PT-2015-1879 · Apple · Os X+1

Xiaoyong Wu · Published 2015-08-16 · Updated 2017-09-21 · CVE-2015-3762

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apple OS X versions prior to 10.10.5

Description The issue is related to an XML External Entity (XXE) problem in the Text Formats component, which can be exploited by remote attackers to read arbitrary files. This can be achieved through a text file containing an XML external entity declaration in conjunction with an entity reference. The vulnerability is associated with a lack of protection for service data, allowing a remote attacker to exploit it and read arbitrary files using a text file with XML references to external entities.

Recommendations For Apple OS X versions prior to 10.10.5, update to version 10.10.5 or later to resolve the issue. As a temporary workaround, consider restricting the use of the Text Formats component in TextEdit until the update is applied. Avoid using the TextEdit application with untrusted text files until the issue is resolved.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2015-11225

CVE-2015-3762

Affected Products

Os X

Textedit

References · 6

• http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-3762 · Security Note
• https://support.apple.com/kb/HT205031 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-11225 · Security Note
• http://securitytracker.com/id/1033276 · Note
• http://securityfocus.com/bid/76340 · Note