Vulnerability CVE-2008-0987


Published: 2008-03-18   Modified: 2011-08-04

Description:
Stack-based buffer overflow in Image Raw in Apple Mac OS X 10.5.2, and Digital Camera RAW Compatibility before Update 2.0 for Aperture 2 and iPhoto 7.1.2, allows remote attackers to execute arbitrary code via a crafted Adobe Digital Negative (DNG) image.

Type:

CWE-119

(Improper Restriction of Operations within the Bounds of a Memory Buffer)

Vendor: Apple
Product: Iphoto 
Version: 7.1.2;
Product: Aperture 
Version: 2;

CVSS2 => (AV:N/AC:M/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
6.8/10
6.4/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial

 References:
http://www.us-cert.gov/cas/techalerts/TA08-079A.html
http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html
http://xforce.iss.net/xforce/xfdb/41294
http://www.vupen.com/english/advisories/2008/0957/references
http://www.vupen.com/english/advisories/2008/0924/references
http://www.securitytracker.com/id?1019684
http://www.securitytracker.com/id?1019683
http://www.securitytracker.com/id?1019659
http://www.securityfocus.com/bid/28363
http://www.securityfocus.com/bid/28304
http://support.apple.com/kb/HT1232
http://secunia.com/advisories/29469
http://secunia.com/advisories/29420
http://lists.apple.com/archives/security-announce/2008/Mar/msg00003.html
http://docs.info.apple.com/article.html?artnum=307562

Related CVE
CVE-2017-7067
An issue was discovered in certain Apple products. macOS before 10.12.6 is affected. The issue involves the "Kernel" component. It allows attackers to bypass intended memory-read restrictions via a crafted app.
CVE-2017-7068
An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. macOS before 10.12.6 is affected. tvOS before 10.2.2 is affected. watchOS before 3.2.3 is affected. The issue involves the "libarchive" component. It allows remote atta...
CVE-2017-7069
An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. macOS before 10.12.6 is affected. tvOS before 10.2.2 is affected. watchOS before 3.2.3 is affected. The issue involves the "Kernel" component. It allows attackers to ex...
CVE-2017-7062
An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. macOS before 10.12.6 is affected. tvOS before 10.2.2 is affected. watchOS before 3.2.3 is affected. The issue involves the "Contacts" component. A buffer overflow allow...
CVE-2017-7063
An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. watchOS before 3.2.3 is affected. The issue involves the "Messages" component. It allows remote attackers to cause a denial of service (memory consumption and applicati...
CVE-2017-7064
An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCloud before 6.2.2 on Windows is affected. iTunes before 12.6.2 on Windows is affected. The issue involves the "WebKit" component. It...
CVE-2017-7059
A DOMParser XSS issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit" component.
CVE-2017-7060
An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. The issue involves the "Safari Printing" component. It allows remote attackers to cause a denial of service (excessive print dialogs) ...

Copyright 2017, cxsecurity.com