A memory corruption issue was addressed with improved input validation. This issue affected versions prior to macOS High Sierra 10.13.6, macOS Mojave 10.14.
Kernel. Multiple memory corruption issues were addressed with improved memory handling.
Kernel. Multiple memory corruption issues were addressed with improved memory handling.
Kernel. Multiple memory corruption issues were addressed with improved memory handling.
Kernel. Multiple memory corruption issues were addressed with improved memory handling.
Kernel. Multiple memory corruption issues were addressed with improved memory handling.
APFS. A memory corruption issue was addressed with improved memory handling.
ATS. A type confusion issue was addressed with improved memory handling.
An issue was discovered in certain Apple products. macOS before 10.13.5 is affected. The issue involves the "Hypervisor" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
IOHIDFamily. A memory corruption issue was addressed with improved memory handling.
IOGraphics. A memory corruption issue was addressed with improved memory handling.
Grand Central Dispatch. An issue existed in parsing entitlement plists. This issue was addressed with improved input validation.
Accessibility Framework. An information disclosure issue existed in Accessibility Framework. This issue was addressed with improved memory management.
AMD. An input validation issue existed in the kernel. This issue was addressed with improved input validation.
AppleGraphicsControl. A buffer overflow was addressed with improved bounds checking.
AppleGraphicsPowerManagement. A buffer overflow was addressed with improved size validation.
Kernel. A memory corruption issue was addressed with improved memory handling.
Kernel. A buffer overflow was addressed with improved bounds checking.
Kernel. A buffer overflow was addressed with improved bounds checking.
libxpc. A memory corruption issue was addressed with improved memory handling.
Windows Server. A memory corruption issue was addressed with improved memory handling.
Dir.open, Dir.new, Dir.entries and Dir.empty? accept the path of the target directory as their parameter. If the parameter contains NUL (\0) bytes, these methods recognize that the path is completed before the NUL bytes. So, if a script accepts an external input as the argument of these methods, the attacker can make the unintentional directory traversal.
Affected versions:
Ruby 2.2 series: 2.2.9 and earlier Ruby 2.3 series: 2.3.6 and earlier Ruby 2.4 series: 2.4.3 and earlier Ruby 2.5 series: 2.5.0 and earlier
External References:
https://www.ruby-lang.org/en/news/2018/03/28/poisoned-nul-byte-dir-cve-2018-8780/
APFS. An injection issue was addressed through improved input validation.
Disk Management. An injection issue was addressed through improved input validation.
Intel Graphics Driver. A memory corruption issue was addressed with improved memory handling.
IOFireWireFamily. A memory corruption issue was addressed with improved memory handling.
An issue was discovered in certain Apple products. iOS before 11.3 is affected. macOS before 10.13.4 is affected. tvOS before 11.3 is affected. watchOS before 4.3 is affected. The issue involves the "Kernel" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
Kernel. An out-of-bounds read was addressed through improved bounds checking.
An issue was discovered in certain Apple products. iOS before 11.3 is affected. macOS before 10.13.4 is affected. tvOS before 11.3 is affected. watchOS before 4.3 is affected. The issue involves the "Kernel" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
Kernel. An out-of-bounds read was addressed through improved bounds checking.