# CVEs published 2015-12-11

72 CVEs were published on December 11, 2015: 0 critical, 0 high. Days are UTC.

- [CVE-2015-7001](https://cve.now/CVE-2015-7001.md): AppSandbox in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 mishandles hard links, which allows attacke (no CVSS)
- [CVE-2015-7037](https://cve.now/CVE-2015-7037.md): Directory traversal vulnerability in Mobile Backup in Photos in Apple iOS before 9.2 allows attackers to read arbitrary files via a crafted (no CVSS)
- [CVE-2015-7038](https://cve.now/CVE-2015-7038.md): Buffer overflow in libc in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows remote attackers to exe (no CVSS)
- [CVE-2015-7039](https://cve.now/CVE-2015-7039.md): Buffer overflow in libc in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows remote attackers to exe (no CVSS)
- [CVE-2015-7040](https://cve.now/CVE-2015-7040.md): The kernel in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows attackers to cause a denial of servi (no CVSS)
- [CVE-2015-7041](https://cve.now/CVE-2015-7041.md): The kernel in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows attackers to cause a denial of servi (no CVSS)
- [CVE-2015-7042](https://cve.now/CVE-2015-7042.md): The kernel in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows attackers to cause a denial of servi (no CVSS)
- [CVE-2015-7043](https://cve.now/CVE-2015-7043.md): The kernel in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows attackers to cause a denial of servi (no CVSS)
- [CVE-2015-7044](https://cve.now/CVE-2015-7044.md): The System Integrity Protection feature in Apple OS X before 10.11.2 mishandles union mounts, which allows attackers to execute arbitrary co (no CVSS)
- [CVE-2015-7045](https://cve.now/CVE-2015-7045.md): Keychain Access in Apple OS X before 10.11.2 and tvOS before 9.1 improperly interacts with Keychain Agent, which allows attackers to spoof t (no CVSS)
- [CVE-2015-7046](https://cve.now/CVE-2015-7046.md): The Sandbox feature in xnu in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 does not properly implement (no CVSS)
- [CVE-2015-7047](https://cve.now/CVE-2015-7047.md): The kernel in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows local users to gain privileges via a (no CVSS)
- [CVE-2015-7048](https://cve.now/CVE-2015-7048.md): WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial (no CVSS)
- [CVE-2015-7049](https://cve.now/CVE-2015-7049.md): otools in Apple Xcode before 7.2 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted mach-o (no CVSS)
- [CVE-2015-7050](https://cve.now/CVE-2015-7050.md): WebKit in Apple iOS before 9.2 and Safari before 9.0.2 misparses content extensions, which allows remote attackers to obtain sensitive brows (no CVSS)
- [CVE-2015-7051](https://cve.now/CVE-2015-7051.md): MobileStorageMounter in Apple iOS before 9.2 and tvOS before 9.1 mishandles the timing of trust-cache loading, which allows attackers to exe (no CVSS)
- [CVE-2015-7052](https://cve.now/CVE-2015-7052.md): kext tools in Apple OS X before 10.11.2 mishandles kernel-extension loading, which allows local users to gain privileges via unspecified vec (no CVSS)
- [CVE-2015-7053](https://cve.now/CVE-2015-7053.md): ImageIO in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows remote attackers to execute arbitrary c (no CVSS)
- [CVE-2015-7054](https://cve.now/CVE-2015-7054.md): zlib in the Compression component in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 does not initialize (no CVSS)
- [CVE-2015-7055](https://cve.now/CVE-2015-7055.md): AppleMobileFileIntegrity in Apple iOS before 9.2 and tvOS before 9.1 does not prevent changes to access-control structures, which allows att (no CVSS)
- [CVE-2015-7056](https://cve.now/CVE-2015-7056.md): IDE SCM in Apple Xcode before 7.2 does not recognize .gitignore files, which allows remote attackers to obtain sensitive information in oppo (no CVSS)
- [CVE-2015-7057](https://cve.now/CVE-2015-7057.md): otools in Apple Xcode before 7.2 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted mach-o (no CVSS)
- [CVE-2015-7058](https://cve.now/CVE-2015-7058.md): Apple iOS before 9.2, OS X before 10.11.2, and tvOS before 9.1 improperly validate keychain item ACLs, which allows attackers to obtain acce (no CVSS)
- [CVE-2015-7059](https://cve.now/CVE-2015-7059.md): The ASN.1 decoder in Apple OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows remote attackers to execute arbitrary code or (no CVSS)
- [CVE-2015-7060](https://cve.now/CVE-2015-7060.md): The ASN.1 decoder in Apple OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows remote attackers to execute arbitrary code or (no CVSS)
- [CVE-2015-7061](https://cve.now/CVE-2015-7061.md): The ASN.1 decoder in Apple OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows remote attackers to execute arbitrary code or (no CVSS)
- [CVE-2015-7062](https://cve.now/CVE-2015-7062.md): Apple OS X before 10.11.2 and tvOS before 9.1 allow local users to bypass intended configuration-profile installation restrictions via unspe (no CVSS)
- [CVE-2015-7063](https://cve.now/CVE-2015-7063.md): The kernel loader in EFI in Apple OS X before 10.11.2 allows local users to gain privileges via a crafted pathname. (no CVSS)
- [CVE-2015-7064](https://cve.now/CVE-2015-7064.md): OpenGL in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows remote attackers to execute arbitrary co (no CVSS)
- [CVE-2015-7065](https://cve.now/CVE-2015-7065.md): OpenGL in Apple iOS before 9.2, OS X before 10.11.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial (no CVSS)
- [CVE-2015-7066](https://cve.now/CVE-2015-7066.md): OpenGL in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows remote attackers to execute arbitrary co (no CVSS)
- [CVE-2015-7067](https://cve.now/CVE-2015-7067.md): IOThunderboltFamily in Apple OS X before 10.11.2 allows local users to cause a denial of service (NULL pointer dereference) via an unspecifi (no CVSS)
- [CVE-2015-7068](https://cve.now/CVE-2015-7068.md): IOKit SCSI in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows attackers to execute arbitrary code (no CVSS)
- [CVE-2015-7069](https://cve.now/CVE-2015-7069.md): Mobile Replayer in GPUTools Framework in Apple iOS before 9.2 allows attackers to execute arbitrary code in a privileged context via an app (no CVSS)
- [CVE-2015-7070](https://cve.now/CVE-2015-7070.md): Mobile Replayer in GPUTools Framework in Apple iOS before 9.2 allows attackers to execute arbitrary code in a privileged context via an app (no CVSS)
- [CVE-2015-7071](https://cve.now/CVE-2015-7071.md): The File Bookmark component in Apple OS X before 10.11.2 allows attackers to bypass a sandbox protection mechanism for app scoped bookmarks (no CVSS)
- [CVE-2015-7072](https://cve.now/CVE-2015-7072.md): dyld in Apple iOS before 9.2, tvOS before 9.1, and watchOS before 2.1 mishandles segment validation, which allows attackers to execute arbit (no CVSS)
- [CVE-2015-7073](https://cve.now/CVE-2015-7073.md): Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allow remote attackers to execute arbitrary code or cause (no CVSS)
- [CVE-2015-7074](https://cve.now/CVE-2015-7074.md): CoreMedia Playback in Apple iOS before 9.2, OS X before 10.11.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or ca (no CVSS)
- [CVE-2015-7075](https://cve.now/CVE-2015-7075.md): CoreMedia Playback in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows remote attackers to execute (no CVSS)
- [CVE-2015-7076](https://cve.now/CVE-2015-7076.md): The Intel Graphics Driver component in Apple OS X before 10.11.2 allows local users to gain privileges or cause a denial of service (NULL po (no CVSS)
- [CVE-2015-7077](https://cve.now/CVE-2015-7077.md): The Intel Graphics Driver component in Apple OS X before 10.11.2 allows local users to gain privileges or cause a denial of service (out-of- (no CVSS)
- [CVE-2015-7078](https://cve.now/CVE-2015-7078.md): Use-after-free vulnerability in Hypervisor in Apple OS X before 10.11.2 allows local users to gain privileges via vectors involving VM objec (no CVSS)
- [CVE-2015-7079](https://cve.now/CVE-2015-7079.md): dyld in Apple iOS before 9.2 and tvOS before 9.1 mishandles segment validation, which allows attackers to execute arbitrary code in a privil (no CVSS)
- [CVE-2015-7080](https://cve.now/CVE-2015-7080.md): Siri in Apple iOS before 9.2 allows physically proximate attackers to bypass an intended client-side protection mechanism and obtain sensiti (no CVSS)
- [CVE-2015-7081](https://cve.now/CVE-2015-7081.md): iBooks in Apple iOS before 9.2 and OS X before 10.11.2 allows remote attackers to read arbitrary files via an iBooks file containing an XML (no CVSS)
- [CVE-2015-7082](https://cve.now/CVE-2015-7082.md): Multiple unspecified vulnerabilities in Git before 2.5.4, as used in Apple Xcode before 7.2, have unknown impact and attack vectors. (no CVSS)
- [CVE-2015-7083](https://cve.now/CVE-2015-7083.md): The kernel in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows local users to gain privileges or ca (no CVSS)
- [CVE-2015-7084](https://cve.now/CVE-2015-7084.md): The kernel in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows local users to gain privileges or ca (no CVSS)
- [CVE-2015-7093](https://cve.now/CVE-2015-7093.md): Safari in Apple iOS before 9.2 allows remote attackers to spoof a URL in the user interface via a crafted web site. (no CVSS)
- [CVE-2015-7094](https://cve.now/CVE-2015-7094.md): CFNetwork HTTPProtocol in Apple iOS before 9.2 and OS X before 10.11.2 allows man-in-the-middle attackers to bypass the HSTS protection mech (no CVSS)
- [CVE-2015-7095](https://cve.now/CVE-2015-7095.md): WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial (no CVSS)
- [CVE-2015-7096](https://cve.now/CVE-2015-7096.md): WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial (no CVSS)
- [CVE-2015-7097](https://cve.now/CVE-2015-7097.md): WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial (no CVSS)
- [CVE-2015-7098](https://cve.now/CVE-2015-7098.md): WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial (no CVSS)
- [CVE-2015-7099](https://cve.now/CVE-2015-7099.md): WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial (no CVSS)
- [CVE-2015-7100](https://cve.now/CVE-2015-7100.md): WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial (no CVSS)
- [CVE-2015-7101](https://cve.now/CVE-2015-7101.md): WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial (no CVSS)
- [CVE-2015-7102](https://cve.now/CVE-2015-7102.md): WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial (no CVSS)
- [CVE-2015-7103](https://cve.now/CVE-2015-7103.md): WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial (no CVSS)
- [CVE-2015-7104](https://cve.now/CVE-2015-7104.md): WebKit in Apple Safari before 9.0.2 and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memo (no CVSS)
- [CVE-2015-7105](https://cve.now/CVE-2015-7105.md): CoreGraphics in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows remote attackers to execute arbitr (no CVSS)
- [CVE-2015-7106](https://cve.now/CVE-2015-7106.md): The Intel Graphics Driver component in Apple OS X before 10.11.2 allows local users to gain privileges or cause a denial of service (memory (no CVSS)
- [CVE-2015-7107](https://cve.now/CVE-2015-7107.md): QuickLook in Apple iOS before 9.2 and OS X before 10.11.2 allows remote attackers to execute arbitrary code or cause a denial of service (me (no CVSS)
- [CVE-2015-7108](https://cve.now/CVE-2015-7108.md): The Bluetooth HCI interface in Apple OS X before 10.11.2 allows local users to gain privileges or cause a denial of service (memory corrupti (no CVSS)
- [CVE-2015-7109](https://cve.now/CVE-2015-7109.md): IOAcceleratorFamily in Apple OS X before 10.11.2 and tvOS before 9.1 allows attackers to execute arbitrary code in a privileged context or c (no CVSS)
- [CVE-2015-7110](https://cve.now/CVE-2015-7110.md): The Disk Images component in Apple OS X before 10.11.2 and tvOS before 9.1 allows local users to gain privileges or cause a denial of servic (no CVSS)
- [CVE-2015-7111](https://cve.now/CVE-2015-7111.md): The IOHIDFamily API in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows attackers to execute arbitr (no CVSS)
- [CVE-2015-7112](https://cve.now/CVE-2015-7112.md): The IOHIDFamily API in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows attackers to execute arbitr (no CVSS)
- [CVE-2015-7113](https://cve.now/CVE-2015-7113.md): The LaunchServices component in Apple iOS before 9.2 and watchOS before 2.1 allows attackers to execute arbitrary code in a privileged conte (no CVSS)
- [CVE-2015-7803](https://cve.now/CVE-2015-7803.md): The phar\_get\_entry\_data function in ext/phar/util.c in PHP before 5.5.30 and 5.6.x before 5.6.14 allows remote attackers to cause a denial o (no CVSS)
- [CVE-2015-7804](https://cve.now/CVE-2015-7804.md): Off-by-one error in the phar\_parse\_zipfile function in ext/phar/zip.c in PHP before 5.5.30 and 5.6.x before 5.6.14 allows remote attackers t (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-12-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.