Vulnerabilities (CVE)

Filtered by vendor Apple Subscribe
Filtered by product Xcode
Total 49 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2015-3185 3 Apache, Apple, Canonical 5 Http Server, Mac Os X, Mac Os X Server and 2 more 2021-06-06 4.3 MEDIUM N/A
The ap_some_auth_required function in server/request.c in the Apache HTTP Server 2.4.x before 2.4.14 does not consider that a Require directive may be associated with an authorization setting rather than an authentication setting, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging the presence of a module that relies on the 2.2 API behavior.
CVE-2014-9390 6 Apple, Eclipse, Git-scm and 3 more 8 Mac Os X, Xcode, Egit and 5 more 2021-05-17 7.5 HIGH 9.8 CRITICAL
Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.
CVE-2021-21300 3 Apple, Fedoraproject, Git-scm 4 Macos, Xcode, Fedora and 1 more 2021-05-05 5.1 MEDIUM 7.5 HIGH
Git is an open-source distributed revision control system. In affected versions of Git a specially crafted repository that contains symbolic links as well as files using a clean/smudge filter such as Git LFS, may cause just-checked out script to be executed while cloning onto a case-insensitive file system such as NTFS, HFS+ or APFS (i.e. the default file systems on Windows and macOS). Note that clean/smudge filters have to be configured for that. Git for Windows configures Git LFS by default, and is therefore vulnerable. The problem has been patched in the versions published on Tuesday, March 9th, 2021. As a workaound, if symbolic link support is disabled in Git (e.g. via `git config --global core.symlinks false`), the described attack won't work. Likewise, if no clean/smudge filters such as Git LFS are configured globally (i.e. _before_ cloning), the attack is foiled. As always, it is best to avoid cloning repositories from untrusted sources. The earliest impacted version is 2.14.2. The fix versions are: 2.30.1, 2.29.3, 2.28.1, 2.27.1, 2.26.3, 2.25.5, 2.24.4, 2.23.4, 2.22.5, 2.21.4, 2.20.5, 2.19.6, 2.18.5, 2.17.62.17.6.
CVE-2021-1800 1 Apple 1 Xcode 2021-04-08 4.3 MEDIUM 5.5 MEDIUM
A path handling issue was addressed with improved validation. This issue is fixed in Xcode 12.4. A malicious application may be able to access arbitrary files on the host device while running an app that uses on-demand resources with Xcode.
CVE-2020-9992 1 Apple 3 Ipad Os, Iphone Os, Xcode 2020-11-15 9.3 HIGH 7.8 HIGH
This issue was addressed by encrypting communications over the network to devices running iOS 14, iPadOS 14, tvOS 14, and watchOS 7. This issue is fixed in iOS 14.0 and iPadOS 14.0, Xcode 12.0. An attacker in a privileged network position may be able to execute arbitrary code on a paired device during a debug session over the network.
CVE-2019-8840 1 Apple 1 Xcode 2020-11-02 6.5 MEDIUM 8.8 HIGH
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 11.3. Compiling with untrusted sources may lead to arbitrary code execution with user privileges.
CVE-2019-3855 8 Apple, Debian, Fedoraproject and 5 more 14 Xcode, Debian Linux, Fedora and 11 more 2020-10-15 9.3 HIGH 8.8 HIGH
An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.
CVE-2019-8739 1 Apple 1 Xcode 2019-12-30 6.8 MEDIUM 7.8 HIGH
A memory corruption issue was addressed with improved state management. This issue is fixed in Xcode 11.0. Processing a maliciously crafted file may lead to arbitrary code execution.
CVE-2019-8738 1 Apple 1 Xcode 2019-12-30 6.8 MEDIUM 7.8 HIGH
A memory corruption issue was addressed with improved state management. This issue is fixed in Xcode 11.0. Processing a maliciously crafted file may lead to arbitrary code execution.
CVE-2019-8800 1 Apple 1 Xcode 2019-12-30 6.8 MEDIUM 7.8 HIGH
A memory corruption issue was addressed with improved validation. This issue is fixed in Xcode 11.2. Processing a maliciously crafted file may lead to arbitrary code execution.
CVE-2019-8806 1 Apple 1 Xcode 2019-12-30 6.8 MEDIUM 7.8 HIGH
A memory corruption issue was addressed with improved validation. This issue is fixed in Xcode 11.2. Processing a maliciously crafted file may lead to arbitrary code execution.
CVE-2019-8721 1 Apple 1 Xcode 2019-12-23 9.3 HIGH 8.8 HIGH
Multiple issues in ld64 in the Xcode toolchains were addressed by updating to version ld64-507.4. This issue is fixed in Xcode 11.0. Compiling code without proper input validation could lead to arbitrary code execution with user privilege.
CVE-2019-8722 1 Apple 1 Xcode 2019-12-23 9.3 HIGH 8.8 HIGH
Multiple issues in ld64 in the Xcode toolchains were addressed by updating to version ld64-507.4. This issue is fixed in Xcode 11.0. Compiling code without proper input validation could lead to arbitrary code execution with user privilege.
CVE-2019-8723 1 Apple 1 Xcode 2019-12-22 9.3 HIGH 8.8 HIGH
Multiple issues in ld64 in the Xcode toolchains were addressed by updating to version ld64-507.4. This issue is fixed in Xcode 11.0. Compiling code without proper input validation could lead to arbitrary code execution with user privilege.
CVE-2019-8724 1 Apple 1 Xcode 2019-12-22 9.3 HIGH 8.8 HIGH
Multiple issues in ld64 in the Xcode toolchains were addressed by updating to version ld64-507.4. This issue is fixed in Xcode 11.0. Compiling code without proper input validation could lead to arbitrary code execution with user privilege.
CVE-2018-4357 1 Apple 1 Xcode 2019-04-05 9.3 HIGH 7.8 HIGH
A memory corruption issue was addressed with improved input validation. This issue affected versions prior to Xcode 10.
CVE-2014-3522 4 Apache, Apple, Canonical and 1 more 4 Subversion, Xcode, Ubuntu Linux and 1 more 2018-10-30 4.0 MEDIUM N/A
The Serf RA layer in Apache Subversion 1.4.0 through 1.7.x before 1.7.18 and 1.8.x before 1.8.10 does not properly handle wildcards in the Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.
CVE-2015-0248 5 Apache, Apple, Opensuse and 2 more 9 Subversion, Xcode, Opensuse and 6 more 2018-10-30 5.0 MEDIUM N/A
The (1) mod_dav_svn and (2) svnserve servers in Subversion 1.6.0 through 1.7.19 and 1.8.0 through 1.8.11 allow remote attackers to cause a denial of service (assertion failure and abort) via crafted parameter combinations related to dynamically evaluated revision numbers.
CVE-2015-0251 5 Apache, Apple, Opensuse and 2 more 9 Subversion, Xcode, Opensuse and 6 more 2018-10-30 4.0 MEDIUM N/A
The mod_dav_svn server in Subversion 1.5.0 through 1.7.19 and 1.8.0 through 1.8.11 allows remote authenticated users to spoof the svn:author property via a crafted v1 HTTP protocol request sequences.
CVE-2014-3528 5 Apache, Apple, Canonical and 2 more 9 Subversion, Xcode, Ubuntu Linux and 6 more 2018-10-30 4.0 MEDIUM N/A
Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of the URL and authentication realm to store cached credentials, which makes it easier for remote servers to obtain the credentials via a crafted authentication realm.