PT-2009-5166 · Apple · Macos X+2

Publicado 2009-09-14 · Atualizado 2017-08-17 · CVE-2009-2804

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apple Mac OS X versions 10.4.11 through 10.5.8 Safari versions prior to 4.0.4

Description The issue allows remote attackers to execute arbitrary code or cause a denial of service via a crafted ColorSync profile embedded in an image, leading to a heap-based buffer overflow. This occurs due to an integer overflow in ColorSync.

Recommendations For Apple Mac OS X versions 10.4.11 through 10.5.8, update to a version that includes the fix for the integer overflow in ColorSync. For Safari versions prior to 4.0.4, update to version 4.0.4 or later to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-189

Identificadores relacionados

CVE-2009-2804

Produtos afetados

Colorsync

Macos X

Safari

Referências · 11

• http://vupen.com/english/advisories/2009/3217 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/53166 · Nota
• http://support.apple.com/kb/HT3949 · Nota
• http://securityfocus.com/bid/36357 · Nota
• http://secunia.com/advisories/37346 · Aviso do Fabricante
• http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html · Aviso do Fabricante
• http://secunia.com/advisories/36701 · Aviso do Fabricante
• http://support.apple.com/kb/HT3865 · Aviso do Fabricante
• http://osvdb.org/57949 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-2804 · Nota de Segurança
• http://lists.apple.com/archives/security-announce/2009/Nov/msg00001.html · Aviso do Fabricante