Vulnerability-Lookup

CVE-2007-4686 (GCVE-0-2007-4686)

Vulnerability from cvelistv5 – Published: 2007-11-15 01:00 – Updated: 2024-08-07 15:01

Summary

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

10 references

URL	Tags
http://securitytracker.com/id?1018950	vdb-entryx_refsource_SECTRACK
http://www.trapkit.de/advisories/TKADV2007-001.txt	x_refsource_MISC
http://www.securityfocus.com/archive/1/483753/100…	mailing-listx_refsource_BUGTRAQ
http://www.securityfocus.com/bid/26444	vdb-entryx_refsource_BID
https://exchange.xforce.ibmcloud.com/vulnerabilit…	vdb-entryx_refsource_XF
http://lists.apple.com/archives/security-announce…	vendor-advisoryx_refsource_APPLE
http://docs.info.apple.com/article.html?artnum=307041	x_refsource_CONFIRM
http://www.vupen.com/english/advisories/2007/3868	vdb-entryx_refsource_VUPEN
http://secunia.com/advisories/27643	third-party-advisoryx_refsource_SECUNIA
http://www.us-cert.gov/cas/techalerts/TA07-319A.html	third-party-advisoryx_refsource_CERT

Date Public

2007-11-14 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T15:01:10.147Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "1018950",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://securitytracker.com/id?1018950"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.trapkit.de/advisories/TKADV2007-001.txt"
          },
          {
            "name": "20071115 [TKADV2007-001] Mac OS X TIOCSETD IOCTL Kernel Memory Corruption Vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/483753/100/200/threaded"
          },
          {
            "name": "26444",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/26444"
          },
          {
            "name": "macosx-kernel-ioctl-overflow(38470)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38470"
          },
          {
            "name": "APPLE-SA-2007-11-14",
            "tags": [
              "vendor-advisory",
              "x_refsource_APPLE",
              "x_transferred"
            ],
            "url": "http://lists.apple.com/archives/security-announce/2007/Nov/msg00002.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://docs.info.apple.com/article.html?artnum=307041"
          },
          {
            "name": "ADV-2007-3868",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2007/3868"
          },
          {
            "name": "27643",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/27643"
          },
          {
            "name": "TA07-319A",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT",
              "x_transferred"
            ],
            "url": "http://www.us-cert.gov/cas/techalerts/TA07-319A.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2007-11-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Integer signedness error in the ttioctl function in bsd/kern/tty.c in the xnu kernel in Apple Mac OS X 10.4 through 10.4.10 allows local users to cause a denial of service (system shutdown) or gain privileges via a crafted TIOCSETD ioctl request."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-15T20:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "1018950",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://securitytracker.com/id?1018950"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.trapkit.de/advisories/TKADV2007-001.txt"
        },
        {
          "name": "20071115 [TKADV2007-001] Mac OS X TIOCSETD IOCTL Kernel Memory Corruption Vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/483753/100/200/threaded"
        },
        {
          "name": "26444",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/26444"
        },
        {
          "name": "macosx-kernel-ioctl-overflow(38470)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38470"
        },
        {
          "name": "APPLE-SA-2007-11-14",
          "tags": [
            "vendor-advisory",
            "x_refsource_APPLE"
          ],
          "url": "http://lists.apple.com/archives/security-announce/2007/Nov/msg00002.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://docs.info.apple.com/article.html?artnum=307041"
        },
        {
          "name": "ADV-2007-3868",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2007/3868"
        },
        {
          "name": "27643",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/27643"
        },
        {
          "name": "TA07-319A",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT"
          ],
          "url": "http://www.us-cert.gov/cas/techalerts/TA07-319A.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2007-4686",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Integer signedness error in the ttioctl function in bsd/kern/tty.c in the xnu kernel in Apple Mac OS X 10.4 through 10.4.10 allows local users to cause a denial of service (system shutdown) or gain privileges via a crafted TIOCSETD ioctl request."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "1018950",
              "refsource": "SECTRACK",
              "url": "http://securitytracker.com/id?1018950"
            },
            {
              "name": "http://www.trapkit.de/advisories/TKADV2007-001.txt",
              "refsource": "MISC",
              "url": "http://www.trapkit.de/advisories/TKADV2007-001.txt"
            },
            {
              "name": "20071115 [TKADV2007-001] Mac OS X TIOCSETD IOCTL Kernel Memory Corruption Vulnerability",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/483753/100/200/threaded"
            },
            {
              "name": "26444",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/26444"
            },
            {
              "name": "macosx-kernel-ioctl-overflow(38470)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38470"
            },
            {
              "name": "APPLE-SA-2007-11-14",
              "refsource": "APPLE",
              "url": "http://lists.apple.com/archives/security-announce/2007/Nov/msg00002.html"
            },
            {
              "name": "http://docs.info.apple.com/article.html?artnum=307041",
              "refsource": "CONFIRM",
              "url": "http://docs.info.apple.com/article.html?artnum=307041"
            },
            {
              "name": "ADV-2007-3868",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2007/3868"
            },
            {
              "name": "27643",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/27643"
            },
            {
              "name": "TA07-319A",
              "refsource": "CERT",
              "url": "http://www.us-cert.gov/cas/techalerts/TA07-319A.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2007-4686",
    "datePublished": "2007-11-15T01:00:00.000Z",
    "dateReserved": "2007-09-05T00:00:00.000Z",
    "dateUpdated": "2024-08-07T15:01:10.147Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2007-4686",
      "date": "2026-09-22",
      "epss": "0.00373",
      "percentile": "0.3122"
    },
    "nvd": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:apple:mac_os_x:10.4.1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "AFD4DE58-46C7-4E69-BF36-C5FD768B8248",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:apple:mac_os_x:10.4.2:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CF824694-52DE-44E3-ACAD-60B2A84CD3CE",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:apple:mac_os_x:10.4.3:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B73A0891-A37A-4E0D-AA73-B18BFD6B1447",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:apple:mac_os_x:10.4.4:*:*:*:*:*:*:*",
                    "matchCriteriaId": "26AC38AB-D689-4B2B-9DAE-F03F4DFD15BE",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:apple:mac_os_x:10.4.5:*:*:*:*:*:*:*",
                    "matchCriteriaId": "0C580935-0091-4163-B747-750FB7686973",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:apple:mac_os_x:10.4.6:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BB0F2132-8431-4CEF-9A3D-A69425E3834E",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:apple:mac_os_x:10.4.7:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8719F3C4-F1DE-49B5-9301-22414A2B6F9C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:apple:mac_os_x:10.4.8:*:*:*:*:*:*:*",
                    "matchCriteriaId": "09ED46A8-1739-411C-8807-2A416BDB6DFE",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:apple:mac_os_x:10.4.9:*:*:*:*:*:*:*",
                    "matchCriteriaId": "786BB737-EA99-4EC6-B742-0C35BF2453F9",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:apple:mac_os_x:10.4.10:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8D089858-3AF9-4B82-912D-AA33F25E3715",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:apple:mac_os_x_server:10.4.1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "29644501-54BD-45E9-A6C1-618892CD354F",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:apple:mac_os_x_server:10.4.2:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8A132487-E89F-4D0D-8366-14AFC904811F",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:apple:mac_os_x_server:10.4.3:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FD231103-D7C7-4697-BE90-D67558D6115C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:apple:mac_os_x_server:10.4.4:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BCADAAA0-C885-466C-A122-A94E73EAF817",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:apple:mac_os_x_server:10.4.5:*:*:*:*:*:*:*",
                    "matchCriteriaId": "448DB1C7-7B0C-4076-9B9F-1CDCD5EB6930",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:apple:mac_os_x_server:10.4.6:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2BE429EF-24D4-453A-8B43-8CCEF5D72773",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:apple:mac_os_x_server:10.4.7:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8AC9692A-CE81-446D-B136-449662C4B9A2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:apple:mac_os_x_server:10.4.8:*:*:*:*:*:*:*",
                    "matchCriteriaId": "504D78AB-5374-48C9-B357-DB6BD2267D2D",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:apple:mac_os_x_server:10.4.9:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3029892E-1375-4F40-83D3-A51BDC4E9840",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:apple:mac_os_x_server:10.4.10:*:*:*:*:*:*:*",
                    "matchCriteriaId": "81F8DA6D-2258-4138-8FB2-90BE3C68B230",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Integer signedness error in the ttioctl function in bsd/kern/tty.c in the xnu kernel in Apple Mac OS X 10.4 through 10.4.10 allows local users to cause a denial of service (system shutdown) or gain privileges via a crafted TIOCSETD ioctl request."
          },
          {
            "lang": "es",
            "value": "Un error en la propiedad signedness de enteros en la funci\u00f3n ttioctl en el archivo bsd/kern/tty.c en el Kernel xnu en Apple Mac OS X versiones 10.4 hasta 10.4.10,  permite a usuarios locales causar una denegaci\u00f3n de servicio (apagado del sistema) o alcanzar privilegios por medio de una petici\u00f3n ioctl TIOCSETD dise\u00f1ada."
          }
        ],
        "id": "CVE-2007-4686",
        "lastModified": "2026-04-23T00:35:47.467",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "HIGH",
              "cvssData": {
                "accessComplexity": "LOW",
                "accessVector": "LOCAL",
                "authentication": "NONE",
                "availabilityImpact": "COMPLETE",
                "baseScore": 7.2,
                "confidentialityImpact": "COMPLETE",
                "integrityImpact": "COMPLETE",
                "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
                "version": "2.0"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 10.0,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": false
            }
          ]
        },
        "published": "2007-11-15T01:46:00.000",
        "references": [
          {
            "source": "cve@mitre.org",
            "url": "http://docs.info.apple.com/article.html?artnum=307041"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Patch"
            ],
            "url": "http://lists.apple.com/archives/security-announce/2007/Nov/msg00002.html"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "http://secunia.com/advisories/27643"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://securitytracker.com/id?1018950"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.securityfocus.com/archive/1/483753/100/200/threaded"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.securityfocus.com/bid/26444"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.trapkit.de/advisories/TKADV2007-001.txt"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "US Government Resource"
            ],
            "url": "http://www.us-cert.gov/cas/techalerts/TA07-319A.html"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "http://www.vupen.com/english/advisories/2007/3868"
          },
          {
            "source": "cve@mitre.org",
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38470"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://docs.info.apple.com/article.html?artnum=307041"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "http://lists.apple.com/archives/security-announce/2007/Nov/msg00002.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "http://secunia.com/advisories/27643"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://securitytracker.com/id?1018950"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.securityfocus.com/archive/1/483753/100/200/threaded"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.securityfocus.com/bid/26444"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.trapkit.de/advisories/TKADV2007-001.txt"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "US Government Resource"
            ],
            "url": "http://www.us-cert.gov/cas/techalerts/TA07-319A.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "http://www.vupen.com/english/advisories/2007/3868"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38470"
          }
        ],
        "sourceIdentifier": "cve@mitre.org",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-189"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    }
  }
}

CERTA-2007-AVI-499

Vulnerability from certfr_avis - Published: 2007-11-15 - Updated: 2007-11-15

None

Description

De très nombreuses vulnérabilités touchent les systèmes d'exploitation Mac OS X. L'exploitation de ces vulnérabilités permettent à une personne mal intentionnée d'exécuter des actions diverses, dont l'exécution de code arbitraire à distance.

Solution

Utiliser la mise à jour automatique ou se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Apple	N/A	Apple Mac OS X version 10.3.9 et versions antérieures ;
Apple	N/A	Apple Mac OS X Server version 10.3.9 et versions antérieures ;
Apple	N/A	Apple Mac OS X Server version 10.4.10 et versions antérieures ;
Apple	N/A	Apple Mac OS X version 10.4.10 et versions antérieures ;

References

Title

Publication Time

FKIE_CVE-2007-4686

Vulnerability from fkie_nvd - Published: 2007-11-15 01:46 - Updated: 2026-06-16 22:44

Severity

Summary

References

URL	Tags
cve@mitre.org	http://docs.info.apple.com/article.html?artnum=307041
cve@mitre.org	http://lists.apple.com/archives/security-announce/2007/Nov/msg00002.html	Patch
cve@mitre.org	http://secunia.com/advisories/27643	Vendor Advisory
cve@mitre.org	http://securitytracker.com/id?1018950
cve@mitre.org	http://www.securityfocus.com/archive/1/483753/100/200/threaded
cve@mitre.org	http://www.securityfocus.com/bid/26444
cve@mitre.org	http://www.trapkit.de/advisories/TKADV2007-001.txt
cve@mitre.org	http://www.us-cert.gov/cas/techalerts/TA07-319A.html	US Government Resource
cve@mitre.org	http://www.vupen.com/english/advisories/2007/3868	Vendor Advisory
cve@mitre.org	https://exchange.xforce.ibmcloud.com/vulnerabilities/38470
af854a3a-2127-422b-91ae-364da2661108	http://docs.info.apple.com/article.html?artnum=307041
af854a3a-2127-422b-91ae-364da2661108	http://lists.apple.com/archives/security-announce/2007/Nov/msg00002.html	Patch
af854a3a-2127-422b-91ae-364da2661108	http://secunia.com/advisories/27643	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://securitytracker.com/id?1018950
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/archive/1/483753/100/200/threaded
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/bid/26444
af854a3a-2127-422b-91ae-364da2661108	http://www.trapkit.de/advisories/TKADV2007-001.txt
af854a3a-2127-422b-91ae-364da2661108	http://www.us-cert.gov/cas/techalerts/TA07-319A.html	US Government Resource
af854a3a-2127-422b-91ae-364da2661108	http://www.vupen.com/english/advisories/2007/3868	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://exchange.xforce.ibmcloud.com/vulnerabilities/38470

Impacted products

Vendor	Product	Version
apple	mac_os_x	10.4.1
apple	mac_os_x	10.4.2
apple	mac_os_x	10.4.3
apple	mac_os_x	10.4.4
apple	mac_os_x	10.4.5
apple	mac_os_x	10.4.6
apple	mac_os_x	10.4.7
apple	mac_os_x	10.4.8
apple	mac_os_x	10.4.9
apple	mac_os_x	10.4.10
apple	mac_os_x_server	10.4.1
apple	mac_os_x_server	10.4.2
apple	mac_os_x_server	10.4.3
apple	mac_os_x_server	10.4.4
apple	mac_os_x_server	10.4.5
apple	mac_os_x_server	10.4.6
apple	mac_os_x_server	10.4.7
apple	mac_os_x_server	10.4.8
apple	mac_os_x_server	10.4.9
apple	mac_os_x_server	10.4.10

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:apple:mac_os_x:10.4.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "AFD4DE58-46C7-4E69-BF36-C5FD768B8248",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:apple:mac_os_x:10.4.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "CF824694-52DE-44E3-ACAD-60B2A84CD3CE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:apple:mac_os_x:10.4.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "B73A0891-A37A-4E0D-AA73-B18BFD6B1447",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:apple:mac_os_x:10.4.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "26AC38AB-D689-4B2B-9DAE-F03F4DFD15BE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:apple:mac_os_x:10.4.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "0C580935-0091-4163-B747-750FB7686973",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:apple:mac_os_x:10.4.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "BB0F2132-8431-4CEF-9A3D-A69425E3834E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:apple:mac_os_x:10.4.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "8719F3C4-F1DE-49B5-9301-22414A2B6F9C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:apple:mac_os_x:10.4.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "09ED46A8-1739-411C-8807-2A416BDB6DFE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:apple:mac_os_x:10.4.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "786BB737-EA99-4EC6-B742-0C35BF2453F9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:apple:mac_os_x:10.4.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "8D089858-3AF9-4B82-912D-AA33F25E3715",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:apple:mac_os_x_server:10.4.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "29644501-54BD-45E9-A6C1-618892CD354F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:apple:mac_os_x_server:10.4.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "8A132487-E89F-4D0D-8366-14AFC904811F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:apple:mac_os_x_server:10.4.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "FD231103-D7C7-4697-BE90-D67558D6115C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:apple:mac_os_x_server:10.4.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "BCADAAA0-C885-466C-A122-A94E73EAF817",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:apple:mac_os_x_server:10.4.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "448DB1C7-7B0C-4076-9B9F-1CDCD5EB6930",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:apple:mac_os_x_server:10.4.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "2BE429EF-24D4-453A-8B43-8CCEF5D72773",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:apple:mac_os_x_server:10.4.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "8AC9692A-CE81-446D-B136-449662C4B9A2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:apple:mac_os_x_server:10.4.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "504D78AB-5374-48C9-B357-DB6BD2267D2D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:apple:mac_os_x_server:10.4.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "3029892E-1375-4F40-83D3-A51BDC4E9840",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:apple:mac_os_x_server:10.4.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "81F8DA6D-2258-4138-8FB2-90BE3C68B230",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Integer signedness error in the ttioctl function in bsd/kern/tty.c in the xnu kernel in Apple Mac OS X 10.4 through 10.4.10 allows local users to cause a denial of service (system shutdown) or gain privileges via a crafted TIOCSETD ioctl request."
    },
    {
      "lang": "es",
      "value": "Un error en la propiedad signedness de enteros en la funci\u00f3n ttioctl en el archivo bsd/kern/tty.c en el Kernel xnu en Apple Mac OS X versiones 10.4 hasta 10.4.10,  permite a usuarios locales causar una denegaci\u00f3n de servicio (apagado del sistema) o alcanzar privilegios por medio de una petici\u00f3n ioctl TIOCSETD dise\u00f1ada."
    }
  ],
  "id": "CVE-2007-4686",
  "lastModified": "2026-06-16T22:44:35.247",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 7.2,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2007-11-15T01:46:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://docs.info.apple.com/article.html?artnum=307041"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://lists.apple.com/archives/security-announce/2007/Nov/msg00002.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/27643"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://securitytracker.com/id?1018950"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/483753/100/200/threaded"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/26444"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.trapkit.de/advisories/TKADV2007-001.txt"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.us-cert.gov/cas/techalerts/TA07-319A.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2007/3868"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38470"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://docs.info.apple.com/article.html?artnum=307041"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://lists.apple.com/archives/security-announce/2007/Nov/msg00002.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/27643"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securitytracker.com/id?1018950"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/483753/100/200/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/26444"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.trapkit.de/advisories/TKADV2007-001.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.us-cert.gov/cas/techalerts/TA07-319A.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2007/3868"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38470"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-189"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-MGQG-9G67-QVCC

Vulnerability from github – Published: 2022-05-01 18:26 – Updated: 2022-05-01 18:26

Details

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2007-4686"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2007-11-15T01:46:00Z",
    "severity": "HIGH"
  },
  "details": "Integer signedness error in the ttioctl function in bsd/kern/tty.c in the xnu kernel in Apple Mac OS X 10.4 through 10.4.10 allows local users to cause a denial of service (system shutdown) or gain privileges via a crafted TIOCSETD ioctl request.",
  "id": "GHSA-mgqg-9g67-qvcc",
  "modified": "2022-05-01T18:26:08Z",
  "published": "2022-05-01T18:26:08Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2007-4686"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38470"
    },
    {
      "type": "WEB",
      "url": "http://docs.info.apple.com/article.html?artnum=307041"
    },
    {
      "type": "WEB",
      "url": "http://lists.apple.com/archives/security-announce/2007/Nov/msg00002.html"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/27643"
    },
    {
      "type": "WEB",
      "url": "http://securitytracker.com/id?1018950"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/483753/100/200/threaded"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/26444"
    },
    {
      "type": "WEB",
      "url": "http://www.trapkit.de/advisories/TKADV2007-001.txt"
    },
    {
      "type": "WEB",
      "url": "http://www.us-cert.gov/cas/techalerts/TA07-319A.html"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2007/3868"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GSD-2007-4686

Vulnerability from gsd - Updated: 2023-12-13 01:21

Details

Aliases

CVE-2007-4686

Aliases

CVE-2007-4686

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2007-4686",
    "description": "Integer signedness error in the ttioctl function in bsd/kern/tty.c in the xnu kernel in Apple Mac OS X 10.4 through 10.4.10 allows local users to cause a denial of service (system shutdown) or gain privileges via a crafted TIOCSETD ioctl request.",
    "id": "GSD-2007-4686"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2007-4686"
      ],
      "details": "Integer signedness error in the ttioctl function in bsd/kern/tty.c in the xnu kernel in Apple Mac OS X 10.4 through 10.4.10 allows local users to cause a denial of service (system shutdown) or gain privileges via a crafted TIOCSETD ioctl request.",
      "id": "GSD-2007-4686",
      "modified": "2023-12-13T01:21:37.043549Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2007-4686",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Integer signedness error in the ttioctl function in bsd/kern/tty.c in the xnu kernel in Apple Mac OS X 10.4 through 10.4.10 allows local users to cause a denial of service (system shutdown) or gain privileges via a crafted TIOCSETD ioctl request."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "1018950",
            "refsource": "SECTRACK",
            "url": "http://securitytracker.com/id?1018950"
          },
          {
            "name": "http://www.trapkit.de/advisories/TKADV2007-001.txt",
            "refsource": "MISC",
            "url": "http://www.trapkit.de/advisories/TKADV2007-001.txt"
          },
          {
            "name": "20071115 [TKADV2007-001] Mac OS X TIOCSETD IOCTL Kernel Memory Corruption Vulnerability",
            "refsource": "BUGTRAQ",
            "url": "http://www.securityfocus.com/archive/1/483753/100/200/threaded"
          },
          {
            "name": "26444",
            "refsource": "BID",
            "url": "http://www.securityfocus.com/bid/26444"
          },
          {
            "name": "macosx-kernel-ioctl-overflow(38470)",
            "refsource": "XF",
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38470"
          },
          {
            "name": "APPLE-SA-2007-11-14",
            "refsource": "APPLE",
            "url": "http://lists.apple.com/archives/security-announce/2007/Nov/msg00002.html"
          },
          {
            "name": "http://docs.info.apple.com/article.html?artnum=307041",
            "refsource": "CONFIRM",
            "url": "http://docs.info.apple.com/article.html?artnum=307041"
          },
          {
            "name": "ADV-2007-3868",
            "refsource": "VUPEN",
            "url": "http://www.vupen.com/english/advisories/2007/3868"
          },
          {
            "name": "27643",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/27643"
          },
          {
            "name": "TA07-319A",
            "refsource": "CERT",
            "url": "http://www.us-cert.gov/cas/techalerts/TA07-319A.html"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:apple:mac_os_x:10.4.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:apple:mac_os_x:10.4.5:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:apple:mac_os_x_server:10.4.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:apple:mac_os_x_server:10.4.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:apple:mac_os_x:10.4.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:apple:mac_os_x:10.4.10:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:apple:mac_os_x:10.4.8:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:apple:mac_os_x:10.4.9:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:apple:mac_os_x_server:10.4.6:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:apple:mac_os_x_server:10.4.7:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:apple:mac_os_x:10.4.6:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:apple:mac_os_x:10.4.7:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:apple:mac_os_x_server:10.4.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:apple:mac_os_x_server:10.4.5:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:apple:mac_os_x:10.4.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:apple:mac_os_x:10.4.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:apple:mac_os_x_server:10.4.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:apple:mac_os_x_server:10.4.10:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:apple:mac_os_x_server:10.4.8:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:apple:mac_os_x_server:10.4.9:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2007-4686"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Integer signedness error in the ttioctl function in bsd/kern/tty.c in the xnu kernel in Apple Mac OS X 10.4 through 10.4.10 allows local users to cause a denial of service (system shutdown) or gain privileges via a crafted TIOCSETD ioctl request."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-189"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "APPLE-SA-2007-11-14",
              "refsource": "APPLE",
              "tags": [
                "Patch"
              ],
              "url": "http://lists.apple.com/archives/security-announce/2007/Nov/msg00002.html"
            },
            {
              "name": "http://www.trapkit.de/advisories/TKADV2007-001.txt",
              "refsource": "MISC",
              "tags": [],
              "url": "http://www.trapkit.de/advisories/TKADV2007-001.txt"
            },
            {
              "name": "http://docs.info.apple.com/article.html?artnum=307041",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://docs.info.apple.com/article.html?artnum=307041"
            },
            {
              "name": "TA07-319A",
              "refsource": "CERT",
              "tags": [
                "US Government Resource"
              ],
              "url": "http://www.us-cert.gov/cas/techalerts/TA07-319A.html"
            },
            {
              "name": "26444",
              "refsource": "BID",
              "tags": [],
              "url": "http://www.securityfocus.com/bid/26444"
            },
            {
              "name": "1018950",
              "refsource": "SECTRACK",
              "tags": [],
              "url": "http://securitytracker.com/id?1018950"
            },
            {
              "name": "27643",
              "refsource": "SECUNIA",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://secunia.com/advisories/27643"
            },
            {
              "name": "ADV-2007-3868",
              "refsource": "VUPEN",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://www.vupen.com/english/advisories/2007/3868"
            },
            {
              "name": "macosx-kernel-ioctl-overflow(38470)",
              "refsource": "XF",
              "tags": [],
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38470"
            },
            {
              "name": "20071115 [TKADV2007-001] Mac OS X TIOCSETD IOCTL Kernel Memory Corruption Vulnerability",
              "refsource": "BUGTRAQ",
              "tags": [],
              "url": "http://www.securityfocus.com/archive/1/483753/100/200/threaded"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.2,
            "confidentialityImpact": "COMPLETE",
            "integrityImpact": "COMPLETE",
            "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 10.0,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "HIGH",
          "userInteractionRequired": false
        }
      },
      "lastModifiedDate": "2018-10-15T21:36Z",
      "publishedDate": "2007-11-15T01:46Z"
    }
  }
}

VAR-200711-0326

Vulnerability from variot - Updated: 2025-04-10 19:54

Integer signedness error in the ttioctl function in bsd/kern/tty.c in the xnu kernel in Apple Mac OS X 10.4 through 10.4.10 allows local users to cause a denial of service (system shutdown) or gain privileges via a crafted TIOCSETD ioctl request. Apple Mac OS X CoreText contains an uninitialized pointer vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Apple Mac OS X is prone to multiple security vulnerabilities. These issues affect Mac OS X and various applications, including AppleRAID, CFFTP, CFNetwork, CoreFoundation, CoreText, kernel, remote_cmds, networking, NFS, NSURL, SecurityAgent, WebCore, and WebKit. Attackers may exploit these issues to execute arbitrary code, trigger denial-of-service conditions, escalate privileges, and potentially compromise vulnerable computers. Apple Mac OS X 10.4.10 and prior versions are vulnerable to these issues.

2003: 2,700 advisories published 2004: 3,100 advisories published 2005: 4,600 advisories published 2006: 5,300 advisories published

How do you know which Secunia advisories are important to you?

The Secunia Vulnerability Intelligence Solutions allows you to filter and structure all the information you need, so you can address issues effectively.

1) Multiple errors within the Adobe Flash Player plug-in can be exploited by malicious people to gain knowledge of sensitive information or compromise a user's system.

For more information: SA26027

2) A null-pointer dereference error exists within AppleRAID when handling disk images. This can be exploited to cause a system shutdown when a specially crafted disk image is mounted e.g. automatically via Safari if the option "Open 'safe' files after downloading" is enabled.

3) An error in BIND can be exploited by malicious people to poison the DNS cache.

For more information: SA26152

4) An error in bzip2 can be exploited to cause a DoS (Denial of Service).

For more information: SA15447

This also fixes a race condition when setting file permissions.

5) An unspecified error in the implementation of FTP of CFNetwork can be exploited by a malicious FTP server to cause the client to connect to other hosts by sending specially crafted replies to FTP PASV (passive) commands.

6) An unspecified error exists in the validation of certificates within CFNetwork. This can be exploited via a Man-in-the-Middle (MitM) attack to spoof a web site with a trusted certificate.

7) A null pointer dereference error in the CFNetwork framework can lead to an unexpected application termination when a vulnerable application connects to a malicious server.

8) A boundary error in CoreFoundation can be exploited to cause a one-byte buffer overflow when a user is enticed to read a specially crafted directory hierarchy.

Successful exploitation allows execution of arbitrary code.

9) An error exists in CoreText due to the use of an uninitialised pointer and can be exploited to execute arbitrary code when a user is tricked into reading a specially crafted text.

10) Some vulnerabilities in Kerberos can be exploited by malicious users and malicious people to compromise a vulnerable system.

Successful exploitation requires permission to execute a setuid binary.

12) An unspecified error in the Kernel can be exploited to bypass the chroot mechanism by changing the working directory using a relative path.

14) An error exists in the handling of standard file descriptors while executing setuid and setgid programs. This can be exploited by malicious, local users to gain system privileges by executing setuid programs with the standard file descriptors in an unexpected state.

15) An integer overflow exists in the Kernel when handling ioctl requests. This can be exploited to execute arbitrary code with system privileges by sending a specially crafted ioctl request.

16) The default configuration of tftpd allows clients to access any path on the system.

17) An error in the Node Information Query mechanism may allow a remote user to query for all addresses of a host, including link-local addresses.

18) An integer overflow exists in the handling of ASP messages with AppleTalk. This can be exploited by malicious, local users to cause a heap-based buffer overflow and to execute arbitrary code with system privileges by sending a maliciously crafted ASP message on an AppleTalk socket.

20) A boundary error exists when adding a new AppleTalk zone. This can be exploited to cause a stack-based buffer overflow by sending a maliciously crafted ioctl request to an AppleTalk socket and allows execution of arbitrary code with system privileges.

21) An arithmetic error exists in AppleTalk when handling memory allocations.

22) A double free error in NFS exists when processing an AUTH_UNIX RPC call. This can be exploited by malicious people to execute arbitrary code by sending a maliciously crafted AUTH_UNIX RPC call via TCP or UDP.

23) An unspecified case-sensitivity error exists in NSURL when determining if a URL references the local file system.

24) A format string error in Safari can be exploited by malicious people to execute arbitrary code when a user is tricked into opening a .download file with a specially crafted name.

25) An implementation error exists in the tabbed browsing feature of Safari. If HTTP authentication is used by a site being loaded in a tab other than the active tab, an authentication sheet may be displayed although the tab and its corresponding page are not visible.

26) A person with physical access to a system may be able to bypass the screen saver authentication dialog by sending keystrokes to a process running behind the screen saver authentication dialog.

27) Safari does not block "file://" URLs when loading resources. This can be exploited to view the content of local files by enticing a user to visit a specially crafted web page.

28) An input validation error exists in WebCore when handling HTML forms. This can be exploited to alter the values of form fields by enticing a user to upload a specially crafted file.

29) A race condition error exists in Safari when handling page transitions. This can be exploited to obtain information entered in forms on other web sites by enticing a user to visit a malicious web page.

30) An unspecified error exists in the handling of the browser's history. This can be exploited to execute arbitrary code by enticing a user to visit a specially crafted web page.

31) An error in Safari allows malicious websites to set Javascript window properties of websites served from a different domain. This can be exploited to get or set the window status and location of pages served from other websites by enticing a user to visit a specially crafted web page.

32) An error in Safari allows a malicious website to bypass the same origin policy by hosting embedded objects with javascript URLs. This can be exploited to execute arbitrary HTML and script code in context of another site by enticing a user to visit a specially crafted web page.

33) An error in Safari allows content served over HTTP to alter or access content served over HTTPS in the same domain. This can be exploited to execute Javascript code in context of HTTPS web pages in that domain when a user visits a malicious web page.

34) An error in Safari in the handling of new browser windows can be exploited to disclose the URL of an unrelated page.

For more information see vulnerability #2 in: SA23893

35) An error in WebKit may allow unauthorised applications to access private keys added to the keychain by Safari.

36) An unspecified error in Safari may allow a malicious website to send remotely specified data to arbitrary TCP ports.

37) WebKit/Safari creates temporary files insecurely when previewing a PDF file, which may allow a local user to access the file's content. 5) The vendor credits Dr Bob Lopez PhD. 6) The vendor credits Marko Karppinen, Petteri Kamppuri, and Nikita Zhuk of MK&C. 9) Will Dormann, CERT/CC 11) An anonymous person, reported via iDefense Labs. 12) The vendor credits Johan Henselmans and Jesper Skov. 13) The vendor credits RISE Security. 14) The vendor credits Ilja van Sprundel. 15) The vendor credits Tobias Klein, www.trapkit.de 16) The vendor credits James P. Javery, Stratus Data Systems 17) The vendor credits Arnaud Ebalard, EADS Innovation Works. 18, 21) Sean Larsson, iDefense Labs 19) The vendor credits Bhavesh Davda of VMware and Brian "chort" Keefer of Tumbleweed Communications. 20) An anonymous person, reported via iDefense Labs. 22) The vendor credits Alan Newson of NGSSoftware, and Renaud Deraison of Tenable Network Security, Inc. 25) The vendor credits Michael Roitzsch, Technical University Dresden. 26) The vendor credits Faisal N. Jawdat 27) The vendor credits lixlpixel. 28) The vendor credits Bodo Ruskamp, Itchigo Communications GmbH. 29) The vendor credits Ryan Grisso, NetSuite. 30) The vendor credits David Bloom. 31, 32) The vendor credits Michal Zalewski, Google Inc. 33) The vendor credits Keigo Yamazaki of LAC Co. 36) The vendor credits Kostas G. Anagnostakis, Institute for Infocomm Research and Spiros Antonatos, FORTH-ICS 37) The vendor credits Jean-Luc Giraud, and Moritz Borgmann of ETH Zurich.

ORIGINAL ADVISORY: Apple: http://docs.info.apple.com/article.html?artnum=307041

US-CERT VU#498105: http://www.kb.cert.org/vuls/id/498105

iDefense Labs: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=630 http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=629 http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=627 http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=628

OTHER REFERENCES: SA15447: http://secunia.com/advisories/15447/

SA23893: http://secunia.com/advisories/23893/

SA26027: http://secunia.com/advisories/26027/

SA26152: http://secunia.com/advisories/26152/

SA26676: http://secunia.com/advisories/26676/

About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.

Subscribe: http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/

Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.

Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

I. Further details are available in the related vulnerability notes.

II. Impact

The impacts of these vulnerabilities vary. Potential consequences include remote execution of arbitrary code or commands, bypass of security restrictions, and denial of service.

III. This and other updates are available via Apple Update or via Apple Downloads.

IV. Please send email to cert@cert.org with "TA07-319A Feedback VU#498105" in the subject.

For instructions on subscribing to or unsubscribing from this mailing list, visit http://www.us-cert.gov/cas/signup.html.

Produced 2007 by US-CERT, a government organization.

 <http://www.us-cert.gov/legal.html>

Revision History

November 15, 2007: Initial release

-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux)

iQEVAwUBRzx7ZvRFkHkM87XOAQJfIQgAmTZfjJAY/QTweUmvZtOJ9JQ4e/Gj0sE9 OPSrK/SplP92WUL1Ucb8I/VUSQEXXJhNv9dTCMcy7IMpqhx4UxPA6fBKWDJ+nUFi sx/60EOAiIVW+yYK79VdoI1jrSs48E+CNdqEJCQcjUCVi29eGAdW63H2jOZV37/F 4iQBZYRqhiycZ9FS+S+9aRfMhfy8dEOr1UwIElq6X/tSwss1EKFSNrK5ktGifUtB AJ+LJVBt2yZOIApcGhsxC3LYUDrDfhqGLIVM2XBc1yuV7Y2gaH4g9Txe+fWK79X2 LYHvhv2xtgLweR12YC+0hT60wSdrDTM6ZW0//ny25LZ7Y7D46ogSWQ== =AgEr -----END PGP SIGNATURE----- .

====================== Technical description: ======================

Kernel source file: bsd/kern/tty.c (from http://www.opensource.apple.com/darwinsource/10.4.8.x86/xnu-792.13.8/)

822 int 823 ttioctl(register struct tty tp, 824 u_long cmd, caddr_t data, int flag, 825 struct proc p) 826 {

[...]

1085 bcopy(t->c_cc, tp->t_cc, sizeof(t->c_cc)); 1086 splx(s); 1087 break; 1088 } 1089 case TIOCSETD: { / set line discipline / 1090 register int t = (int )data; <--- (1) 1091 dev_t device = tp->t_dev; 1092 1093 if (t >= nlinesw) <--- (2) 1094 return (ENXIO); 1095 if (t != tp->t_line) { 1096 s = spltty(); 1097 (linesw[tp->t_line].l_close)(tp, flag); 1098 error = (linesw[t].l_open)(device, tp); <--- (3) 1099 if (error) { 1100 (void)(*linesw[tp->t_line].l_open)(device, tp); 1101 splx(s); 1102 return (error); 1103 } 1104 tp->t_line = t; 1105 splx(s); 1106 } 1107 break; 1108 }

In line 1090 the user supplied "data" of the type caddr_t (char *) gets stored in the variable "t" of the type signed int (see (1)). Then in line 1093 the value of "t" is compared with "nlinesw". As "data" is supplied by the user it is possible to provide a string value >= 0x80000000. If so, "t" gets a negative value due to the type conversion error (see (1)) and the check in line 1093 will always be passed (see (2)). In line 1098 the user supplied value "t" is used to reference and call "l_open". This leads to full control of the kernel execution flow.

Corresponding assembler code snippet:

__text:00356C08 loc_356C08:
__text:00356C08 mov eax, [ebp+arg_8] __text:00356C0B mov ebx, [eax] <--- (1) __text:00356C0D mov edx, [ebp+arg_0]
__text:00356C10 mov edx, [edx+64h]
__text:00356C13 mov [ebp+var_58], edx
__text:00356C16 cmp ebx, ds:457880h <--- (2) __text:00356C1C jl short loc_356C28 __text:00356C1E mov esi, 6
__text:00356C23 jmp loc_356F70
__text:00356C28 ; -------------------------------- __text:00356C28 __text:00356C28 loc_356C28:
__text:00356C28 mov ecx, [ebp+arg_0]
__text:00356C2B cmp ebx, [ecx+60h]
__text:00356C2E jz loc_356633
__text:00356C34 call _spltty
__text:00356C39 mov edi, eax
__text:00356C3B mov esi, [ebp+arg_0]
__text:00356C3E mov eax, [esi+60h]
__text:00356C41 shl eax, 5
__text:00356C44 mov edx, [ebp+arg_C]
__text:00356C47 mov [esp+0B8h+var_B4], edx
__text:00356C4B mov [esp+0B8h+var_B8], esi
__text:00356C4E call ds:off_4578A4[eax] __text:00356C54 mov eax, ebx <--- (3) __text:00356C56 shl eax, 5 <--- (4) __text:00356C59 mov [esp+0B8h+var_B4], esi __text:00356C5D mov ecx, [ebp+var_58] __text:00356C60 mov [esp+0B8h+var_B8], ecx __text:00356C63 call ds:_linesw[eax] <--- (5)

(1) The user supplied data is copied into EBX (2) EBX is compared with nlinesw (3) The user supplied data in EBX is copied into EAX (4) Slightly modification of EAX (5) The user supplied value in EAX is used as a reference in this call

================= Proof of Concept: =================

Due to the severity of this issue no proof of concept exploit code will be released.

http://www.apple.com/support/downloads/

======== History: ========

2007/03/19 - Vendor notified 2007/03/19 - Automated reply from vendor 2007/03/26 - Vendor asks for more details 2007/04/01 - Provided vendor with more details 2007/04/04 - Status update from vendor 2007/04/06 - Vendor confirms the vulnerability 2007/05/11 - Status update request 2007/06/22 - Status update from vendor 2007/11/14 - Update released by the vendor 2007/11/15 - Full technical details released to general public

======== Credits: ========

Vulnerability found and advisory written by Tobias Klein.

=========== References: ===========

[1] http://docs.info.apple.com/article.html?artnum=307041 [2] http://www.trapkit.de/advisories/TKADV2007-001.txt

======== Changes: ========

Revision 0.1 - Initial draft release to the vendor Revision 1.0 - Public release

=========== Disclaimer: ===========

The information within this advisory may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are no warranties, implied or express, with regard to this information. In no event shall the author be liable for any direct or indirect damages whatsoever arising out of or in connection with the use or spread of this information. Any use of this information is at the user's own risk.

================== PGP Signature Key: ==================

http://www.trapkit.de/advisories/tk-advisories-signature-key.asc

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-200711-0326",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "mac os x server",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "apple",
        "version": "10.4.7"
      },
      {
        "model": "mac os x",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "apple",
        "version": "10.4.9"
      },
      {
        "model": "mac os x server",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "apple",
        "version": "10.4.2"
      },
      {
        "model": "mac os x server",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "apple",
        "version": "10.4.9"
      },
      {
        "model": "mac os x",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "apple",
        "version": "10.4.8"
      },
      {
        "model": "mac os x server",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "apple",
        "version": "10.4.5"
      },
      {
        "model": "mac os x server",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "apple",
        "version": "10.4.10"
      },
      {
        "model": "mac os x server",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "apple",
        "version": "10.4.6"
      },
      {
        "model": "mac os x server",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "apple",
        "version": "10.4.1"
      },
      {
        "model": "mac os x server",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "apple",
        "version": "10.4.8"
      },
      {
        "model": "mac os x server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "apple",
        "version": "10.4.4"
      },
      {
        "model": "mac os x",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "apple",
        "version": "10.4.2"
      },
      {
        "model": "mac os x",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "apple",
        "version": "10.4.7"
      },
      {
        "model": "mac os x",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "apple",
        "version": "10.4.1"
      },
      {
        "model": "mac os x",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "apple",
        "version": "10.4.3"
      },
      {
        "model": "mac os x",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "apple",
        "version": "10.4.6"
      },
      {
        "model": "mac os x",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "apple",
        "version": "10.4.5"
      },
      {
        "model": "mac os x",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "apple",
        "version": "10.4.10"
      },
      {
        "model": "mac os x server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "apple",
        "version": "10.4.3"
      },
      {
        "model": "mac os x",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "apple",
        "version": "10.4.4"
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "apple computer",
        "version": null
      },
      {
        "model": "mac os x",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "apple",
        "version": "v10.4 to  v10.4.10 version"
      },
      {
        "model": "mac os x server",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "apple",
        "version": "v10.4 to  v10.4.10 version"
      },
      {
        "model": "linux enterprise server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "suse",
        "version": "8"
      },
      {
        "model": "linux enterprise server sp1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "suse",
        "version": "10"
      },
      {
        "model": "linux enterprise desktop sp1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "suse",
        "version": "10"
      },
      {
        "model": "opensuse",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "suse",
        "version": "10.3"
      },
      {
        "model": "unitedlinux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "s u s e",
        "version": "1.0"
      },
      {
        "model": "suse linux standard server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "s u s e",
        "version": "8.0"
      },
      {
        "model": "suse linux school server for i386",
        "scope": null,
        "trust": 0.3,
        "vendor": "s u s e",
        "version": null
      },
      {
        "model": "suse linux retail solution",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "s u s e",
        "version": "8.0"
      },
      {
        "model": "suse linux openexchange server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "s u s e",
        "version": "4.0"
      },
      {
        "model": "opensuse",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "s u s e",
        "version": "10.2"
      },
      {
        "model": "open-enterprise-server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "s u s e",
        "version": "0"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "s u s e",
        "version": "10.1x86-64"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "s u s e",
        "version": "10.1x86"
      },
      {
        "model": "linux ppc",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "s u s e",
        "version": "10.1"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "s u s e",
        "version": "10.0x86-64"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "s u s e",
        "version": "10.0x86"
      },
      {
        "model": "linux ppc",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "s u s e",
        "version": "10.0"
      },
      {
        "model": "linux pos",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "novell",
        "version": "9"
      },
      {
        "model": "linux desktop",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "novell",
        "version": "9"
      },
      {
        "model": "safari beta for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "3.0.4"
      },
      {
        "model": "safari beta for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "3.0.3"
      },
      {
        "model": "safari beta",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "3.0.3"
      },
      {
        "model": "safari beta for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "3.0.2"
      },
      {
        "model": "safari beta",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "3.0.2"
      },
      {
        "model": "safari beta for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "3.0.1"
      },
      {
        "model": "safari beta",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "3.0.1"
      },
      {
        "model": "safari beta for windows",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "3"
      },
      {
        "model": "safari beta",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "3"
      },
      {
        "model": "safari",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "3"
      },
      {
        "model": "mac os server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.4.10"
      },
      {
        "model": "mac os server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.4.9"
      },
      {
        "model": "mac os server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.4.8"
      },
      {
        "model": "mac os server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.4.7"
      },
      {
        "model": "mac os server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.4.6"
      },
      {
        "model": "mac os server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.4.5"
      },
      {
        "model": "mac os server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.4.4"
      },
      {
        "model": "mac os server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.4.3"
      },
      {
        "model": "mac os server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.4.2"
      },
      {
        "model": "mac os server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.4.1"
      },
      {
        "model": "mac os server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.4"
      },
      {
        "model": "mac os server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.3.9"
      },
      {
        "model": "mac os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.4.10"
      },
      {
        "model": "mac os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.4.9"
      },
      {
        "model": "mac os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.4.8"
      },
      {
        "model": "mac os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.4.7"
      },
      {
        "model": "mac os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.4.6"
      },
      {
        "model": "mac os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.4.5"
      },
      {
        "model": "mac os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.4.4"
      },
      {
        "model": "mac os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.4.3"
      },
      {
        "model": "mac os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.4.2"
      },
      {
        "model": "mac os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.4.1"
      },
      {
        "model": "mac os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.4"
      },
      {
        "model": "mac os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.3.9"
      },
      {
        "model": "safari",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "apple",
        "version": "3.1"
      },
      {
        "model": "mac os server",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.4.11"
      },
      {
        "model": "mac os",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.4.11"
      }
    ],
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#498105"
      },
      {
        "db": "BID",
        "id": "26444"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2007-000966"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200711-213"
      },
      {
        "db": "NVD",
        "id": "CVE-2007-4686"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/o:apple:mac_os_x",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:apple:mac_os_x_server",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2007-000966"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Mark TullJoel VinkDr Bob Lopez PhDMarko KarppinenPetteri KamppuriNikita ZhukJohan HenselmansSean Larsson",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200711-213"
      }
    ],
    "trust": 0.6
  },
  "cve": "CVE-2007-4686",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.2,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 3.9,
            "id": "CVE-2007-4686",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 1.8,
            "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.2,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 3.9,
            "id": "VHN-28048",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 0.1,
            "vectorString": "AV:L/AC:L/AU:N/C:C/I:C/A:C",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2007-4686",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "CARNEGIE MELLON",
            "id": "VU#498105",
            "trust": 0.8,
            "value": "7.76"
          },
          {
            "author": "NVD",
            "id": "CVE-2007-4686",
            "trust": 0.8,
            "value": "High"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-200711-213",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "VULHUB",
            "id": "VHN-28048",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#498105"
      },
      {
        "db": "VULHUB",
        "id": "VHN-28048"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2007-000966"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200711-213"
      },
      {
        "db": "NVD",
        "id": "CVE-2007-4686"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Integer signedness error in the ttioctl function in bsd/kern/tty.c in the xnu kernel in Apple Mac OS X 10.4 through 10.4.10 allows local users to cause a denial of service (system shutdown) or gain privileges via a crafted TIOCSETD ioctl request. Apple Mac OS X CoreText contains an uninitialized pointer vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Apple Mac OS X is prone to multiple security vulnerabilities. \nThese issues affect Mac OS X and various applications, including AppleRAID, CFFTP, CFNetwork, CoreFoundation, CoreText, kernel, remote_cmds, networking, NFS, NSURL, SecurityAgent, WebCore, and WebKit. \nAttackers may exploit these issues to execute arbitrary code, trigger denial-of-service conditions, escalate privileges, and potentially compromise vulnerable computers. \nApple Mac OS X 10.4.10 and prior versions are vulnerable to these issues. \n\n----------------------------------------------------------------------\n\n2003: 2,700 advisories published\n2004: 3,100 advisories published\n2005: 4,600 advisories published\n2006: 5,300 advisories published\n\nHow do you know which Secunia advisories are important to you?\n\nThe Secunia Vulnerability Intelligence Solutions allows you to filter\nand structure all the information you need, so you can address issues\neffectively. \n\n1) Multiple errors within the Adobe Flash Player plug-in can be\nexploited by malicious people to gain knowledge of sensitive\ninformation or compromise a user\u0027s system. \n\nFor more information:\nSA26027\n\n2) A null-pointer dereference error exists within AppleRAID when\nhandling disk images. This can be exploited to cause a system\nshutdown when a specially crafted disk image is mounted e.g. \nautomatically via Safari if the option \"Open \u0027safe\u0027 files after\ndownloading\" is enabled. \n\n3) An error in BIND can be exploited by malicious people to poison\nthe DNS cache. \n\nFor more information:\nSA26152\n\n4) An error in bzip2 can be exploited to cause a DoS (Denial of\nService). \n\nFor more information:\nSA15447\n\nThis also fixes a race condition when setting file permissions. \n\n5) An unspecified error in the implementation of FTP of CFNetwork can\nbe exploited by a malicious FTP server to cause the client to connect\nto other hosts by sending specially crafted replies to FTP PASV\n(passive) commands. \n\n6) An unspecified error exists in the validation of certificates\nwithin CFNetwork. This can be exploited via a Man-in-the-Middle\n(MitM) attack to spoof a web site with a trusted certificate. \n\n7) A null pointer dereference error in the CFNetwork framework can\nlead to an unexpected application termination when a vulnerable\napplication connects to a malicious server. \n\n8) A boundary error in CoreFoundation can be exploited to cause a\none-byte buffer overflow when a user is enticed to read a specially\ncrafted directory hierarchy. \n\nSuccessful exploitation allows execution of arbitrary code. \n\n9) An error exists in CoreText due to the use of an uninitialised\npointer and can be exploited to execute arbitrary code when a user is\ntricked into reading a specially crafted text. \n\n10) Some vulnerabilities in Kerberos can be exploited by malicious\nusers and malicious people to compromise a vulnerable system. \n\nSuccessful exploitation requires permission to execute a setuid\nbinary. \n\n12) An unspecified error in the  Kernel can be exploited to bypass\nthe chroot mechanism by changing the working directory using a\nrelative path. \n\n14) An error exists in the handling of standard file descriptors\nwhile executing setuid and setgid programs. This can be exploited by\nmalicious, local users to gain system privileges by executing setuid\nprograms with the standard file descriptors in an unexpected state. \n\n15) An integer overflow exists in the Kernel when handling ioctl\nrequests. This can be exploited to execute arbitrary code with system\nprivileges by sending a specially crafted ioctl request. \n\n16) The default configuration of tftpd allows clients to access any\npath on the system. \n\n17) An error in the Node Information Query mechanism may allow a\nremote user to query for all addresses of a host, including\nlink-local addresses. \n\n18) An integer overflow exists in the handling of ASP messages with\nAppleTalk. This can be exploited by malicious, local users to cause a\nheap-based buffer overflow and to execute arbitrary code with system\nprivileges by sending a maliciously crafted ASP message on an\nAppleTalk socket. \n\n20) A boundary error exists when adding a new AppleTalk zone. This\ncan be exploited to cause a stack-based buffer overflow by sending a\nmaliciously crafted ioctl request to an AppleTalk socket and allows\nexecution of arbitrary code with system privileges. \n\n21) An arithmetic error exists in AppleTalk when handling memory\nallocations. \n\n22) A double free error in NFS exists when processing an AUTH_UNIX\nRPC call. This can be exploited by malicious people to execute\narbitrary code by sending a maliciously crafted AUTH_UNIX RPC call\nvia TCP or UDP. \n\n23) An unspecified case-sensitivity error exists in NSURL when\ndetermining if a URL references the local file system. \n\n24) A format string error in Safari can be exploited by malicious\npeople to execute arbitrary code when a user is tricked into opening\na .download file with a specially crafted name. \n\n25) An implementation error exists in the tabbed browsing feature of\nSafari. If HTTP authentication is used by a site being loaded in a\ntab other than the active tab, an authentication sheet may be\ndisplayed although the tab and its corresponding page are not\nvisible. \n\n26) A person with physical access to a system may be able to bypass\nthe screen saver authentication dialog by sending keystrokes to a\nprocess running behind the screen saver authentication dialog. \n\n27) Safari does not block \"file://\" URLs when loading resources. This\ncan be exploited to view the content of local files by enticing a user\nto visit a specially crafted web page. \n\n28) An input validation error exists in WebCore when handling HTML\nforms. This can be exploited to alter the values of form fields by\nenticing a user to upload a specially crafted file. \n\n29) A race condition error exists in Safari when handling page\ntransitions. This can be exploited to obtain information entered in\nforms on other web sites by enticing a user to visit a malicious web\npage. \n\n30) An unspecified error exists in the handling of the browser\u0027s\nhistory. This can be exploited to execute arbitrary code by enticing\na user to visit a specially crafted web page. \n\n31) An error in Safari allows malicious websites to set Javascript\nwindow properties of websites served from a different domain. This\ncan be exploited to get or set the window status and location of\npages served from other websites by enticing a user to visit a\nspecially crafted web page. \n\n32) An error in Safari allows a malicious website to bypass the same\norigin policy by hosting embedded objects with javascript URLs. This\ncan be exploited to execute arbitrary HTML and script code in context\nof another site by enticing a user to visit a specially crafted web\npage. \n\n33) An error in Safari allows content served over HTTP to alter or\naccess content served over HTTPS in the same domain. This can be\nexploited to execute Javascript code in context of HTTPS web pages in\nthat domain when a user visits a malicious web page. \n\n34) An error in Safari in the handling of new browser windows can be\nexploited to disclose the URL of an unrelated page. \n\nFor more information see vulnerability #2 in:\nSA23893\n\n35) An error in WebKit may allow unauthorised applications to access\nprivate keys added to the keychain by Safari. \n\n36) An unspecified error in Safari may allow a malicious website to\nsend remotely specified data to arbitrary TCP ports. \n\n37) WebKit/Safari creates temporary files insecurely when previewing\na PDF file, which may allow a local user to access the file\u0027s\ncontent. \n5) The vendor credits Dr Bob Lopez PhD. \n6) The vendor credits Marko Karppinen, Petteri Kamppuri, and Nikita\nZhuk of MK\u0026C. \n9) Will Dormann, CERT/CC\n11) An anonymous person, reported via iDefense Labs. \n12) The vendor credits Johan Henselmans and Jesper Skov. \n13) The vendor credits RISE Security. \n14) The vendor credits Ilja van Sprundel. \n15) The vendor credits Tobias Klein, www.trapkit.de\n16) The vendor credits James P. Javery, Stratus Data Systems\n17) The vendor credits Arnaud Ebalard, EADS Innovation Works. \n18, 21) Sean Larsson, iDefense Labs\n19) The vendor credits Bhavesh Davda of VMware and Brian \"chort\"\nKeefer of Tumbleweed Communications. \n20) An anonymous person, reported via iDefense Labs. \n22) The vendor credits Alan Newson of NGSSoftware, and Renaud\nDeraison of Tenable Network Security, Inc. \n25) The vendor credits Michael Roitzsch, Technical University\nDresden. \n26) The vendor credits Faisal N. Jawdat\n27) The vendor credits lixlpixel. \n28) The vendor credits Bodo Ruskamp, Itchigo Communications GmbH. \n29) The vendor credits Ryan Grisso, NetSuite. \n30) The vendor credits David Bloom. \n31, 32) The vendor credits Michal Zalewski,  Google Inc. \n33) The vendor credits Keigo Yamazaki of LAC Co. \n36) The vendor credits Kostas G. Anagnostakis, Institute for Infocomm\nResearch and Spiros Antonatos, FORTH-ICS\n37) The vendor credits Jean-Luc Giraud, and Moritz Borgmann of ETH\nZurich. \n\nORIGINAL ADVISORY:\nApple:\nhttp://docs.info.apple.com/article.html?artnum=307041\n\nUS-CERT VU#498105:\nhttp://www.kb.cert.org/vuls/id/498105\n\niDefense Labs:\nhttp://labs.idefense.com/intelligence/vulnerabilities/display.php?id=630\nhttp://labs.idefense.com/intelligence/vulnerabilities/display.php?id=629\nhttp://labs.idefense.com/intelligence/vulnerabilities/display.php?id=627\nhttp://labs.idefense.com/intelligence/vulnerabilities/display.php?id=628\n\nOTHER REFERENCES:\nSA15447:\nhttp://secunia.com/advisories/15447/\n\nSA23893:\nhttp://secunia.com/advisories/23893/\n\nSA26027:\nhttp://secunia.com/advisories/26027/\n\nSA26152:\nhttp://secunia.com/advisories/26152/\n\nSA26676:\nhttp://secunia.com/advisories/26676/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. \n\n\nI. Further\n   details are available in the related vulnerability notes. \n\n\nII. Impact\n\n   The impacts of these vulnerabilities vary. Potential consequences\n   include remote execution of arbitrary code or commands, bypass of\n   security restrictions, and denial of service. \n\n\nIII. This and\n   other updates are available via Apple Update or via Apple Downloads. \n\n\nIV. Please send\n   email to \u003ccert@cert.org\u003e with \"TA07-319A Feedback VU#498105\" in the\n   subject. \n ____________________________________________________________________\n\n   For instructions on subscribing to or unsubscribing from this\n   mailing list, visit \u003chttp://www.us-cert.gov/cas/signup.html\u003e. \n ____________________________________________________________________\n\n   Produced 2007 by US-CERT, a government organization. \n\n   Terms of use:\n\n     \u003chttp://www.us-cert.gov/legal.html\u003e\n ____________________________________________________________________\n\n\nRevision History\n\n   November 15, 2007: Initial release\n\n\n\n\n\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.2.1 (GNU/Linux)\n\niQEVAwUBRzx7ZvRFkHkM87XOAQJfIQgAmTZfjJAY/QTweUmvZtOJ9JQ4e/Gj0sE9\nOPSrK/SplP92WUL1Ucb8I/VUSQEXXJhNv9dTCMcy7IMpqhx4UxPA6fBKWDJ+nUFi\nsx/60EOAiIVW+yYK79VdoI1jrSs48E+CNdqEJCQcjUCVi29eGAdW63H2jOZV37/F\n4iQBZYRqhiycZ9FS+S+9aRfMhfy8dEOr1UwIElq6X/tSwss1EKFSNrK5ktGifUtB\nAJ+LJVBt2yZOIApcGhsxC3LYUDrDfhqGLIVM2XBc1yuV7Y2gaH4g9Txe+fWK79X2\nLYHvhv2xtgLweR12YC+0hT60wSdrDTM6ZW0//ny25LZ7Y7D46ogSWQ==\n=AgEr\n-----END PGP SIGNATURE-----\n. \n\n\n======================\nTechnical description:\n======================\n\nKernel source file: bsd/kern/tty.c \n(from http://www.opensource.apple.com/darwinsource/10.4.8.x86/xnu-792.13.8/)\n\n 822 int\n 823 ttioctl(register struct tty *tp,\n 824         u_long cmd, caddr_t data, int flag,\n 825         struct proc *p)\n 826 {       \n\n[...]\n\n1085            bcopy(t-\u003ec_cc, tp-\u003et_cc, sizeof(t-\u003ec_cc));\n1086            splx(s);\n1087            break;\n1088    }\n1089    case TIOCSETD: {                /* set line discipline */\n1090           register int t = *(int *)data;   \u003c--- (1)\n1091           dev_t device = tp-\u003et_dev;\n1092 \n1093           if (t \u003e= nlinesw)   \u003c--- (2)\n1094                   return (ENXIO);\n1095           if (t != tp-\u003et_line) {\n1096                   s = spltty();\n1097                   (*linesw[tp-\u003et_line].l_close)(tp, flag);\n1098                   error = (*linesw[t].l_open)(device, tp); \u003c--- (3)\n1099                   if (error) {\n1100                         (void)(*linesw[tp-\u003et_line].l_open)(device, tp);\n1101                          splx(s);\n1102                          return (error);\n1103                   }\n1104                   tp-\u003et_line = t;\n1105                   splx(s);\n1106          }\n1107          break;\n1108    }\n\nIn line 1090 the user supplied \"data\" of the type caddr_t (char *) gets \nstored in the variable \"t\" of the type signed int (see (1)). Then in line \n1093 the value of \"t\" is compared with \"nlinesw\". As \"data\" is supplied \nby the user it is possible to provide a string value \u003e= 0x80000000. If so, \n\"t\" gets a negative value due to the type conversion error (see (1)) and \nthe check in line 1093 will always be passed (see (2)). In line 1098 the user \nsupplied value \"t\" is used to reference and call \"l_open\". This leads to full \ncontrol of the kernel execution flow. \n\nCorresponding assembler code snippet:\n\n__text:00356C08 loc_356C08:    \n__text:00356C08    mov     eax, [ebp+arg_8]\n__text:00356C0B    mov     ebx, [eax] \u003c--- (1)\n__text:00356C0D    mov     edx, [ebp+arg_0]                       \n__text:00356C10    mov     edx, [edx+64h]                       \n__text:00356C13    mov     [ebp+var_58], edx                         \n__text:00356C16    cmp     ebx, ds:457880h \u003c--- (2)\n__text:00356C1C    jl      short loc_356C28\n__text:00356C1E    mov     esi, 6                       \n__text:00356C23    jmp     loc_356F70                                 \n__text:00356C28 ; --------------------------------\n__text:00356C28\n__text:00356C28 loc_356C28:                        \n__text:00356C28    mov     ecx, [ebp+arg_0]                         \n__text:00356C2B    cmp     ebx, [ecx+60h]                             \n__text:00356C2E    jz      loc_356633                                \n__text:00356C34    call    _spltty                               \n__text:00356C39    mov     edi, eax                       \n__text:00356C3B    mov     esi, [ebp+arg_0]                         \n__text:00356C3E    mov     eax, [esi+60h]                                 \n__text:00356C41    shl     eax, 5                       \n__text:00356C44    mov     edx, [ebp+arg_C]                 \n__text:00356C47    mov     [esp+0B8h+var_B4], edx                 \n__text:00356C4B    mov     [esp+0B8h+var_B8], esi                     \n__text:00356C4E    call    ds:off_4578A4[eax]\n__text:00356C54    mov     eax, ebx    \u003c--- (3)\n__text:00356C56    shl     eax, 5      \u003c--- (4)\n__text:00356C59    mov     [esp+0B8h+var_B4], esi\n__text:00356C5D    mov     ecx, [ebp+var_58]\n__text:00356C60    mov     [esp+0B8h+var_B8], ecx\n__text:00356C63    call    ds:_linesw[eax]   \u003c--- (5)\n\n(1) The user supplied data is copied into EBX \n(2) EBX is compared with nlinesw \n(3) The user supplied data in EBX is copied into EAX\n(4) Slightly modification of EAX\n(5) The user supplied value in EAX is used as a reference in this call\n\n\n=================\nProof of Concept:\n=================\n\nDue to the severity of this issue no proof of concept exploit code \nwill be released. \n  \n  http://www.apple.com/support/downloads/\n  \n\n======== \nHistory: \n========\n\n  2007/03/19 - Vendor notified\n  2007/03/19 - Automated reply from vendor\n  2007/03/26 - Vendor asks for more details\n  2007/04/01 - Provided vendor with more details\n  2007/04/04 - Status update from vendor\n  2007/04/06 - Vendor confirms the vulnerability\n  2007/05/11 - Status update request\n  2007/06/22 - Status update from vendor \n  2007/11/14 - Update released by the vendor \n  2007/11/15 - Full technical details released to general \n               public\n\n\n======== \nCredits: \n========\n\n  Vulnerability found and advisory written by Tobias Klein. \n\n\n=========== \nReferences: \n===========\n\n  [1] http://docs.info.apple.com/article.html?artnum=307041\n  [2] http://www.trapkit.de/advisories/TKADV2007-001.txt\n\n\n======== \nChanges: \n========\n\n  Revision 0.1 - Initial draft release to the vendor\n  Revision 1.0 - Public release\n  \n\n===========\nDisclaimer:\n===========\n\nThe information within this advisory may change without notice. Use\nof this information constitutes acceptance for use in an AS IS\ncondition. There are no warranties, implied or express, with regard\nto this information. In no event shall the author be liable for any\ndirect or indirect damages whatsoever arising out of or in connection\nwith the use or spread of this information. Any use of this\ninformation is at the user\u0027s own risk. \n\n\n================== \nPGP Signature Key: \n==================\n\n  http://www.trapkit.de/advisories/tk-advisories-signature-key.asc\n\n  \nCopyright 2007 Tobias Klein. All rights reserved",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2007-4686"
      },
      {
        "db": "CERT/CC",
        "id": "VU#498105"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2007-000966"
      },
      {
        "db": "BID",
        "id": "26444"
      },
      {
        "db": "VULHUB",
        "id": "VHN-28048"
      },
      {
        "db": "PACKETSTORM",
        "id": "60958"
      },
      {
        "db": "PACKETSTORM",
        "id": "60987"
      },
      {
        "db": "PACKETSTORM",
        "id": "60988"
      }
    ],
    "trust": 2.97
  },
  "exploit_availability": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "reference": "https://www.scap.org.cn/vuln/vhn-28048",
        "trust": 0.1,
        "type": "unknown"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-28048"
      }
    ]
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "SECUNIA",
        "id": "27643",
        "trust": 3.5
      },
      {
        "db": "NVD",
        "id": "CVE-2007-4686",
        "trust": 2.9
      },
      {
        "db": "BID",
        "id": "26444",
        "trust": 2.8
      },
      {
        "db": "USCERT",
        "id": "TA07-319A",
        "trust": 2.6
      },
      {
        "db": "SECTRACK",
        "id": "1018950",
        "trust": 2.5
      },
      {
        "db": "VUPEN",
        "id": "ADV-2007-3868",
        "trust": 1.7
      },
      {
        "db": "XF",
        "id": "38470",
        "trust": 1.4
      },
      {
        "db": "CERT/CC",
        "id": "VU#498105",
        "trust": 1.2
      },
      {
        "db": "USCERT",
        "id": "SA07-319A",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2007-000966",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200711-213",
        "trust": 0.7
      },
      {
        "db": "BUGTRAQ",
        "id": "20071115 [TKADV2007-001] MAC OS X TIOCSETD IOCTL KERNEL MEMORY CORRUPTION VULNERABILITY",
        "trust": 0.6
      },
      {
        "db": "APPLE",
        "id": "APPLE-SA-2007-11-14",
        "trust": 0.6
      },
      {
        "db": "CERT/CC",
        "id": "TA07-319A",
        "trust": 0.6
      },
      {
        "db": "PACKETSTORM",
        "id": "60988",
        "trust": 0.2
      },
      {
        "db": "VULHUB",
        "id": "VHN-28048",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "60958",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "60987",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#498105"
      },
      {
        "db": "VULHUB",
        "id": "VHN-28048"
      },
      {
        "db": "BID",
        "id": "26444"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2007-000966"
      },
      {
        "db": "PACKETSTORM",
        "id": "60958"
      },
      {
        "db": "PACKETSTORM",
        "id": "60987"
      },
      {
        "db": "PACKETSTORM",
        "id": "60988"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200711-213"
      },
      {
        "db": "NVD",
        "id": "CVE-2007-4686"
      }
    ]
  },
  "id": "VAR-200711-0326",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-28048"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2025-04-10T19:54:50.485000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Security Update 2007-008",
        "trust": 0.8,
        "url": "http://docs.info.apple.com/article.html?artnum=307041-en"
      },
      {
        "title": "Security Update 2007-008",
        "trust": 0.8,
        "url": "http://docs.info.apple.com/article.html?artnum=307041-ja"
      },
      {
        "title": "TA07-319A",
        "trust": 0.8,
        "url": "http://software.fujitsu.com/jp/security/vulnerabilities/ta07-319a.html"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2007-000966"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-189",
        "trust": 1.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-28048"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2007-000966"
      },
      {
        "db": "NVD",
        "id": "CVE-2007-4686"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 3.0,
        "url": "http://docs.info.apple.com/article.html?artnum=307041"
      },
      {
        "trust": 2.5,
        "url": "http://www.securityfocus.com/bid/26444"
      },
      {
        "trust": 2.5,
        "url": "http://www.us-cert.gov/cas/techalerts/ta07-319a.html"
      },
      {
        "trust": 2.5,
        "url": "http://securitytracker.com/id?1018950"
      },
      {
        "trust": 2.5,
        "url": "http://secunia.com/advisories/27643"
      },
      {
        "trust": 2.1,
        "url": "http://www.trapkit.de/advisories/tkadv2007-001.txt"
      },
      {
        "trust": 1.7,
        "url": "http://lists.apple.com/archives/security-announce/2007/nov/msg00002.html"
      },
      {
        "trust": 1.4,
        "url": "http://www.frsirt.com/english/advisories/2007/3868"
      },
      {
        "trust": 1.4,
        "url": "http://xforce.iss.net/xforce/xfdb/38470"
      },
      {
        "trust": 1.1,
        "url": "http://www.securityfocus.com/archive/1/483753/100/200/threaded"
      },
      {
        "trust": 1.1,
        "url": "http://www.vupen.com/english/advisories/2007/3868"
      },
      {
        "trust": 1.1,
        "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38470"
      },
      {
        "trust": 0.9,
        "url": "http://secunia.com/advisories/27643/"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2007-4686"
      },
      {
        "trust": 0.8,
        "url": "http://jvn.jp/cert/jvnta07-319a/index.html"
      },
      {
        "trust": 0.8,
        "url": "http://jvn.jp/tr/trta07-319a/index.html"
      },
      {
        "trust": 0.8,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2007-4686"
      },
      {
        "trust": 0.8,
        "url": "http://www.us-cert.gov/cas/alerts/sa07-319a.html"
      },
      {
        "trust": 0.6,
        "url": "http://www.securityfocus.com/archive/1/archive/1/483753/100/200/threaded"
      },
      {
        "trust": 0.4,
        "url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=629"
      },
      {
        "trust": 0.4,
        "url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=628"
      },
      {
        "trust": 0.4,
        "url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=627"
      },
      {
        "trust": 0.4,
        "url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=630"
      },
      {
        "trust": 0.4,
        "url": "http://www.kb.cert.org/vuls/id/498105"
      },
      {
        "trust": 0.3,
        "url": "http://www.apple.com/macosx/"
      },
      {
        "trust": 0.3,
        "url": "/archive/1/483793"
      },
      {
        "trust": 0.3,
        "url": "/archive/1/483753"
      },
      {
        "trust": 0.3,
        "url": "/archive/1/483735"
      },
      {
        "trust": 0.3,
        "url": "/archive/1/483736"
      },
      {
        "trust": 0.3,
        "url": "/archive/1/483738"
      },
      {
        "trust": 0.3,
        "url": "/archive/1/483737"
      },
      {
        "trust": 0.3,
        "url": "http://docs.info.apple.com/article.html?artnum=307563"
      },
      {
        "trust": 0.3,
        "url": "http://risesecurity.org/advisory/rise-2007004/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/advisories/26027/"
      },
      {
        "trust": 0.1,
        "url": "https://www.trapkit.de"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/advisories/23893/"
      },
      {
        "trust": 0.1,
        "url": "http://www.apple.com/support/downloads/macosx10411comboupdateppc.html"
      },
      {
        "trust": 0.1,
        "url": "http://corporate.secunia.com/how_to_buy/38/vi/?ref=secadv"
      },
      {
        "trust": 0.1,
        "url": "http://www.apple.com/support/downloads/macosxserver10411comboupdateppc.html"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
      },
      {
        "trust": 0.1,
        "url": "http://www.apple.com/support/downloads/macosxserver10411updateppc.html"
      },
      {
        "trust": 0.1,
        "url": "http://www.apple.com/support/downloads/macosx10411comboupdateintel.html"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/advisories/26676/"
      },
      {
        "trust": 0.1,
        "url": "http://www.apple.com/support/downloads/macosx10411updateintel.html"
      },
      {
        "trust": 0.1,
        "url": "http://www.apple.com/support/downloads/macosxserver10411comboupdateuniversal.html"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/advisories/15447/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/about_secunia_advisories/"
      },
      {
        "trust": 0.1,
        "url": "http://www.apple.com/support/downloads/macosx10411updateppc.html"
      },
      {
        "trust": 0.1,
        "url": "http://www.apple.com/support/downloads/securityupdate20070081039server.html"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/secunia_security_advisories/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/advisories/26152/"
      },
      {
        "trust": 0.1,
        "url": "http://www.apple.com/support/downloads/securityupdate20070081039client.html"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/product/96/"
      },
      {
        "trust": 0.1,
        "url": "http://www.isc.org/sw/bind/\u003e"
      },
      {
        "trust": 0.1,
        "url": "http://www.adobe.com/products/flashplayer/\u003e"
      },
      {
        "trust": 0.1,
        "url": "http://www.us-cert.gov/cas/techalerts/ta07-319a.html\u003e"
      },
      {
        "trust": 0.1,
        "url": "http://www.kb.cert.org/vuls/byid?searchview\u0026query=apple_2007_008\u003e"
      },
      {
        "trust": 0.1,
        "url": "http://docs.info.apple.com/article.html?artnum=307041\u003e"
      },
      {
        "trust": 0.1,
        "url": "http://www.bzip.org/\u003e"
      },
      {
        "trust": 0.1,
        "url": "http://web.mit.edu/kerberos/\u003e"
      },
      {
        "trust": 0.1,
        "url": "http://www.apple.com/support/downloads/\u003e"
      },
      {
        "trust": 0.1,
        "url": "http://docs.info.apple.com/article.html?artnum=106704\u003e"
      },
      {
        "trust": 0.1,
        "url": "http://www.us-cert.gov/cas/signup.html\u003e."
      },
      {
        "trust": 0.1,
        "url": "http://www.us-cert.gov/legal.html\u003e"
      },
      {
        "trust": 0.1,
        "url": "http://www.apple.com"
      },
      {
        "trust": 0.1,
        "url": "http://www.apple.com/support/downloads/"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2007-4686"
      },
      {
        "trust": 0.1,
        "url": "http://www.trapkit.de/advisories/tk-advisories-signature-key.asc"
      },
      {
        "trust": 0.1,
        "url": "http://www.opensource.apple.com/darwinsource/10.4.8.x86/xnu-792.13.8/)"
      }
    ],
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#498105"
      },
      {
        "db": "VULHUB",
        "id": "VHN-28048"
      },
      {
        "db": "BID",
        "id": "26444"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2007-000966"
      },
      {
        "db": "PACKETSTORM",
        "id": "60958"
      },
      {
        "db": "PACKETSTORM",
        "id": "60987"
      },
      {
        "db": "PACKETSTORM",
        "id": "60988"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200711-213"
      },
      {
        "db": "NVD",
        "id": "CVE-2007-4686"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "CERT/CC",
        "id": "VU#498105"
      },
      {
        "db": "VULHUB",
        "id": "VHN-28048"
      },
      {
        "db": "BID",
        "id": "26444"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2007-000966"
      },
      {
        "db": "PACKETSTORM",
        "id": "60958"
      },
      {
        "db": "PACKETSTORM",
        "id": "60987"
      },
      {
        "db": "PACKETSTORM",
        "id": "60988"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200711-213"
      },
      {
        "db": "NVD",
        "id": "CVE-2007-4686"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2007-11-14T00:00:00",
        "db": "CERT/CC",
        "id": "VU#498105"
      },
      {
        "date": "2007-11-15T00:00:00",
        "db": "VULHUB",
        "id": "VHN-28048"
      },
      {
        "date": "2007-11-14T00:00:00",
        "db": "BID",
        "id": "26444"
      },
      {
        "date": "2007-12-05T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2007-000966"
      },
      {
        "date": "2007-11-16T07:06:08",
        "db": "PACKETSTORM",
        "id": "60958"
      },
      {
        "date": "2007-11-16T07:24:07",
        "db": "PACKETSTORM",
        "id": "60987"
      },
      {
        "date": "2007-11-16T07:37:22",
        "db": "PACKETSTORM",
        "id": "60988"
      },
      {
        "date": "2005-04-01T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-200711-213"
      },
      {
        "date": "2007-11-15T01:46:00",
        "db": "NVD",
        "id": "CVE-2007-4686"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2007-11-15T00:00:00",
        "db": "CERT/CC",
        "id": "VU#498105"
      },
      {
        "date": "2018-10-15T00:00:00",
        "db": "VULHUB",
        "id": "VHN-28048"
      },
      {
        "date": "2016-07-05T21:38:00",
        "db": "BID",
        "id": "26444"
      },
      {
        "date": "2007-12-05T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2007-000966"
      },
      {
        "date": "2007-11-15T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-200711-213"
      },
      {
        "date": "2025-04-09T00:30:58.490000",
        "db": "NVD",
        "id": "CVE-2007-4686"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "local",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200711-213"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Apple Mac OS X CoreText uninitialized pointer vulnerability",
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#498105"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "digital error",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200711-213"
      }
    ],
    "trust": 0.6
  }
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2007-4686 (GCVE-0-2007-4686)

CERTA-2007-AVI-499

Description

Solution

FKIE_CVE-2007-4686

GHSA-MGQG-9G67-QVCC

GSD-2007-4686

VAR-200711-0326

Tags

Sightings

Nomenclature

Related by attack behaviour