Apple Installer vulnerabilities

2 CVEs affecting Apple Installer, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2011-0190, published 2011-03-23.

More from Apple.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2007-0465, published 2007-01-31. High severity, CVSS 7.6. EPSS: 18.5% chance of exploitation in the next 30 days. Format string vulnerability in Apple Installer 2.1.5 on Mac OS X 10.4.8 allows user-assisted remote attackers to execute arbitrary code via format string specifiers in a (1) PKG, (2) DISTZ, or (3)…
• CVE-2011-0190, published 2011-03-23. Medium severity, CVSS 4.3. EPSS: 1.3% chance of exploitation in the next 30 days. Install Helper in Installer in Apple Mac OS X before 10.6.7 does not properly process an unspecified URL, which might allow remote attackers to track user logins by logging network traffic from an…