PT-2009-5166 · Apple · Macos X+2

Published 2009-09-14 · Updated 2017-08-17 · CVE-2009-2804

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apple Mac OS X versions 10.4.11 through 10.5.8 Safari versions prior to 4.0.4

Description The issue allows remote attackers to execute arbitrary code or cause a denial of service via a crafted ColorSync profile embedded in an image, leading to a heap-based buffer overflow. This occurs due to an integer overflow in ColorSync.

Recommendations For Apple Mac OS X versions 10.4.11 through 10.5.8, update to a version that includes the fix for the integer overflow in ColorSync. For Safari versions prior to 4.0.4, update to version 4.0.4 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2009-2804

Affected Products

Colorsync

Macos X

Safari

References · 11

• http://vupen.com/english/advisories/2009/3217 · Vendor Advisory
• http://secunia.com/advisories/37346 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html · Vendor Advisory
• http://secunia.com/advisories/36701 · Vendor Advisory
• http://support.apple.com/kb/HT3865 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-2804 · Security Note
• http://lists.apple.com/archives/security-announce/2009/Nov/msg00001.html · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/53166 · Note
• http://support.apple.com/kb/HT3949 · Note
• http://securityfocus.com/bid/36357 · Note
• http://osvdb.org/57949 · Note