| |
ID ▼ |
Type ▼ |
Status ▼ |
Priority ▼ |
Milestone ▼ |
Owner ▼ |
Summary + Labels ▼ |
... |
|---|
|
|
15 |
----
|
Fixed
|
----
|
----
|
cevans@google.com
|
Lack of bounds checking in notifyd
CCProjectZeroMembers
|
|
|
|
23 |
----
|
Fixed
|
----
|
----
|
cevans@google.com
|
OS X kASLR defeat using sgdt
|
|
|
|
28 |
----
|
Fixed
|
----
|
----
|
cevans@google.com
|
OS X IOKit kernel code execution due to lack of bounds checking in GPU command buffers
|
|
|
|
29 |
----
|
Fixed
|
----
|
----
|
cevans@google.com
|
OS X IOKit kernel code execution due to off-by-one error in IGAccelGLContext::processSidebandToken
|
|
|
|
30 |
----
|
Fixed
|
----
|
----
|
cevans@google.com
|
OS X IOKit kernel multiple exploitable memory safety issues in token parsing in IGAccelVideoContextMedia (x5)
|
|
|
|
31 |
----
|
Fixed
|
----
|
----
|
cevans@google.com
|
OS X IOKit kernel code execution due to NULL pointer dereference in IOAccelContext2::clientMemoryForType
|
|
|
|
32 |
----
|
Fixed
|
----
|
----
|
cevans@google.com
|
OS X IOKit kernel code execution due to lack of bounds checking in IGAccelVideoContextMain::process_token_ColorSpaceConversion
|
|
|
|
33 |
----
|
Fixed
|
----
|
----
|
cevans@google.com
|
OS X IOKit kernel code execution due to lack of bounds checking in IOAccelDisplayPipeTransaction2::set_plane_gamma_table
|
|
|
|
34 |
----
|
Fixed
|
----
|
----
|
cevans@google.com
|
OS X IOKit kernel code execution due to multiple bounds checking issues in IGAccelGLContext token parsing (x3)
|
|
|
|
37 |
----
|
Fixed
|
----
|
----
|
cevans@google.com
|
OS X IOKit kernel code execution due to bad free in IOBluetoothFamily
|
|
|
|
39 |
----
|
Fixed
|
----
|
----
|
cevans@google.com
|
OS X IOKit kernel code execution due to integer overflow in IODataQueue::enqueue
|
|
|
|
42 |
----
|
Fixed
|
----
|
----
|
cevans@google.com
|
OS X IOKit kernel memory disclosure due to lack of bounds checking in IOHIKeyboardMapper::modifierSwapFilterKey
|
|