CVE-2016-1775
Apple OS X TTF bdat Out-Of-Bounds Write Remote Code Execution Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
TrueTypeScaler in Apple iOS before 9.3, OS X before 10.11.4, tvOS before 9.2, and watchOS before 2.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file.
TrueTypeScaler en Apple iOS en versiones anteriores a 9.3, OS X en versiones anteriores a 10.11.4, tvOS en versiones anteriores a 9.2 y watchOS en versiones anteriores a 2.2 permite a atacantes remotos ejecutar código arbitrario o causar una denegación de servicio (corrupción de memoria) a través de un archivo de fuente manipulado.
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple OS X. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the handling of TTF fonts. The issue lies in the handling of the bdat table. An attacker can leverage this vulnerability to execute arbitrary code under the context of the current process.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2016-01-13 CVE Reserved
- 2016-03-22 CVE Published
- 2024-08-05 CVE Updated
- 2025-01-12 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CAPEC
References (10)
| URL | Tag | Source |
|---|---|---|
| http://www.securitytracker.com/id/1035353 | Third Party Advisory | |
| http://www.zerodayinitiative.com/advisories/ZDI-16-204 | Third Party Advisory |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://lists.apple.com/archives/security-announce/2015/Dec/msg00000.html | 2019-03-25 | |
| http://lists.apple.com/archives/security-announce/2015/Dec/msg00001.html | 2019-03-25 | |
| http://lists.apple.com/archives/security-announce/2015/Dec/msg00002.html | 2019-03-25 | |
| http://lists.apple.com/archives/security-announce/2015/Dec/msg00005.html | 2019-03-25 | |
| https://support.apple.com/HT205635 | 2019-03-25 | |
| https://support.apple.com/HT205637 | 2019-03-25 | |
| https://support.apple.com/HT205640 | 2019-03-25 | |
| https://support.apple.com/HT205641 | 2019-03-25 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Apple Search vendor "Apple" | Iphone Os Search vendor "Apple" for product "Iphone Os" | < 9.3 Search vendor "Apple" for product "Iphone Os" and version " < 9.3" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Mac Os X Search vendor "Apple" for product "Mac Os X" | < 10.11.4 Search vendor "Apple" for product "Mac Os X" and version " < 10.11.4" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Tvos Search vendor "Apple" for product "Tvos" | < 9.2 Search vendor "Apple" for product "Tvos" and version " < 9.2" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Watchos Search vendor "Apple" for product "Watchos" | < 2.2 Search vendor "Apple" for product "Watchos" and version " < 2.2" | - |
Affected
| ||||||