CVE-2014-1314
Apple OS X WindowsServer Sandbox Escape Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
WindowServer in Apple OS X through 10.9.2 does not prevent session creation by a sandboxed application, which allows attackers to bypass the sandbox protection mechanism and execute arbitrary code via a crafted application.
WindowServer en Apple OS X hasta 10.9.2 no previene la creación de sesión mediante una aplicación en una sandbox, lo que permite a atacantes evadir el mecanismo de protección sandbox y ejecutar código arbitrario a través de una aplicación manipulada.
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple OS X. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within WindowServer. The issue lies in the failure to prevent sandboxed applications from creating new sessions. An attacker can leverage this to execute code outside the context of the sandbox.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2014-01-08 CVE Reserved
- 2014-04-23 CVE Published
- 2023-07-08 EPSS Updated
- 2024-08-06 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-264: Permissions, Privileges, and Access Controls
CAPEC
References (1)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://archives.neohapsis.com/archives/bugtraq/2014-04/0134.html | 2014-04-24 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Apple Search vendor "Apple" | Mac Os X Search vendor "Apple" for product "Mac Os X" | <= 10.9.2 Search vendor "Apple" for product "Mac Os X" and version " <= 10.9.2" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Mac Os X Search vendor "Apple" for product "Mac Os X" | 10.9 Search vendor "Apple" for product "Mac Os X" and version "10.9" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Mac Os X Search vendor "Apple" for product "Mac Os X" | 10.9.1 Search vendor "Apple" for product "Mac Os X" and version "10.9.1" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Mac Os X Search vendor "Apple" for product "Mac Os X" | 10.8.0 Search vendor "Apple" for product "Mac Os X" and version "10.8.0" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Mac Os X Search vendor "Apple" for product "Mac Os X" | 10.8.1 Search vendor "Apple" for product "Mac Os X" and version "10.8.1" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Mac Os X Search vendor "Apple" for product "Mac Os X" | 10.8.2 Search vendor "Apple" for product "Mac Os X" and version "10.8.2" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Mac Os X Search vendor "Apple" for product "Mac Os X" | 10.8.3 Search vendor "Apple" for product "Mac Os X" and version "10.8.3" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Mac Os X Search vendor "Apple" for product "Mac Os X" | 10.8.4 Search vendor "Apple" for product "Mac Os X" and version "10.8.4" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Mac Os X Search vendor "Apple" for product "Mac Os X" | 10.8.5 Search vendor "Apple" for product "Mac Os X" and version "10.8.5" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Mac Os X Search vendor "Apple" for product "Mac Os X" | 10.8.5 Search vendor "Apple" for product "Mac Os X" and version "10.8.5" | supplemental_update |
Affected
| ||||||