PT-2014-5867 · Apple · Os X

Published 2014-09-19 · Updated 2017-08-29 · CVE-2014-4403

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apple OS X versions prior to 10.9.5

Description The issue allows local users to obtain sensitive address information and bypass the Address Space Layout Randomization (ASLR) protection mechanism. This is achieved by leveraging the predictability of the location of the CPU Global Descriptor Table.

Recommendations For versions prior to 10.9.5, update to version 10.9.5 or later to resolve the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2014-4403

Affected Products

Os X

References · 5

• http://support.apple.com/kb/HT6443 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-4403 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/96064 · Note
• http://securityfocus.com/bid/69910 · Note
• http://securitytracker.com/id/1030868 · Note