| ID |
CVE-2006-1442
|
| Summary |
The bundle API in CoreFoundation in Apple Mac OS X 10.3.9 and 10.4.6 loads dynamic libraries even if the client application has not directly requested it, which allows attackers to execute arbitrary code from an untrusted bundle. This vulnerability is addressed in the following product release:
Apple, Mac OS X, 10.4.6 (2006-003) |
| References |
|
| Vulnerable Configurations |
|
| CVSS |
| Base: | 7.5 (as of 20-07-2017 - 01:30) |
| Impact: | |
| Exploitability: | |
|
| CWE |
NVD-CWE-Other |
| CAPEC |
|
| Access |
| Vector | Complexity | Authentication |
| NETWORK |
LOW |
NONE |
|
| Impact |
| Confidentiality | Integrity | Availability |
| PARTIAL |
PARTIAL |
PARTIAL |
|
| cvss-vector
via4
|
AV:N/AC:L/Au:N/C:P/I:P/A:P
|
| refmap
via4
|
| apple | APPLE-SA-2006-05-11 | | bid | 17951 | | cert | TA06-132A | | osvdb | 25586 | | sectrack | 1016080 | | secunia | 20077 | | vupen | ADV-2006-1779 | | xf | macos-corefoundation-bundle-code-execution(26407) |
|
| Last major update |
20-07-2017 - 01:30 |
| Published |
12-05-2006 - 21:02 |
| Last modified |
20-07-2017 - 01:30 |
