VulnerabilityModified
CVE-2012-3749
The extensions APIs in the kernel in Apple iOS before 6.0.1 provide kernel addresses in responses that contain an OSBundleMachOHeaders key, which makes it easier for remote attackers to bypass the ASLR protection mechanism via a crafted app.
MEDIUM 5.0EPSS 2.23%
Does this matter?
Lower severity and a low EPSS score (2.23%). Track it; it rarely justifies an emergency change on its own.
Description
The extensions APIs in the kernel in Apple iOS before 6.0.1 provide kernel addresses in responses that contain an OSBundleMachOHeaders key, which makes it easier for remote attackers to bypass the ASLR protection mechanism via a crafted app.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
- EPSS
- 2.23% probability · 82th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- apple/iphone os
- Source
- product-security@apple.com
References
- http://archives.neohapsis.com/archives/bugtraq/2012-11/0012.html
- http://lists.apple.com/archives/security-announce/2012/Nov/msg00000.htmlVendor Advisory
- http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html
- http://secunia.com/advisories/51445
- http://support.apple.com/kb/HT5567Vendor Advisory
- http://support.apple.com/kb/HT5598
- http://www.securityfocus.com/bid/56361
- http://archives.neohapsis.com/archives/bugtraq/2012-11/0012.html
- http://lists.apple.com/archives/security-announce/2012/Nov/msg00000.htmlVendor Advisory
- http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html
- http://secunia.com/advisories/51445
- http://support.apple.com/kb/HT5567Vendor Advisory
- http://support.apple.com/kb/HT5598
- http://www.securityfocus.com/bid/56361
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.