Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, allows (no CVSS)
- [CVE-2015-1122](https://cve.now/CVE-2015-1122.md): WebKit, as used in Apple iOS before 8.3, Apple TV before 7.2, and Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, allows (no CVSS)
- [CVE-2015-1123](https://cve.now/CVE-2015-1123.md): WebKit, as used in Apple iOS before 8.3 and Apple TV before 7.2, allows remote attackers to execute arbitrary code or cause a denial of serv (no CVSS)
- [CVE-2015-1124](https://cve.now/CVE-2015-1124.md): WebKit, as used in Apple iOS before 8.3, Apple TV before 7.2, and Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, allows (no CVSS)
- [CVE-2015-1125](https://cve.now/CVE-2015-1125.md): The touch-events implementation in WebKit in Apple iOS before 8.3 allows remote attackers to trigger an association between a tap and an uni (no CVSS)
- [CVE-2015-1126](https://cve.now/CVE-2015-1126.md): WebKit, as used in Apple iOS before 8.3 and Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, does not properly handle the (no CVSS)
- [CVE-2015-1127](https://cve.now/CVE-2015-1127.md): The private-browsing implementation in WebKit in Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5 places browsing history i (no CVSS)
- [CVE-2015-1128](https://cve.now/CVE-2015-1128.md): The private-browsing implementation in Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5 allows attackers to obtain sensitiv (no CVSS)
- [CVE-2015-1129](https://cve.now/CVE-2015-1129.md): Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5 does not properly select X.509 client certificates, which makes it easier (no CVSS)
- [CVE-2015-1130](https://cve.now/CVE-2015-1130.md): The XPC implementation in Admin Framework in Apple OS X before 10.10.3 allows local users to bypass authentication and obtain admin privileg (CVSS 7.8, KEV)
- [CVE-2015-1131](https://cve.now/CVE-2015-1131.md): fontd in Apple Type Services (ATS) in Apple OS X before 10.10.3 allows local users to gain privileges via unspecified vectors, a different v (no CVSS)
- [CVE-2015-1132](https://cve.now/CVE-2015-1132.md): fontd in Apple Type Services (ATS) in Apple OS X before 10.10.3 allows local users to gain privileges via unspecified vectors, a different v (no CVSS)
- [CVE-2015-1133](https://cve.now/CVE-2015-1133.md): fontd in Apple Type Services (ATS) in Apple OS X before 10.10.3 allows local users to gain privileges via unspecified vectors, a different v (no CVSS)
- [CVE-2015-1134](https://cve.now/CVE-2015-1134.md): fontd in Apple Type Services (ATS) in Apple OS X before 10.10.3 allows local users to gain privileges via unspecified vectors, a different v (no CVSS)
- [CVE-2015-1135](https://cve.now/CVE-2015-1135.md): fontd in Apple Type Services (ATS) in Apple OS X before 10.10.3 allows local users to gain privileges via unspecified vectors, a different v (no CVSS)
- [CVE-2015-1136](https://cve.now/CVE-2015-1136.md): Use-after-free vulnerability in CoreAnimation in Apple OS X before 10.10.3 allows remote attackers to execute arbitrary code by leveraging i (no CVSS)
- [CVE-2015-1137](https://cve.now/CVE-2015-1137.md): The NVIDIA graphics driver in Apple OS X before 10.10.3 allows local users to gain privileges or cause a denial of service (NULL pointer der (no CVSS)
- [CVE-2015-1138](https://cve.now/CVE-2015-1138.md): Hypervisor in Apple OS X before 10.10.3 allows local users to cause a denial of service via unspecified vectors. (no CVSS)
- [CVE-2015-1139](https://cve.now/CVE-2015-1139.md): ImageIO in Apple OS X before 10.10.3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via (no CVSS)
- [CVE-2015-1140](https://cve.now/CVE-2015-1140.md): Buffer overflow in IOHIDFamily in Apple OS X before 10.10.3 allows local users to gain privileges via unspecified vectors. (no CVSS)
- [CVE-2015-1141](https://cve.now/CVE-2015-1141.md): The mach\_vm\_read functionality in the kernel in Apple OS X before 10.10.3 allows local users to cause a denial of service (system crash) via (no CVSS)
- [CVE-2015-1142](https://cve.now/CVE-2015-1142.md): LaunchServices in Apple OS X before 10.10.3 allows local users to cause a denial of service (Finder crash) via crafted localization data. (no CVSS)
- [CVE-2015-1143](https://cve.now/CVE-2015-1143.md): LaunchServices in Apple OS X before 10.10.3 allows local users to gain privileges via a crafted localized string, related to a "type confusi (no CVSS)
- [CVE-2015-1144](https://cve.now/CVE-2015-1144.md): Buffer overflow in the UniformTypeIdentifiers component in Apple OS X before 10.10.3 allows local users to gain privileges via a crafted Uni (no CVSS)
- [CVE-2015-1145](https://cve.now/CVE-2015-1145.md): The Code Signing implementation in Apple OS X before 10.10.3 does not properly validate signatures, which allows local users to bypass inten (no CVSS)
- [CVE-2015-1146](https://cve.now/CVE-2015-1146.md): The Code Signing implementation in Apple OS X before 10.10.3 does not properly validate signatures, which allows local users to bypass inten (no CVSS)
- [CVE-2015-1147](https://cve.now/CVE-2015-1147.md): Open Directory Client in Apple OS X before 10.10.3 sends unencrypted password-change requests in certain circumstances involving missing cer (no CVSS)
- [CVE-2015-1148](https://cve.now/CVE-2015-1148.md): Screen Sharing in Apple OS X before 10.10.3 stores the password of a user in a log file, which might allow context-dependent attackers to ob (no CVSS)
- [CVE-2015-1149](https://cve.now/CVE-2015-1149.md): Integer overflow in the simulator in Swift in Apple Xcode before 6.3 allows context-dependent attackers to cause a denial of service or poss (no CVSS)
- [CVE-2015-1415](https://cve.now/CVE-2015-1415.md): The bsdinstall installer in FreeBSD 10.x before 10.1 p9, when configuring full disk encrypted ZFS, uses world-readable permissions for the G (no CVSS)
- [CVE-2015-1842](https://cve.now/CVE-2015-1842.md): The puppet manifests in the Red Hat openstack-puppet-modules package before 2014.2.13-2 uses a default password of CHANGEME for the pcsd dae (no CVSS)
- [CVE-2015-2295](https://cve.now/CVE-2015-2295.md): Cross-site request forgery (CSRF) vulnerability in system\_firmware\_restorefullbackup.php in the WebGUI in pfSense before 2.2.1 allows remote (no CVSS)
- [CVE-2015-2778](https://cve.now/CVE-2015-2778.md): Quassel before 0.12-rc1 uses an incorrect data-type size when splitting a message, which allows remote attackers to cause a denial of servic (no CVSS)
- [CVE-2015-2779](https://cve.now/CVE-2015-2779.md): Stack consumption vulnerability in the message splitting functionality in Quassel before 0.12-rc1 allows remote attackers to cause a denial (no CVSS)
- [CVE-2015-2806](https://cve.now/CVE-2015-2806.md): Stack-based buffer overflow in asn1\_der\_decoding in libtasn1 before 4.4 allows remote attackers to have unspecified impact via unknown vecto (no CVSS)
- [CVE-2015-3002](https://cve.now/CVE-2015-3002.md): Juniper Junos 12.1X44 before 12.1X44-D45, 12.1X46 before 12.1X46-D30, 12.1X47 before 12.1X47-D15, and 12.3X48 before 12.3X48-D10 on SRX seri (no CVSS)
- [CVE-2015-3003](https://cve.now/CVE-2015-3003.md): Juniper Junos 12.1X44 before 12.1X44-D45, 12.1X46 before 12.1X46-D30, 12.1X47 before 12.1X47-D20, 12.3 before 12.3R9, 12.3X48 before 12.3X48 (no CVSS)
- [CVE-2015-3004](https://cve.now/CVE-2015-3004.md): J-Web in Juniper Junos 11.4 before 11.4R12, 12.1X44 before 12.1X44-D35, 12.1X46 before 12.1X46-D25, 12.1X47 before 12.1X47-D10, 12.3X48 befo (no CVSS)
- [CVE-2015-3005](https://cve.now/CVE-2015-3005.md): Cross-site scripting (XSS) vulnerability in the Dynamic VPN in Juniper Junos 12.1X44 before 12.1X44-D45, 12.1X46 before 12.1X46-D30, 12.1X47 (no CVSS)
- [CVE-2015-3008](https://cve.now/CVE-2015-3008.md): Asterisk Open Source 1.8 before 1.8.32.3, 11.x before 11.17.1, 12.x before 12.8.2, and 13.x before 13.3.2 and Certified Asterisk 1.8.28 befo (no CVSS)
- [CVE-2015-3027](https://cve.now/CVE-2015-3027.md): Clang in LLVM, as used in Apple Xcode before 6.3, performs incorrect register allocation in a way that triggers stack storage for stack cook (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-04-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.