CVE-2015-1101
Apple OS X XNU HFS_GETPATH Buffer Overflow Privilege Escalation Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
The kernel in Apple iOS before 8.3, Apple OS X before 10.10.3, and Apple TV before 7.2 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
El kernel en Apple iOS anterior a 8.3, Apple OS X anterior a 10.10.3, y Apple TV anterior a 7.2 permite a atacantes ejecutar código arbitrario en un contexto privilegiado o causar una denegación de servicio (corrupción de memoria) a través de una aplicación manipulada.
This vulnerability allows attackers to execute arbitrary code on vulnerable installations of Apple OS X. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within XNU HFS_GETPATH. This does not check the length of an attacker-supplied string before copying it into a fixed length buffer. This allows an attacker to execute arbitrary code in the context of the kernel.
OS X Yosemite 10.10.3 and Security Update 2015-004 are now available and address privilege escalation, code execution, information disclosure, and various other vulnerabilities.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2015-01-16 CVE Reserved
- 2015-04-08 CVE Published
- 2024-08-06 CVE Updated
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
CAPEC
References (8)
| URL | Tag | Source |
|---|---|---|
| http://www.securitytracker.com/id/1032048 | Vdb Entry | |
| https://support.apple.com/kb/HT204870 | X_refsource_confirm |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html | 2019-03-08 | |
| http://lists.apple.com/archives/security-announce/2015/Apr/msg00002.html | 2019-03-08 | |
| http://lists.apple.com/archives/security-announce/2015/Apr/msg00003.html | 2019-03-08 | |
| https://support.apple.com/HT204659 | 2019-03-08 | |
| https://support.apple.com/HT204661 | 2019-03-08 | |
| https://support.apple.com/HT204662 | 2019-03-08 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Apple Search vendor "Apple" | Mac Os X Search vendor "Apple" for product "Mac Os X" | <= 10.10.2 Search vendor "Apple" for product "Mac Os X" and version " <= 10.10.2" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Tvos Search vendor "Apple" for product "Tvos" | <= 7.1 Search vendor "Apple" for product "Tvos" and version " <= 7.1" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Iphone Os Search vendor "Apple" for product "Iphone Os" | <= 8.2 Search vendor "Apple" for product "Iphone Os" and version " <= 8.2" | - |
Affected
| ||||||