About the security content of OS X El Capitan v10.11.4 and Security Update 2016-002 - Apple Support

Linked CVE reports

These are source relationships, not a claim that this article fixes every affected product or branch.

• CVE-2015-8126Affected product: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
• CVE-2016-0777n/a: Exposure of Sensitive Information to an Unauthorized Actor
• CVE-2016-0778n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-1762The xmlNextChar function in libxml2 before 2.9.4 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document
• CVE-2015-0973n/a: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
• CVE-2014-9495n/a: Heap-based Buffer Overflow
• CVE-2015-8659The idle stream handling in nghttp2 before 1.6.0 allows attackers to have unspecified impact via unknown vectors, aka a heap-use-after-free bug
• CVE-2015-8472n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2015-8242n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2015-8035n/a: security vulnerability
• CVE-2015-7942n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2015-7551n/a: Improper Input Validation
• CVE-2015-7500n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2015-7499n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2015-5334LibreSSL — Out-of-bounds Write
• CVE-2015-5312n/a: security vulnerability
• CVE-2015-5333LibreSSL — Uncontrolled Resource Consumption
• CVE-2015-3195n/a: Exposure of Sensitive Information to an Unauthorized Actor
• CVE-2015-1819The xmlreader in libxml allows remote attackers to cause a denial of service (memory consumption) via crafted XML data, related to an XML Entity Expansion (XEE) attack
• CVE-2016-1950n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-1788n/a: security vulnerability
• CVE-2016-1756n/a: security vulnerability
• CVE-2016-1746n/a: Improper Input Validation
• CVE-2016-1749IOUSBFamily in Apple OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app
• CVE-2016-1761n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-1767n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-1754n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-1745IOFireWireFamily in Apple OS X before 10.11.4 allows local users to cause a denial of service (NULL pointer dereference) via unspecified vectors
• CVE-2016-1768n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-1741n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-1747n/a: Improper Input Validation
• CVE-2016-1775n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-1770The Reminders component in Apple OS X before 10.11.4 allows attackers to bypass an intended user-confirmation requirement and trigger a dialing action via a tel: URL
• CVE-2016-1764The Content Security Policy (CSP) implementation in Messages in Apple OS X before 10.11.4 allows remote attackers to obtain sensitive information via a javascript: URL
• CVE-2016-1752The kernel in Apple iOS before 9.3, OS X before 10.11.4, tvOS before 9.2, and watchOS before 2.2 allows attackers to cause a denial of service via a crafted app
• CVE-2016-1753n/a: Integer Overflow or Wraparound
• CVE-2016-1757Race condition in the kernel in Apple iOS before 9.3 and OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context via a crafted app
• CVE-2016-1758The kernel in Apple iOS before 9.3 and OS X before 10.11.4 allows attackers to obtain sensitive memory-layout information or cause a denial of service (out-of-bounds read) via a crafted app
• CVE-2016-1769QuickTime in Apple OS X before 10.11.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Photoshop file
• CVE-2016-1750n/a: Use After Free
• CVE-2016-1773n/a: security vulnerability
• CVE-2016-1744n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-1759The kernel in Apple OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app
• CVE-2016-1748IOHIDFamily in Apple iOS before 9.3, OS X before 10.11.4, tvOS before 9.2, and watchOS before 2.2 allows attackers to obtain sensitive kernel memory-layout information via a crafted app
• CVE-2016-1743n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-1755n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-1736n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-1740n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-1734n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-1733AppleRAID in Apple OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app

Source and provenance

Original title: About the security content of OS X El Capitan v10.11.4 and Security Update 2016-002 - Apple Support. Captured 17 Oct 2026, 14:11 UTC. The stored article is used for enrichment and change detection; BlackTree does not republish the publisher's full text here.