CVE-2007-3749

HIGH 7.8

En bref

Source: NVD
EPSS: EPSS 0.45 % · centile 39 (2026-10-31)
État: PUBLISHED
Publiée: 2007-11-15 01:00 UTC
Mise à jour: 2024-08-07 14:28 UTC
Attribuée par: mitre
Statut NVD: Modified

Rechercher sur…

Description

The kernel in Apple Mac OS X 10.4 through 10.4.10 does not reset the current Mach Thread Port or Thread Exception Port when executing a setuid program, which allows local users to execute arbitrary code by creating the port before launching the setuid program, then writing to the address space of the setuid process.

Faiblesses (CWE)

CWE-665 — Initialisation incorrecte

Références

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	HIGH 7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	NVD · nvd@nist.gov (Primary)
CVSS 2.0	HIGH 7.2	AV:L/AC:L/Au:N/C:C/I:C/A:C	NVD · nvd@nist.gov (Primary)

Références européennes

ENISA EUVD · EUVD-2007-3733
GCVE · GCVE-0-2007-3749

Avis du CERT-FR

CERTA-2007-AVI-499 — Multiples vulnérabilités du système Mac OS X · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:* ≥ 10.4.0 ≤ 10.4.10

Produits affectés

Produit	Versions
	affected n/a

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

⚠️ CVE-2007-3749