Apple Software Update vulnerabilities

2 CVEs affecting Apple Software Update, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2016-1731, published 2016-03-14.

More from Apple.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2007-0463, published 2007-01-29. Medium severity, CVSS 5.0. EPSS: 17.7% chance of exploitation in the next 30 days. Format string vulnerability in Apple Software Update 2.0.5 on Mac OS X 10.4.8 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via format string…
• CVE-2016-1731, published 2016-03-14. Medium severity, CVSS 5.9. EPSS: 0.9% chance of exploitation in the next 30 days. Apple Software Update before 2.2 on Windows does not use HTTPS, which makes it easier for man-in-the-middle attackers to spoof updates by modifying the client-server data stream.