PT-2006-2967 · Apple · Imageio+2

Published 2006-04-21 · Updated 2017-07-20 · CVE-2006-1983

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Mac OS X versions prior to 10.4.6

Description The issue is related to multiple heap-based buffer overflows that can be triggered remotely, potentially leading to a denial of service or the execution of arbitrary code. This is possible through the PredictorVSetField function for TIFF or the CFAllocatorAllocate function for GIF, as used in applications that utilize ImageIO or AppKit.

Recommendations For Mac OS X versions prior to 10.4.6, update to a version later than 10.4.6 to resolve the issue. As a temporary workaround, consider restricting the use of ImageIO or AppKit in applications to minimize the risk of exploitation.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2006-1983

Affected Products

Appkit

Imageio

Macos X

References · 17

• 🔥 http://security-protocols.com/modules.php?name=News&file=article&sid=3233 · Exploit
• 🔥 http://securityfocus.com/bid/17634 · Exploit
• http://secunia.com/advisories/20077 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-1983 · Security Note
• http://vupen.com/english/advisories/2006/1779 · Vendor Advisory
• http://security-protocols.com/sp-x30-advisory.php · Vendor Advisory
• http://security-protocols.com/sp-x28-advisory.php · Vendor Advisory
• http://securitytracker.com/id?1016067 · Patch
• http://vupen.com/english/advisories/2006/1452 · Vendor Advisory
• http://secunia.com/advisories/19686 · Vendor Advisory
• http://us-cert.gov/cas/techalerts/TA06-132A.html · Patch
• http://securityfocus.com/bid/17951 · Note
• http://osvdb.org/24821 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25951 · Note
• http://lists.apple.com/archives/security-announce/2006/May/msg00003.html · Patch, Vendor Advisory