# CVEs published 2015-10-09

49 CVEs were published on October 9, 2015: 0 critical, 0 high. Days are UTC.

- [CVE-2015-1337](https://cve.now/CVE-2015-1337.md): Simple Streams (simplestreams) does not properly verify the GPG signatures of disk image files, which allows remote mirror servers to spoof (no CVSS)
- [CVE-2015-5234](https://cve.now/CVE-2015-5234.md): IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly sanitize applet URLs, which allows remote attackers to inject applets into (no CVSS)
- [CVE-2015-5235](https://cve.now/CVE-2015-5235.md): IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly determine the origin of unsigned applets, which allows remote attackers to (no CVSS)
- [CVE-2015-7765](https://cve.now/CVE-2015-7765.md): ZOHO ManageEngine OpManager 11.5 build 11600 and earlier uses a hardcoded password of "plugin" for the IntegrationUser account, which allows (no CVSS)
- [CVE-2015-7766](https://cve.now/CVE-2015-7766.md): PGSQL:SubmitQuery.do in ZOHO ManageEngine OpManager 11.6, 11.5, and earlier allows remote administrators to bypass SQL query restrictions vi (no CVSS)
- [CVE-2015-7767](https://cve.now/CVE-2015-7767.md): Buffer overflow in Konica Minolta FTP Utility 1.0 allows remote attackers to execute arbitrary code or cause a denial of service (applicatio (no CVSS)
- [CVE-2015-7768](https://cve.now/CVE-2015-7768.md): Buffer overflow in Konica Minolta FTP Utility 1.0 allows remote attackers to execute arbitrary code via a long CWD command. (no CVSS)
- [CVE-2015-3785](https://cve.now/CVE-2015-3785.md): The Telephony component in Apple OS X before 10.11, when the Continuity feature is enabled, allows local users to bypass intended telephone- (no CVSS)
- [CVE-2015-5780](https://cve.now/CVE-2015-5780.md): The Safari Extensions implementation in Apple Safari before 9 does not require user confirmation before replacing an installed extension, wh (no CVSS)
- [CVE-2015-5828](https://cve.now/CVE-2015-5828.md): The API in the WebKit Plug-ins component in Apple Safari before 9 does not provide notification of an HTTP Redirection (aka 3xx) status code (no CVSS)
- [CVE-2015-5830](https://cve.now/CVE-2015-5830.md): The Intel Graphics Driver component in Apple OS X before 10.11 allows local users to gain privileges or cause a denial of service (memory co (no CVSS)
- [CVE-2015-5833](https://cve.now/CVE-2015-5833.md): The Login Window component in Apple OS X before 10.11 does not ensure that the screen is locked at the intended time, which allows physicall (no CVSS)
- [CVE-2015-5836](https://cve.now/CVE-2015-5836.md): Apple Online Store Kit in Apple OS X before 10.11 improperly validates iCloud keychain item ACLs, which allows attackers to obtain access to (no CVSS)
- [CVE-2015-5849](https://cve.now/CVE-2015-5849.md): The filtering implementation in AppleEvents in Apple OS X before 10.11 mishandles attempts to send events to a different user, which allows (no CVSS)
- [CVE-2015-5853](https://cve.now/CVE-2015-5853.md): AirScan in Apple OS X before 10.11 allows man-in-the-middle attackers to obtain eSCL packet payload data via unspecified vectors. (no CVSS)
- [CVE-2015-5854](https://cve.now/CVE-2015-5854.md): The backup implementation in Time Machine in Apple OS X before 10.11 allows local users to obtain access to keychain items via unspecified v (no CVSS)
- [CVE-2015-5864](https://cve.now/CVE-2015-5864.md): IOAudioFamily in Apple OS X before 10.11 allows local users to obtain sensitive kernel memory-layout information via unspecified vectors. (no CVSS)
- [CVE-2015-5865](https://cve.now/CVE-2015-5865.md): IOGraphics in Apple OS X before 10.11 allows attackers to obtain sensitive kernel memory-layout information via a crafted app. (no CVSS)
- [CVE-2015-5866](https://cve.now/CVE-2015-5866.md): IOHIDFamily in Apple OS X before 10.11 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memo (no CVSS)
- [CVE-2015-5870](https://cve.now/CVE-2015-5870.md): The debugging interfaces in the kernel in Apple OS X before 10.11 allow local users to obtain sensitive memory-layout information via unspec (no CVSS)
- [CVE-2015-5871](https://cve.now/CVE-2015-5871.md): IOGraphics in Apple OS X before 10.11 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified (no CVSS)
- [CVE-2015-5872](https://cve.now/CVE-2015-5872.md): IOGraphics in Apple OS X before 10.11 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified (no CVSS)
- [CVE-2015-5873](https://cve.now/CVE-2015-5873.md): IOGraphics in Apple OS X before 10.11 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified (no CVSS)
- [CVE-2015-5875](https://cve.now/CVE-2015-5875.md): Cross-site scripting (XSS) vulnerability in Notes in Apple OS X before 10.11 allows local users to inject arbitrary web script or HTML via c (no CVSS)
- [CVE-2015-5877](https://cve.now/CVE-2015-5877.md): The Intel Graphics Driver component in Apple OS X before 10.11 allows local users to gain privileges or cause a denial of service (memory co (no CVSS)
- [CVE-2015-5878](https://cve.now/CVE-2015-5878.md): Notes in Apple OS X before 10.11 misparses links, which allows local users to obtain sensitive information via unspecified vectors. (no CVSS)
- [CVE-2015-5883](https://cve.now/CVE-2015-5883.md): The bidirectional text-display and text-selection implementations in Terminal in Apple OS X before 10.11 interpret directional override form (no CVSS)
- [CVE-2015-5884](https://cve.now/CVE-2015-5884.md): The Mail Drop feature in Mail in Apple OS X before 10.11 mishandles encryption parameters for attachments, which makes it easier for remote (no CVSS)
- [CVE-2015-5887](https://cve.now/CVE-2015-5887.md): The TLS Handshake Protocol implementation in Secure Transport in Apple OS X before 10.11 accepts a Certificate Request message within a sess (no CVSS)
- [CVE-2015-5888](https://cve.now/CVE-2015-5888.md): The Install Framework Legacy component in Apple OS X before 10.11 allows local users to obtain root privileges via vectors involving a privi (no CVSS)
- [CVE-2015-5889](https://cve.now/CVE-2015-5889.md): rsh in the remote\_cmds component in Apple OS X before 10.11 allows local users to obtain root privileges via vectors involving environment v (no CVSS)
- [CVE-2015-5890](https://cve.now/CVE-2015-5890.md): IOGraphics in Apple OS X before 10.11 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified (no CVSS)
- [CVE-2015-5891](https://cve.now/CVE-2015-5891.md): The SMB implementation in the kernel in Apple OS X before 10.11 allows local users to gain privileges or cause a denial of service (memory c (no CVSS)
- [CVE-2015-5893](https://cve.now/CVE-2015-5893.md): SMBClient in SMB in Apple OS X before 10.11 allows local users to obtain sensitive kernel memory-layout information via unspecified vectors. (no CVSS)
- [CVE-2015-5894](https://cve.now/CVE-2015-5894.md): The X.509 certificate-trust implementation in Apple OS X before 10.11 does not recognize that the kSecRevocationRequirePositiveResponse flag (no CVSS)
- [CVE-2015-5897](https://cve.now/CVE-2015-5897.md): The Address Book framework in Apple OS X before 10.11 allows local users to gain privileges by using an environment variable to inject code (no CVSS)
- [CVE-2015-5900](https://cve.now/CVE-2015-5900.md): The protected range register in the EFI component in Apple OS X before 10.11 has an incorrect value, which allows attackers to cause a denia (no CVSS)
- [CVE-2015-5901](https://cve.now/CVE-2015-5901.md): The Secure Empty Trash feature in Finder in Apple OS X before 10.11 improperly deletes Trash files, which might allow local users to obtain (no CVSS)
- [CVE-2015-5902](https://cve.now/CVE-2015-5902.md): The debugging feature in the kernel in Apple OS X before 10.11 mismanages state, which allows local users to cause a denial of service via u (no CVSS)
- [CVE-2015-5913](https://cve.now/CVE-2015-5913.md): Heimdal, as used in Apple OS X before 10.11, allows remote attackers to conduct replay attacks against the SMB server via packet data that r (no CVSS)
- [CVE-2015-5914](https://cve.now/CVE-2015-5914.md): The EFI component in Apple OS X before 10.11 allows physically proximate attackers to modify firmware during the EFI update process by inser (no CVSS)
- [CVE-2015-5915](https://cve.now/CVE-2015-5915.md): Apple OS X before 10.11 does not ensure that the keychain's lock state is displayed correctly, which has unspecified impact and attack vecto (no CVSS)
- [CVE-2015-5917](https://cve.now/CVE-2015-5917.md): The glob implementation in tnftpd (formerly lukemftpd), as used in Apple OS X before 10.11, allows remote attackers to cause a denial of ser (no CVSS)
- [CVE-2015-5918](https://cve.now/CVE-2015-5918.md): GasGauge in Apple watchOS before 2 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified ve (no CVSS)
- [CVE-2015-5919](https://cve.now/CVE-2015-5919.md): GasGauge in Apple watchOS before 2 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified ve (no CVSS)
- [CVE-2015-5922](https://cve.now/CVE-2015-5922.md): Unspecified vulnerability in International Components for Unicode (ICU) before 53.1.0, as used in Apple OS X before 10.11 and watchOS before (no CVSS)
- [CVE-2015-5923](https://cve.now/CVE-2015-5923.md): Apple iOS before 9.0.2 does not properly restrict the options available on the lock screen, which allows physically proximate attackers to r (no CVSS)
- [CVE-2015-7760](https://cve.now/CVE-2015-7760.md): libxpc in launchd in Apple OS X before 10.11 does not restrict the creation of processes for network connections, which allows remote attack (no CVSS)
- [CVE-2015-7761](https://cve.now/CVE-2015-7761.md): Mail in Apple OS X before 10.11 does not properly recognize user preferences, which allows attackers to obtain sensitive information via an (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-10-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.