6.8

CVE-2009-0943

Help Viewer in Apple Mac OS X 10.4.11 and 10.5 before 10.5.7 does not verify that HTML pathnames are located in a registered help book, which allows remote attackers to execute arbitrary code via a help: URL that triggers invocation of AppleScript files.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Apple ≫ macOS X Version10.4.11
Apple ≫ macOS X Version10.5.0
Apple ≫ macOS X Version10.5.1
Apple ≫ macOS X Version10.5.2
Apple ≫ macOS X Version10.5.3
Apple ≫ macOS X Version10.5.4
Apple ≫ macOS X Version10.5.5
Apple ≫ macOS X Version10.5.6
Apple ≫ macOS X Server Version10.4.11
Apple ≫ macOS X Server Version10.5.0
Apple ≫ macOS X Server Version10.5.1
Apple ≫ macOS X Server Version10.5.2
Apple ≫ macOS X Server Version10.5.3
Apple ≫ macOS X Server Version10.5.4
Apple ≫ macOS X Server Version10.5.5
Apple ≫ macOS X Server Version10.5.6
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 4.19% 0.896
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
Patch
Vendor Advisory
http://secunia.com/advisories/35074
http://support.apple.com/kb/HT3549
Patch
Vendor Advisory
http://www.us-cert.gov/cas/techalerts/TA09-133A.html
US Government Resource
http://www.vupen.com/english/advisories/2009/1297
http://www.securityfocus.com/bid/34926
http://www.securitytracker.com/id?1022216
https://exchange.xforce.ibmcloud.com/vulnerabilities/50486