The remote host is running a version of Mac OS X 10.8.5 or 10.9.5 that is missing Security Update 2015-005. It is, therefore, affected multiple vulnerabilities in the following components :

  - Admin Framework
  - afpserver
  - apache
  - AppleFSCompression
  - AppleGraphicsControl
  - AppleThunderboltEDMService
  - ATS
  - Bluetooth
  - Certificate Trust Policy
  - CFNetwork HTTPAuthentication
  - CoreText
  - coreTLS
  - DiskImages
  - Display Drivers
  - EFI
  - FontParser
  - Graphics Driver
  - ImageIO
  - Install Framework Legacy
  - Intel Graphics Driver
  - IOAcceleratorFamily
  - IOFireWireFamily
  - Kernel
  - kext tools
  - Mail
  - ntfs
  - ntp
  - OpenSSL
  - QuickTime
  - Security
  - Spotlight
  - SQLite
  - System Stats
  - TrueTypeScaler
  - zip

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

The remote host is running a version of Mac OS X 10.10.x that is prior to 10.10.4. It is, therefore, affected multiple vulnerabilities in the following components :

  - Admin Framework
  - afpserver
  - apache
  - AppleFSCompression
  - AppleGraphicsControl
  - AppleThunderboltEDMService
  - ATS
  - Bluetooth
  - Certificate Trust Policy
  - CFNetwork HTTPAuthentication
  - CoreText
  - coreTLS
  - DiskImages
  - Display Drivers
  - EFI
  - FontParser
  - Graphics Driver
  - ImageIO
  - Install Framework Legacy
  - Intel Graphics Driver
  - IOAcceleratorFamily
  - IOFireWireFamily
  - Kernel
  - kext tools
  - Mail
  - ntfs
  - ntp
  - OpenSSL
  - QuickTime
  - Security
  - Spotlight
  - SQLite
  - System Stats
  - TrueTypeScaler
  - zip

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

The version of Apple QuickTime installed on the remote Windows host is prior to 7.7.7. It is, therefore, affected by multiple vulnerabilities :

  - An arbitrary code execution vulnerability exists due to     improper validation of user-supplied input. An attacker     can exploit this, with specially crafted image data in     an SGI file, to execute arbitrary code. (CVE-2015-3661)

  - An arbitrary code execution vulnerability exists due to     an out-of-bounds write flaw caused by improper     validation of user-supplied input. An attacker can     exploit this, with specially crafted image data in     a GIF file, to execute arbitrary code. (CVE-2015-3662)

  - An arbitrary code execution vulnerability exists due to     an out-of-bounds write flaw caused by improper     validation of user-supplied input. An attacker can     exploit this, with a specially crafted image descriptor     in a GIF file, to execute arbitrary code.
    (CVE-2015-3663)

  - An overflow condition exists due to improper validation     of user-supplied input when handling 'alis' atoms. An     attacker can exploit this, with a specially crafted     file, to cause a stack-based buffer overflow, resulting     in a denial of service condition or the execution of     arbitrary code. (CVE-2015-3664)

  - A user-after-free error exists when handling object     properties in movie files. An attacker can exploit this,     with a specially crafted movie file, to dereference     already freed memory, potentially resulting in the     execution of arbitrary code. (CVE-2015-3665)

  - A memory corruption flaw exists due to improper     validation of user-supplied input when handling the     'code' atom within the 'minf' (Media Information) atom.
    An attacker can exploit this, with a specially crafted     file, to corrupt memory, potentially resulting in the     execution of arbitrary code. (CVE-2015-3666)

  - A user-after-free error exists in the     QuickTimeMPEG4!0x147f0() function when handling 'stbl'     atoms. An attacker can exploit this, with a specially     crafted .MOV file, to dereference already freed memory,     potentially resulting in the execution of arbitrary     code. (CVE-2015-3667)

  - A memory corruption flaw exists due to improper     validation of user-supplied input when handling movie     files. An attacker can exploit this, with a specially     crafted file, to corrupt memory, potentially resulting     in the execution of arbitrary code. (CVE-2015-3668)

  - An overflow condition exists due to improper validation     of user-supplied input. An attacker can exploit this,     with a specially crafted SGI file, to cause a heap-based     buffer overflow, potentially resulting in the execution     of arbitrary code. (CVE-2015-3669)

The remote host is running a version of Mac OS X 10.10.x that is prior to version 10.10.4 and the following components contain vulnerabilities :

  - Admin Framework 
-  afpserver 
 - apache 
 - AppleFSCompression 
 - AppleGraphicsControl 
 - AppleThunderboltEDMService 
 - ATS 
 - Bluetooth 
 - Certificate Trust Policy 
 - CFNetwork HTTPAuthentication 
 - CoreText 
 - coreTLS 
 - DiskImages 
 - Display Drivers 
 - EFI 
 - FontParser 
 - Graphics Driver 
 - ImageIO 
 - Install Framework Legacy 
 - Intel Graphics Driver 
 - IOAcceleratorFamily 
 - IOFireWireFamily 
 - Kernel 
 - kext tools 
 - Mail 
 - ntfs 
 - ntp 
 - OpenSSL 
 - QuickTime 
 - Security 
 - Spotlight 
 - SQLite 
 - System Stats 
 - TrueTypeScaler 
 - zip

Versions of QuickTime older than 7.7.7 are affected by the following vulnerabilities :

  - A flaw is triggered as user-supplied input is not properly validated when handling specially crafted image data in an SGI file allowing a context-dependent attacker to potentially execute arbitrary code. (CVE-2015-3661) 
 - An out-of-bounds write flaw is triggered as user-supplied input is not properly validated when handling specially crafted image data in a GIF file allowing a context-dependent attacker to potentially execute arbitrary code. (CVE-2015-3662, CVE-2015-3663) 
 - An overflow condition is triggered as user-supplied input is not properly validated when handling alis atoms. With a specially crafted file, a context-dependent attacker can cause a stack-based buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code. (CVE-2015-3664) 
 - A use-after-free error is triggered when handling object properties in a specially crafted movie file allowing a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2015-3665) 
 - A flaw is triggered as user-supplied input is not properly validated when handling the code atom within the Media Information (minf) atom allowing a context-dependent attacker to use a specially crafted file to corrupt memory and potentially execute arbitrary code. (CVE-2015-3666) 
 - A use-after-free error in the 'QuickTimeMPEG4!0x147f0()' function is triggered when an out-of-bounds read error occurs during the handling of stbl ataoms. With a specially crafted movie (.MOV) file, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code. (CVE-2015-3667) 
 - A flaw is triggered as user-supplied input is not properly validated when handling a specially crafted track fragment's 'size' field inside a moof atom allowing a context-dependent attacker to cause a heap-based buffer overflow and potentially execute arbitrary code. (CVE-2015-3668) 
 - An overflow condition is triggered as user-supplied input is not properly validated. With a specially crafted SGI file, a context-dependent attacker can cause a heap-based buffer overflow, potentially allowing the execution of arbitrary code. (CVE-2015-3669)

ID	Name	Product	Family	Published	Updated	Severity
84489	Mac OS X Multiple Vulnerabilities (Security Update 2015-005) (GHOST) (Logjam)	Nessus	MacOS X Local Security Checks	7/1/2015	5/28/2024	critical
84488	Mac OS X 10.10.x < 10.10.4 Multiple Vulnerabilities (GHOST) (Logjam)	Nessus	MacOS X Local Security Checks	7/1/2015	5/28/2024	critical
84505	Apple QuickTime < 7.7.7 Multiple Vulnerabilities (Windows)	Nessus	Windows	7/3/2015	11/22/2019	medium
8801	Mac OS X < 10.10.4 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	10/12/2015	3/6/2019	critical
9304	Apple QuickTime < 7.7.7 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	4/20/2016	3/6/2019	critical

Detections

Analytics

Plugins Search

critical

critical

medium

critical

critical