About the security content of OS X El Capitan v10.11 - Apple Support

Linked CVE reports

These are source relationships, not a claim that this article fixes every affected product or branch.

• CVE-2014-2532n/a: Incorrect Privilege Assignment
• CVE-2013-3951n/a: Improper Input Validation
• CVE-2014-9705n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2014-9709n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2014-9652n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2014-9427n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2014-9425n/a: security vulnerability
• CVE-2014-8611n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2014-8146n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2014-8147n/a: security vulnerability
• CVE-2014-8080n/a: security vulnerability
• CVE-2014-8090n/a: security vulnerability
• CVE-2014-7187n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2014-7186n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2014-6277n/a: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
• CVE-2014-3618n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2015-5876dyld in Dev Tools in Apple iOS before 9 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app
• CVE-2015-5893SMBClient in SMB in Apple OS X before 10.11 allows local users to obtain sensitive kernel memory-layout information via unspecified vectors
• CVE-2015-5889rsh in the remote_cmds component in Apple OS X before 10.11 allows local users to obtain root privileges via vectors involving environment variables
• CVE-2015-5912The CFNetwork FTPProtocol component in Apple iOS before 9 allows remote FTP proxy servers to trigger TCP connection attempts to intranet hosts via crafted responses
• CVE-2015-5899libpthread in the kernel in Apple iOS before 9 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors
• CVE-2015-5903n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2015-5862The Audio component in Apple iOS before 9 allows remote attackers to cause a denial of service (memory corruption and application crash) via a crafted audio file
• CVE-2015-5887n/a: security vulnerability
• CVE-2015-5917n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2015-5860n/a: Exposure of Sensitive Information to an Unauthorized Actor
• CVE-2015-5897The Address Book framework in Apple OS X before 10.11 allows local users to gain privileges by using an environment variable to inject code into processes that rely on this framework
• CVE-2015-5890n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2015-5900n/a: security vulnerability
• CVE-2015-5874CoreText in Apple iOS before 9 and iTunes before 12.3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file
• CVE-2015-5913Heimdal, as used in Apple OS X before 10.11, allows remote attackers to conduct replay attacks against the SMB server via packet data that represents a Kerberos authenticated request
• CVE-2015-5922Unspecified vulnerability in International Components for Unicode (ICU) before 53.1.0, as used in Apple OS X before 10.11 and watchOS before 2, has unknown impact and attack vectors
• CVE-2015-5894n/a: security vulnerability
• CVE-2015-5877n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2015-5885The CFNetwork Cookies component in Apple iOS before 9 allows remote attackers to track users via vectors involving a cookie for a top-level domain
• CVE-2015-5891The SMB implementation in the kernel in Apple OS X before 10.11 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors
• CVE-2015-5902The debugging feature in the kernel in Apple OS X before 10.11 mismanages state, which allows local users to cause a denial of service via unspecified vectors
• CVE-2015-5901n/a: Exposure of Sensitive Information to an Unauthorized Actor
• CVE-2015-5882n/a: Improper Access Control
• CVE-2015-5915Apple OS X before 10.11 does not ensure that the keychain's lock state is displayed correctly, which has unspecified impact and attack vectors
• CVE-2015-5879n/a: Improper Input Validation
• CVE-2015-5872n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2015-5896n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2015-5883n/a: Improper Input Validation
• CVE-2015-5873n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2015-5888The Install Framework Legacy component in Apple OS X before 10.11 allows local users to obtain root privileges via vectors involving a privileged executable file
• CVE-2015-5871n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2015-5914n/a: security vulnerability
• CVE-2015-5867IOHIDFamily in Apple iOS before 9 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app
• CVE-2015-5869n/a: Improper Input Validation

Source and provenance

Original title: About the security content of OS X El Capitan v10.11 - Apple Support. Captured 17 Oct 2026, 20:01 UTC. The stored article is used for enrichment and change detection; BlackTree does not republish the publisher's full text here.