Apple Carboncore vulnerabilities

2 CVEs affecting Apple Carboncore, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2011-0178, published 2011-03-23.

More from Apple.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2008-2320, published 2008-08-04. High severity, CVSS 9.3. EPSS: 3.8% chance of exploitation in the next 30 days. Stack-based buffer overflow in CarbonCore in Apple Mac OS X 10.4.11 and 10.5.4, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows context-dependent attackers to…
• CVE-2011-0178, published 2011-03-23. Low severity, CVSS 2.1. EPSS: 0.3% chance of exploitation in the next 30 days. The FSFindFolder API in CarbonCore in Apple Mac OS X before 10.6.7 provides a world-readable directory in response to a call with the kTemporaryFolderType flag, which allows local users to obtain…