About the security content of macOS Sierra 10.12.4, Security Update 2017-001 El Capitan, and Security Update 2017-001 Yosemite - Apple Support

Linked CVE reports

These are source relationships, not a claim that this article fixes every affected product or branch.

• CVE-2016-10012n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-9535n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-10009n/a: Untrusted Search Path
• CVE-2016-10010n/a: Improper Privilege Management
• CVE-2016-10011n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-9586curl before version 7.52.0 is vulnerable to a buffer overflow when doing a large floating point output in libcurl's implementation of the printf() functions
• CVE-2016-2161In Apache HTTP Server versions 2.4.0 to 2.4.23, malicious input to mod_auth_digest can cause the server to crash, and each instance continues to crash even for subsequently valid requests
• CVE-2016-0736This made it vulnerable to padding oracle attacks, particularly with CBC
• CVE-2016-8743Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers
• CVE-2016-10160n/a: Off-by-one Error
• CVE-2016-10161n/a: Out-of-bounds Read
• CVE-2016-10158n/a: security vulnerability
• CVE-2016-10159n/a: Integer Overflow or Wraparound
• CVE-2016-9935n/a: Out-of-bounds Read
• CVE-2016-9533tif_pixarlog.c in libtiff 4.0.6 has out-of-bounds write vulnerabilities in heap allocated buffers
• CVE-2016-9536tools/tiff2pdf.c in libtiff 4.0.6 has out-of-bounds write vulnerabilities in heap allocated buffers in t2p_process_jpeg_strip()
• CVE-2016-9537tools/tiffcrop.c in libtiff 4.0.6 has out-of-bounds write vulnerabilities in buffers
• CVE-2016-9539tools/tiffcrop.c in libtiff 4.0.6 has an out-of-bounds read in readContigTilesIntoBuffer()
• CVE-2016-9538tools/tiffcrop.c in libtiff 4.0.6 reads an undefined buffer in readContigStripsIntoBuffer() because of a uint16 integer overflow
• CVE-2016-9540Reported as MSVR 35103, aka "cpStripToTile heap-buffer-overflow."
• CVE-2016-8740Apache Software Foundation Apache HTTP Server: Improper Input Validation
• CVE-2016-8574The FRF.15 parser in tcpdump before 4.9.0 has a buffer overflow in print-fr.c:frf15_print()
• CVE-2016-8575The Q.933 parser in tcpdump before 4.9.0 has a buffer overflow in print-fr.c:q933_print(), a different vulnerability than CVE-2017-5482
• CVE-2016-7974The IP parser in tcpdump before 4.9.0 has a buffer overflow in print-ip.c, multiple functions
• CVE-2016-7975The TCP parser in tcpdump before 4.9.0 has a buffer overflow in print-tcp.c:tcp_print()
• CVE-2016-7992The Classical IP over ATM parser in tcpdump before 4.9.0 has a buffer overflow in print-cip.c:cip_if_print()
• CVE-2016-7973The AppleTalk parser in tcpdump before 4.9.0 has a buffer overflow in print-atalk.c, multiple functions
• CVE-2016-7986The GeoNetworking parser in tcpdump before 4.9.0 has a buffer overflow in print-geonet.c, multiple functions
• CVE-2016-7993A bug in util-print.c:relts_print() in tcpdump before 4.9.0 could cause a buffer overflow in multiple protocol parsers (DNS, DVMRP, HSRP, IGMP, lightweight resolver protocol, PIM)
• CVE-2016-7984The TFTP parser in tcpdump before 4.9.0 has a buffer overflow in print-tftp.c:tftp_print()
• CVE-2016-7985The CALM FAST parser in tcpdump before 4.9.0 has a buffer overflow in print-calm-fast.c:calm_fast_print()
• CVE-2016-7983The BOOTP parser in tcpdump before 4.9.0 has a buffer overflow in print-bootp.c:bootp_print()
• CVE-2016-7926The Ethernet parser in tcpdump before 4.9.0 has a buffer overflow in print-ether.c:ethertype_print()
• CVE-2016-7939The GRE parser in tcpdump before 4.9.0 has a buffer overflow in print-gre.c, multiple functions
• CVE-2016-7940The STP parser in tcpdump before 4.9.0 has a buffer overflow in print-stp.c, multiple functions
• CVE-2016-7937The VAT parser in tcpdump before 4.9.0 has a buffer overflow in print-udp.c:vat_print()
• CVE-2016-7931The MPLS parser in tcpdump before 4.9.0 has a buffer overflow in print-mpls.c:mpls_print()
• CVE-2016-7938The ZeroMQ parser in tcpdump before 4.9.0 has an integer overflow in print-zeromq.c:zmtp1_print_frame()
• CVE-2016-7927The IEEE 802.11 parser in tcpdump before 4.9.0 has a buffer overflow in print-802_11.c:ieee802_11_radio_print()
• CVE-2016-7922The AH parser in tcpdump before 4.9.0 has a buffer overflow in print-ah.c:ah_print()
• CVE-2016-7935The RTP parser in tcpdump before 4.9.0 has a buffer overflow in print-udp.c:rtp_print()
• CVE-2016-7933The PPP parser in tcpdump before 4.9.0 has a buffer overflow in print-ppp.c:ppp_hdlc_if_print()
• CVE-2016-7936The UDP parser in tcpdump before 4.9.0 has a buffer overflow in print-udp.c:udp_print()
• CVE-2016-7930The LLC/SNAP parser in tcpdump before 4.9.0 has a buffer overflow in print-llc.c:llc_print()
• CVE-2016-7929The Juniper PPPoE ATM parser in tcpdump before 4.9.0 has a buffer overflow in print-juniper.c:juniper_parse_header()
• CVE-2016-7932The PIM parser in tcpdump before 4.9.0 has a buffer overflow in print-pim.c:pimv2_check_checksum()
• CVE-2016-7925The compressed SLIP parser in tcpdump before 4.9.0 has a buffer overflow in print-sl.c:sl_if_print()
• CVE-2016-7928The IPComp parser in tcpdump before 4.9.0 has a buffer overflow in print-ipcomp.c:ipcomp_print()
• CVE-2016-7924The ATM parser in tcpdump before 4.9.0 has a buffer overflow in print-atm.c:oam_print()
• CVE-2016-7934The RTCP parser in tcpdump before 4.9.0 has a buffer overflow in print-udp.c:rtcp_print()

Source and provenance

Original title: About the security content of macOS Sierra 10.12.4, Security Update 2017-001 El Capitan, and Security Update 2017-001 Yosemite - Apple Support. Captured 17 Oct 2026, 08:14 UTC. The stored article is used for enrichment and change detection; BlackTree does not republish the publisher's full text here.