CVE-2014-4484
Apple Mac OS X DFont Memory Corruption Remote Code Execution Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
FontParser in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted .dfont file.
FontParser en Apple iOS anterior a 8.1.3, Apple OS X anterior a 10.10.2, y Apple TV anterior a 7.0.3 permite a atacantes remotos ejecutar código arbitrario o causar una denegación de servicio (corrupción de memoria y caída de aplicación) a través de un fichero .dfont manipulado.
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple Mac OSX. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of a dfont file. When processing a malformed dfont file, a specified value is parsed from the file and passed to the memmove API call which can cause memory corruption. A remote attacker can use this to execute remote code under the context of the user.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2014-06-20 CVE Reserved
- 2015-01-27 CVE Published
- 2024-07-26 EPSS Updated
- 2024-08-06 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-19: Data Processing Errors
CAPEC
References (7)
URL | Tag | Source |
---|---|---|
http://www.securitytracker.com/id/1031650 | Vdb Entry |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
http://lists.apple.com/archives/security-announce/2015/Jan/msg00000.html | 2019-03-08 | |
http://lists.apple.com/archives/security-announce/2015/Jan/msg00001.html | 2019-03-08 | |
http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html | 2019-03-08 | |
http://support.apple.com/HT204244 | 2019-03-08 | |
http://support.apple.com/HT204245 | 2019-03-08 | |
http://support.apple.com/HT204246 | 2019-03-08 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Apple Search vendor "Apple" | Iphone Os Search vendor "Apple" for product "Iphone Os" | <= 8.1.2 Search vendor "Apple" for product "Iphone Os" and version " <= 8.1.2" | - |
Affected
| ||||||
Apple Search vendor "Apple" | Mac Os X Search vendor "Apple" for product "Mac Os X" | <= 10.10.1 Search vendor "Apple" for product "Mac Os X" and version " <= 10.10.1" | - |
Affected
| ||||||
Apple Search vendor "Apple" | Tvos Search vendor "Apple" for product "Tvos" | <= 7.0.1 Search vendor "Apple" for product "Tvos" and version " <= 7.0.1" | - |
Affected
|