CVE-2012-3718

LowCVSS 2.1/10Last modified Jun 16, 2026

Description

Apple Mac OS X before 10.7.5 and 10.8.x before 10.8.2 allows local users to read passwords entered into Login Window (aka LoginWindow) or Screen Saver Unlock by installing an input method that intercepts keystrokes.

Metrics

CVSS 2.0 2.1/10AV:L/AC:L/Au:N/C:P/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.htmlVendor Advisory
http://osvdb.org/85647
http://support.apple.com/kb/HT5501Vendor Advisory
http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.htmlVendor Advisory
http://osvdb.org/85647
http://support.apple.com/kb/HT5501Vendor Advisory

Timeline

Published: Sep 20, 2012
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-37196.8Mail in Apple Mac OS X before 10.7.5 does not properly handle embedded web plugins, which allows remote attackers to execute arbitrary plugi CVE-2012-37204.3Mobile Accounts in Apple Mac OS X before 10.7.5 and 10.8.x before 10.8.2 saves password hashes for external-account use even if external acc CVE-2012-37215.0Profile Manager in Apple Mac OS X before 10.7.5 does not properly perform authentication for the Device Management private interface, which CVE-2012-37226.8The Sorenson codec in QuickTime in Apple Mac OS X before 10.7.5, and in CoreMedia in iOS before 6, accesses uninitialized memory locations, CVE-2012-37234.6Apple Mac OS X before 10.7.5 does not properly handle the bNbrPorts field of a USB hub descriptor, which allows physically proximate attacke CVE-2012-37245.0CFNetwork in Apple iOS before 6 does not properly identify the host portion of a URL, which allows remote attackers to obtain sensitive info CVE-2012-37253.3The DNAv4 protocol implementation in the DHCP component in Apple iOS before 6 sends Wi-Fi packets containing a MAC address of a host on a pr CVE-2012-37266.8Double free vulnerability in ImageIO in Apple iOS before 6 allows remote attackers to execute arbitrary code or cause a denial of service (a CVE-2012-37276.8Buffer overflow in the IPsec component in Apple iOS before 6 allows remote attackers to execute arbitrary code via a crafted racoon configur CVE-2012-37286.9The kernel in Apple iOS before 6 dereferences invalid pointers during the handling of packet-filter data structures, which allows local user CVE-2012-37291.9The Berkeley Packet Filter (BPF) interpreter implementation in the kernel in Apple iOS before 6 accesses uninitialized memory locations, whi CVE-2012-37304.3Mail in Apple iOS before 6 does not properly handle reuse of Content-ID header values, which allows remote attackers to spoof attachments vi