About the security content of OS X El Capitan v10.11.5 and Security Update 2016-003 - Apple Support

Linked CVE reports

These are source relationships, not a claim that this article fixes every affected product or branch.

• CVE-2016-1834n/a: Heap-based Buffer Overflow
• CVE-2016-4070n/a: security vulnerability
• CVE-2015-8865n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-4650n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-4071n/a: Improper Input Validation
• CVE-2016-4072n/a: Improper Input Validation
• CVE-2016-4073n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-3142n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-3141n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-1842n/a: Improper Access Control
• CVE-2016-1814IOAcceleratorFamily in Apple iOS before 9.3.2, OS X before 10.11.5, and tvOS before 9.2.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted app
• CVE-2016-1831n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-1861n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-1841n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-1846n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-1862Intel Graphics Driver in Apple OS X before 10.11.5 allows attackers to obtain sensitive kernel memory-layout information via a crafted app, a different vulnerability than CVE-2016-1860
• CVE-2016-1844The Messages component in Apple OS X before 10.11.5 mishandles roster changes, which allows remote attackers to modify contact lists via unspecified vectors
• CVE-2016-1828n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-1818n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-1840n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-1838n/a: Out-of-bounds Read
• CVE-2016-1850SceneKit in Apple OS X before 10.11.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted file
• CVE-2016-1802n/a: Exposure of Sensitive Information to an Unauthorized Actor
• CVE-2016-1807n/a: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
• CVE-2016-1837n/a: Use After Free
• CVE-2016-1794n/a: security vulnerability
• CVE-2016-1829n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-1808n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-1832n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-1827n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-1826Integer overflow in the dtrace implementation in the kernel in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context via a crafted app
• CVE-2016-1801n/a: Exposure of Sensitive Information to an Unauthorized Actor
• CVE-2016-1798Audio in Apple OS X before 10.11.5 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted app
• CVE-2016-1848QuickTime in Apple OS X before 10.11.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted file
• CVE-2016-1803n/a: NULL Pointer Dereference
• CVE-2016-1839n/a: Out-of-bounds Read
• CVE-2016-1836n/a: Use After Free
• CVE-2016-1799Audio in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app
• CVE-2016-1817n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-1812Buffer overflow in Intel Graphics Driver in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context via a crafted app
• CVE-2016-1816IOAcceleratorFamily in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via a crafted app
• CVE-2016-1835n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-1825IOHIDFamily in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app
• CVE-2016-1805CoreStorage in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context via a crafted app
• CVE-2016-1820Buffer overflow in IOAudioFamily in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context via a crafted app
• CVE-2016-1851n/a: security vulnerability
• CVE-2016-1853Tcl in Apple OS X before 10.11.5 allows remote attackers to obtain sensitive information by leveraging SSLv2 support
• CVE-2016-1791The AMD subsystem in Apple OS X before 10.11.5 allows attackers to obtain sensitive kernel memory-layout information via a crafted app
• CVE-2016-1797n/a: Improper Access Control
• CVE-2016-1823n/a: Out-of-bounds Read

Source and provenance

Original title: About the security content of OS X El Capitan v10.11.5 and Security Update 2016-003 - Apple Support. Captured 17 Oct 2026, 14:11 UTC. The stored article is used for enrichment and change detection; BlackTree does not republish the publisher's full text here.