Vulnerability-Lookup - Search a vulnerability

Search criteria

Vendor

Product

Assigner

Sources

Sort by

Order

CVE-2020-13095 (GCVE-0-2020-13095)

Vulnerability from cvelistv5 – Published: 2020-06-30 16:33 – Updated: 2024-08-04 12:11

Summary

Little Snitch version 4.5.1 and older changed ownership of a directory path controlled by the user. This allowed the user to escalate to root by linking the path to a directory containing code executed by root.

Severity ?

No CVSS data available.

CWE

CWE-59 - Improper Link Resolution Before File Access ('Link Following')

Assigner

obdev

References

URL

Tags

https://obdev.at/cve/2020-13095-t46oXJJOwz.html

x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	Little Snitch	Affected: up to 4.5.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T12:11:19.272Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://obdev.at/cve/2020-13095-t46oXJJOwz.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Little Snitch",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "up to 4.5.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Little Snitch version 4.5.1 and older changed ownership of a directory path controlled by the user. This allowed the user to escalate to root by linking the path to a directory containing code executed by root."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-06-30T16:33:54",
        "orgId": "e0cebea7-a708-4bfe-81c1-855d35eb4544",
        "shortName": "obdev"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://obdev.at/cve/2020-13095-t46oXJJOwz.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-13095",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Little Snitch",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "up to 4.5.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Little Snitch version 4.5.1 and older changed ownership of a directory path controlled by the user. This allowed the user to escalate to root by linking the path to a directory containing code executed by root."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://obdev.at/cve/2020-13095-t46oXJJOwz.html",
              "refsource": "MISC",
              "url": "https://obdev.at/cve/2020-13095-t46oXJJOwz.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e0cebea7-a708-4bfe-81c1-855d35eb4544",
    "assignerShortName": "obdev",
    "cveId": "CVE-2020-13095",
    "datePublished": "2020-06-30T16:33:54",
    "dateReserved": "2020-05-15T00:00:00",
    "dateUpdated": "2024-08-04T12:11:19.272Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2019-13013 (GCVE-0-2019-13013)

Vulnerability from cvelistv5 – Published: 2019-08-23 16:58 – Updated: 2024-08-04 23:41

Summary

Little Snitch versions 4.3.0 to 4.3.2 have a local privilege escalation vulnerability in their privileged helper tool. The privileged helper tool implements an XPC interface which is available to any process and allows directory listings and copying files as root.

Severity ?

No CVSS data available.

CWE

CWE-264 - Permissions, Privileges, and Access Controls

Assigner

obdev

References

URL

Tags

https://obdev.at/cve/2019-13013-OSv2mEFD3z.html

x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	Little Snitch	Affected: 4.3 - 4.3.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T23:41:10.198Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://obdev.at/cve/2019-13013-OSv2mEFD3z.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Little Snitch",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "4.3 - 4.3.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Little Snitch versions 4.3.0 to 4.3.2 have a local privilege escalation vulnerability in their privileged helper tool. The privileged helper tool implements an XPC interface which is available to any process and allows directory listings and copying files as root."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-264",
              "description": "CWE-264: Permissions, Privileges, and Access Controls",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-08-23T16:58:49",
        "orgId": "e0cebea7-a708-4bfe-81c1-855d35eb4544",
        "shortName": "obdev"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://obdev.at/cve/2019-13013-OSv2mEFD3z.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2019-13013",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Little Snitch",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "4.3 - 4.3.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Little Snitch versions 4.3.0 to 4.3.2 have a local privilege escalation vulnerability in their privileged helper tool. The privileged helper tool implements an XPC interface which is available to any process and allows directory listings and copying files as root."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-264: Permissions, Privileges, and Access Controls"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://obdev.at/cve/2019-13013-OSv2mEFD3z.html",
              "refsource": "MISC",
              "url": "https://obdev.at/cve/2019-13013-OSv2mEFD3z.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e0cebea7-a708-4bfe-81c1-855d35eb4544",
    "assignerShortName": "obdev",
    "cveId": "CVE-2019-13013",
    "datePublished": "2019-08-23T16:58:49",
    "dateReserved": "2019-06-28T00:00:00",
    "dateUpdated": "2024-08-04T23:41:10.198Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2019-13014 (GCVE-0-2019-13014)

Vulnerability from cvelistv5 – Published: 2019-08-23 16:55 – Updated: 2024-08-04 23:41

Summary

Little Snitch versions 4.4.0 fixes a vulnerability in a privileged helper tool. However, the operating system may have made a copy of the privileged helper which is not removed or updated immediately. Computers may therefore still be vulnerable after upgrading to 4.4.0. Version 4.4.1 fixes this issue by removing the operating system's copy during the upgrade.

Severity ?

No CVSS data available.

CWE

CWE-264 - Permissions, Privileges, and Access Controls

Assigner

obdev

References

URL

Tags

https://obdev.at/cve/2019-13014-MzE24Ify4p.html

x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	Little Snitch	Affected: 4.4.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T23:41:10.142Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://obdev.at/cve/2019-13014-MzE24Ify4p.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Little Snitch",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "4.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Little Snitch versions 4.4.0 fixes a vulnerability in a privileged helper tool. However, the operating system may have made a copy of the privileged helper which is not removed or updated immediately. Computers may therefore still be vulnerable after upgrading to 4.4.0. Version 4.4.1 fixes this issue by removing the operating system\u0027s copy during the upgrade."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-264",
              "description": "CWE-264: Permissions, Privileges, and Access Controls",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-08-23T16:55:55",
        "orgId": "e0cebea7-a708-4bfe-81c1-855d35eb4544",
        "shortName": "obdev"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://obdev.at/cve/2019-13014-MzE24Ify4p.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2019-13014",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Little Snitch",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "4.4.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Little Snitch versions 4.4.0 fixes a vulnerability in a privileged helper tool. However, the operating system may have made a copy of the privileged helper which is not removed or updated immediately. Computers may therefore still be vulnerable after upgrading to 4.4.0. Version 4.4.1 fixes this issue by removing the operating system\u0027s copy during the upgrade."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-264: Permissions, Privileges, and Access Controls"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://obdev.at/cve/2019-13014-MzE24Ify4p.html",
              "refsource": "MISC",
              "url": "https://obdev.at/cve/2019-13014-MzE24Ify4p.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e0cebea7-a708-4bfe-81c1-855d35eb4544",
    "assignerShortName": "obdev",
    "cveId": "CVE-2019-13014",
    "datePublished": "2019-08-23T16:55:55",
    "dateReserved": "2019-06-28T00:00:00",
    "dateUpdated": "2024-08-04T23:41:10.142Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-2678 (GCVE-0-2017-2678)

Vulnerability from cvelistv5 – Published: 2019-04-02 19:15 – Updated: 2019-04-03 17:05

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2017. Notes: none

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2019-04-03T17:05:05",
        "orgId": "e0cebea7-a708-4bfe-81c1-855d35eb4544",
        "shortName": "obdev"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2017. Notes: none"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e0cebea7-a708-4bfe-81c1-855d35eb4544",
    "assignerShortName": "obdev",
    "cveId": "CVE-2017-2678",
    "datePublished": "2019-04-02T19:15:15",
    "dateRejected": "2019-04-02T19:15:15",
    "dateReserved": "2016-12-01T00:00:00",
    "dateUpdated": "2019-04-03T17:05:05",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.0"
}

CVE-2017-2677 (GCVE-0-2017-2677)

Vulnerability from cvelistv5 – Published: 2019-04-02 19:15 – Updated: 2019-04-03 17:02

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2017. Notes: none

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2019-04-03T17:02:53",
        "orgId": "e0cebea7-a708-4bfe-81c1-855d35eb4544",
        "shortName": "obdev"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2017. Notes: none"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e0cebea7-a708-4bfe-81c1-855d35eb4544",
    "assignerShortName": "obdev",
    "cveId": "CVE-2017-2677",
    "datePublished": "2019-04-02T19:15:15",
    "dateRejected": "2019-04-02T19:15:15",
    "dateReserved": "2016-12-01T00:00:00",
    "dateUpdated": "2019-04-03T17:02:53",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.0"
}

CVE-2017-2679 (GCVE-0-2017-2679)

Vulnerability from cvelistv5 – Published: 2019-04-02 19:15 – Updated: 2019-04-03 17:07

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2017. Notes: none

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2019-04-03T17:07:06",
        "orgId": "e0cebea7-a708-4bfe-81c1-855d35eb4544",
        "shortName": "obdev"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2017. Notes: none"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e0cebea7-a708-4bfe-81c1-855d35eb4544",
    "assignerShortName": "obdev",
    "cveId": "CVE-2017-2679",
    "datePublished": "2019-04-02T19:15:15",
    "dateRejected": "2019-04-02T19:15:15",
    "dateReserved": "2016-12-01T00:00:00",
    "dateUpdated": "2019-04-03T17:07:06",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.0"
}

CVE-2017-2676 (GCVE-0-2017-2676)

Vulnerability from cvelistv5 – Published: 2019-04-02 19:15 – Updated: 2019-04-03 16:59

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2017. Notes: none

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2019-04-03T16:59:35",
        "orgId": "e0cebea7-a708-4bfe-81c1-855d35eb4544",
        "shortName": "obdev"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2017. Notes: none"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e0cebea7-a708-4bfe-81c1-855d35eb4544",
    "assignerShortName": "obdev",
    "cveId": "CVE-2017-2676",
    "datePublished": "2019-04-02T19:15:15",
    "dateRejected": "2019-04-02T19:15:15",
    "dateReserved": "2016-12-01T00:00:00",
    "dateUpdated": "2019-04-03T16:59:35",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.0"
}

CVE-2018-10470 (GCVE-0-2018-10470)

Vulnerability from cvelistv5 – Published: 2018-06-12 17:00 – Updated: 2024-09-16 21:03

Summary

Little Snitch versions 4.0 to 4.0.6 use the SecStaticCodeCheckValidityWithErrors() function without the kSecCSCheckAllArchitectures flag and therefore do not validate all architectures stored in a fat binary. An attacker can maliciously craft a fat binary containing multiple architectures that may cause a situation where Little Snitch treats the running process as having no code signature at all while erroneously indicating that the binary on disk does have a valid code signature. This could lead to users being confused about whether or not the code signature is valid.

Severity ?

No CVSS data available.

CWE

CWE-347 - Improper Verification of Cryptographic Signature

Assigner

obdev

References

URL

Tags

	https://obdev.at/cve/2018-10470-8FRWkW4oH8.html	x_refsource_CONFIRM
	https://www.okta.com/security-blog/2018/06/issues…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	Objective Development Software GmbH	Little Snitch	Affected: 4.0 - 4.0.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T07:39:07.545Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://obdev.at/cve/2018-10470-8FRWkW4oH8.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.okta.com/security-blog/2018/06/issues-around-third-party-apple-code-signing-checks/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Little Snitch",
          "vendor": "Objective Development Software GmbH",
          "versions": [
            {
              "status": "affected",
              "version": "4.0 - 4.0.6"
            }
          ]
        }
      ],
      "datePublic": "2018-06-12T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Little Snitch versions 4.0 to 4.0.6 use the SecStaticCodeCheckValidityWithErrors() function without the kSecCSCheckAllArchitectures flag and therefore do not validate all architectures stored in a fat binary. An attacker can maliciously craft a fat binary containing multiple architectures that may cause a situation where Little Snitch treats the running process as having no code signature at all while erroneously indicating that the binary on disk does have a valid code signature. This could lead to users being confused about whether or not the code signature is valid."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-347",
              "description": "CWE-347: Improper Verification of Cryptographic Signature",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-06-12T17:57:01",
        "orgId": "e0cebea7-a708-4bfe-81c1-855d35eb4544",
        "shortName": "obdev"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://obdev.at/cve/2018-10470-8FRWkW4oH8.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.okta.com/security-blog/2018/06/issues-around-third-party-apple-code-signing-checks/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "DATE_PUBLIC": "2018-06-12T00:00:00",
          "ID": "CVE-2018-10470",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Little Snitch",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "4.0 - 4.0.6"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Objective Development Software GmbH"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Little Snitch versions 4.0 to 4.0.6 use the SecStaticCodeCheckValidityWithErrors() function without the kSecCSCheckAllArchitectures flag and therefore do not validate all architectures stored in a fat binary. An attacker can maliciously craft a fat binary containing multiple architectures that may cause a situation where Little Snitch treats the running process as having no code signature at all while erroneously indicating that the binary on disk does have a valid code signature. This could lead to users being confused about whether or not the code signature is valid."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-347: Improper Verification of Cryptographic Signature"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://obdev.at/cve/2018-10470-8FRWkW4oH8.html",
              "refsource": "CONFIRM",
              "url": "https://obdev.at/cve/2018-10470-8FRWkW4oH8.html"
            },
            {
              "name": "https://www.okta.com/security-blog/2018/06/issues-around-third-party-apple-code-signing-checks/",
              "refsource": "MISC",
              "url": "https://www.okta.com/security-blog/2018/06/issues-around-third-party-apple-code-signing-checks/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e0cebea7-a708-4bfe-81c1-855d35eb4544",
    "assignerShortName": "obdev",
    "cveId": "CVE-2018-10470",
    "datePublished": "2018-06-12T17:00:00Z",
    "dateReserved": "2018-04-27T00:00:00",
    "dateUpdated": "2024-09-16T21:03:03.661Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2016-8665 (GCVE-0-2016-8665)

Vulnerability from cvelistv5 – Published: 2017-05-11 14:01 – Updated: 2017-05-11 13:57

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2017-05-11T13:57:01",
        "orgId": "e0cebea7-a708-4bfe-81c1-855d35eb4544",
        "shortName": "obdev"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e0cebea7-a708-4bfe-81c1-855d35eb4544",
    "assignerShortName": "obdev",
    "cveId": "CVE-2016-8665",
    "datePublished": "2017-05-11T14:01:00",
    "dateRejected": "2017-05-11T13:57:01",
    "dateReserved": "2016-10-14T00:00:00",
    "dateUpdated": "2017-05-11T13:57:01",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.0"
}

CVE-2016-8663 (GCVE-0-2016-8663)

Vulnerability from cvelistv5 – Published: 2017-05-11 14:01 – Updated: 2017-05-11 13:57

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2017-05-11T13:57:01",
        "orgId": "e0cebea7-a708-4bfe-81c1-855d35eb4544",
        "shortName": "obdev"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e0cebea7-a708-4bfe-81c1-855d35eb4544",
    "assignerShortName": "obdev",
    "cveId": "CVE-2016-8663",
    "datePublished": "2017-05-11T14:01:00",
    "dateRejected": "2017-05-11T13:57:01",
    "dateReserved": "2016-10-14T00:00:00",
    "dateUpdated": "2017-05-11T13:57:01",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.0"
}

CVE-2016-8662 (GCVE-0-2016-8662)

Vulnerability from cvelistv5 – Published: 2017-05-11 14:01 – Updated: 2017-05-11 13:57

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2017-05-11T13:57:01",
        "orgId": "e0cebea7-a708-4bfe-81c1-855d35eb4544",
        "shortName": "obdev"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e0cebea7-a708-4bfe-81c1-855d35eb4544",
    "assignerShortName": "obdev",
    "cveId": "CVE-2016-8662",
    "datePublished": "2017-05-11T14:01:00",
    "dateRejected": "2017-05-11T13:57:01",
    "dateReserved": "2016-10-14T00:00:00",
    "dateUpdated": "2017-05-11T13:57:01",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.0"
}

CVE-2016-8664 (GCVE-0-2016-8664)

Vulnerability from cvelistv5 – Published: 2017-05-11 14:01 – Updated: 2017-05-11 13:57

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2017-05-11T13:57:01",
        "orgId": "e0cebea7-a708-4bfe-81c1-855d35eb4544",
        "shortName": "obdev"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e0cebea7-a708-4bfe-81c1-855d35eb4544",
    "assignerShortName": "obdev",
    "cveId": "CVE-2016-8664",
    "datePublished": "2017-05-11T14:01:00",
    "dateRejected": "2017-05-11T13:57:01",
    "dateReserved": "2016-10-14T00:00:00",
    "dateUpdated": "2017-05-11T13:57:01",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.0"
}

CVE-2017-2675 (GCVE-0-2017-2675)

Vulnerability from cvelistv5 – Published: 2017-04-06 15:00 – Updated: 2024-08-05 14:02

Summary

Little Snitch version 3.0 through 3.7.3 suffer from a local privilege escalation vulnerability in the installer part. The vulnerability is related to the installation of the configuration file "at.obdev.littlesnitchd.plist" which gets installed to /Library/LaunchDaemons.

Severity ?

No CVSS data available.

CWE

unspecified

Assigner

obdev

References

URL

Tags

	https://www.obdev.at/products/littlesnitch/releas…	x_refsource_CONFIRM
	https://twitter.com/patrickwardle/status/84907661…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	Objective Development Software GmbH	Little Snitch	Affected: 3.0 - 3.7.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T14:02:07.317Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.obdev.at/products/littlesnitch/releasenotes.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://twitter.com/patrickwardle/status/849076615170711552"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Little Snitch",
          "vendor": "Objective Development Software GmbH",
          "versions": [
            {
              "status": "affected",
              "version": "3.0 - 3.7.3"
            }
          ]
        }
      ],
      "datePublic": "2017-04-03T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Little Snitch version 3.0 through 3.7.3 suffer from a local privilege escalation vulnerability in the installer part. The vulnerability is related to the installation of the configuration file \"at.obdev.littlesnitchd.plist\" which gets installed to /Library/LaunchDaemons."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "unspecified",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-04-11T19:57:01",
        "orgId": "e0cebea7-a708-4bfe-81c1-855d35eb4544",
        "shortName": "obdev"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.obdev.at/products/littlesnitch/releasenotes.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://twitter.com/patrickwardle/status/849076615170711552"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2017-2675",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Little Snitch",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "3.0 - 3.7.3"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Objective Development Software GmbH"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Little Snitch version 3.0 through 3.7.3 suffer from a local privilege escalation vulnerability in the installer part. The vulnerability is related to the installation of the configuration file \"at.obdev.littlesnitchd.plist\" which gets installed to /Library/LaunchDaemons."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "unspecified"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.obdev.at/products/littlesnitch/releasenotes.html",
              "refsource": "CONFIRM",
              "url": "https://www.obdev.at/products/littlesnitch/releasenotes.html"
            },
            {
              "name": "https://twitter.com/patrickwardle/status/849076615170711552",
              "refsource": "MISC",
              "url": "https://twitter.com/patrickwardle/status/849076615170711552"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e0cebea7-a708-4bfe-81c1-855d35eb4544",
    "assignerShortName": "obdev",
    "cveId": "CVE-2017-2675",
    "datePublished": "2017-04-06T15:00:00",
    "dateReserved": "2016-12-01T00:00:00",
    "dateUpdated": "2024-08-05T14:02:07.317Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2016-8661 (GCVE-0-2016-8661)

Vulnerability from cvelistv5 – Published: 2016-11-15 15:00 – Updated: 2024-08-06 02:27

Summary

Little Snitch version 3.0 through 3.6.1 suffer from a buffer overflow vulnerability that could be locally exploited which could lead to an escalation of privileges (EoP) and unauthorised ring0 access to the operating system. The buffer overflow is related to insufficient checking of parameters to the "OSMalloc" and "copyin" kernel API calls.

Severity ?

No CVSS data available.

CWE

escalation of privileges

Assigner

obdev

References

URL

Tags

	http://www.securityfocus.com/bid/94352	vdb-entryx_refsource_BID
	https://speakerdeck.com/patrickwardle/defcon-2016…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	Little Snitch version 3.0 through 3.6.1	Affected: Little Snitch version 3.0 through 3.6.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T02:27:41.325Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "94352",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/94352"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://speakerdeck.com/patrickwardle/defcon-2016-i-got-99-problems-but-little-snitch-aint-one"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Little Snitch version 3.0 through 3.6.1",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Little Snitch version 3.0 through 3.6.1"
            }
          ]
        }
      ],
      "datePublic": "2016-11-15T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Little Snitch version 3.0 through 3.6.1 suffer from a buffer overflow vulnerability that could be locally exploited which could lead to an escalation of privileges (EoP) and unauthorised ring0 access to the operating system. The buffer overflow is related to insufficient checking of parameters to the \"OSMalloc\" and \"copyin\" kernel API calls."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "escalation of privileges",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-11-25T19:57:01",
        "orgId": "e0cebea7-a708-4bfe-81c1-855d35eb4544",
        "shortName": "obdev"
      },
      "references": [
        {
          "name": "94352",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/94352"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://speakerdeck.com/patrickwardle/defcon-2016-i-got-99-problems-but-little-snitch-aint-one"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2016-8661",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Little Snitch version 3.0 through 3.6.1",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Little Snitch version 3.0 through 3.6.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Little Snitch version 3.0 through 3.6.1 suffer from a buffer overflow vulnerability that could be locally exploited which could lead to an escalation of privileges (EoP) and unauthorised ring0 access to the operating system. The buffer overflow is related to insufficient checking of parameters to the \"OSMalloc\" and \"copyin\" kernel API calls."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "escalation of privileges"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "94352",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/94352"
            },
            {
              "name": "https://speakerdeck.com/patrickwardle/defcon-2016-i-got-99-problems-but-little-snitch-aint-one",
              "refsource": "MISC",
              "url": "https://speakerdeck.com/patrickwardle/defcon-2016-i-got-99-problems-but-little-snitch-aint-one"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e0cebea7-a708-4bfe-81c1-855d35eb4544",
    "assignerShortName": "obdev",
    "cveId": "CVE-2016-8661",
    "datePublished": "2016-11-15T15:00:00",
    "dateReserved": "2016-10-14T00:00:00",
    "dateUpdated": "2024-08-06T02:27:41.325Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Search criteria

14 vulnerabilities

CVE-2020-13095 (GCVE-0-2020-13095)

CVE-2019-13013 (GCVE-0-2019-13013)

CVE-2019-13014 (GCVE-0-2019-13014)

CVE-2017-2678 (GCVE-0-2017-2678)

CVE-2017-2677 (GCVE-0-2017-2677)

CVE-2017-2679 (GCVE-0-2017-2679)

CVE-2017-2676 (GCVE-0-2017-2676)

CVE-2018-10470 (GCVE-0-2018-10470)

CVE-2016-8665 (GCVE-0-2016-8665)

CVE-2016-8663 (GCVE-0-2016-8663)

CVE-2016-8662 (GCVE-0-2016-8662)

CVE-2016-8664 (GCVE-0-2016-8664)

CVE-2017-2675 (GCVE-0-2017-2675)

CVE-2016-8661 (GCVE-0-2016-8661)