About the security content of macOS High Sierra 10.13 - Apple Support

Linked CVE reports

These are source relationships, not a claim that this article fixes every affected product or branch.

• CVE-2017-9050libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c
• CVE-2017-9049libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c
• CVE-2017-7376Buffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an incorrect limit for port values when handling redirects
• CVE-2016-9840inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic
• CVE-2016-9841inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic
• CVE-2017-9233Affected product: Improper Restriction of XML External Entity Reference
• CVE-2016-9063An integer overflow during the parsing of XML using the Expat library
• CVE-2016-9842The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers
• CVE-2017-5130n/a Google Chrome prior to 62.0.3202.62: Integer Overflow or Wraparound
• CVE-2016-9042An exploitable denial of service vulnerability exists in the origin timestamp check functionality of ntpd 4.2.8p9
• CVE-2016-2161In Apache HTTP Server versions 2.4.0 to 2.4.23, malicious input to mod_auth_digest can cause the server to crash, and each instance continues to crash even for subsequently valid requests
• CVE-2016-0736This made it vulnerable to padding oracle attacks, particularly with CBC
• CVE-2016-8743Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers
• CVE-2016-9843The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation
• CVE-2016-8740Apache Software Foundation Apache HTTP Server: Improper Input Validation
• CVE-2016-5387n/a: security vulnerability
• CVE-2016-4736libarchive in Apple OS X before 10.12 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted file
• CVE-2017-1000373The OpenBSD qsort() function is recursive, and not randomized, an attacker can construct a pathological input array of N elements that causes qsort() to deterministically recurse N/4 times
• CVE-2017-13908A local attacker may be able to execute non-executable text files via an SMB share
• CVE-2017-13838It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app
• CVE-2017-13906A memory corruption issue was addressed with improved memory handling
• CVE-2017-13890It allows remote attackers to trigger disk-image mounting via a crafted web site
• CVE-2017-13909A local attacker may gain access to iCloud authentication tokens
• CVE-2017-13851It allows local users to bypass intended access restrictions on home folder files
• CVE-2017-13910An access issue was addressed with additional sandbox restrictions on applications
• CVE-2017-13839It allows local users to see results for other users' files
• CVE-2017-13829It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app
• CVE-2017-13823It allows attackers to bypass intended memory-read restrictions via a crafted app
• CVE-2017-13846Versions before 8.40 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact
• CVE-2017-13854It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app
• CVE-2017-13833It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app
• CVE-2017-13822It allows attackers to bypass intended memory-read restrictions via a crafted app
• CVE-2017-13815Versions before 5.31 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact
• CVE-2017-13824It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted AppleScript file that is mishandled by osadecompile
• CVE-2017-13827It allows attackers to execute arbitrary code in a privileged context via a crafted app that performs kext loading
• CVE-2017-13821It allows attackers to bypass intended memory-read restrictions via a crafted app
• CVE-2017-13830It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app
• CVE-2017-13814It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted image file
• CVE-2017-13808It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app
• CVE-2017-13831It allows remote attackers to obtain sensitive information or cause a denial of service via a crafted image
• CVE-2017-13825It allows remote attackers to execute arbitrary code or cause a denial of service (memory consumption) via a crafted font file
• CVE-2017-13843It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app
• CVE-2017-13835A memory corruption issue was addressed with improved memory handling
• CVE-2017-13818It allows attackers to bypass intended memory-read restrictions via a crafted app
• CVE-2017-13816It allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a crafted archive file
• CVE-2017-13873It allows attackers to obtain sensitive network-activity information about arbitrary apps via a crafted app
• CVE-2017-13820It allows remote attackers to obtain sensitive information from process memory or cause a denial of service (memory corruption) via a crafted font
• CVE-2017-13840It allows attackers to bypass intended memory-read restrictions via a crafted app
• CVE-2017-13836It allows attackers to bypass intended memory-read restrictions via a crafted app
• CVE-2017-13813It allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a crafted archive file

Source and provenance

Original title: About the security content of macOS High Sierra 10.13 - Apple Support. Captured 17 Oct 2026, 02:04 UTC. The stored article is used for enrichment and change detection; BlackTree does not republish the publisher's full text here.