CVE-2007-4268 — Incorrect Conversion between Numeric Types in Apple MAC OS X

CWE-681 — Incorrect Conversion between Numeric TypesCWE-788 — Access of Memory Location After End of BufferCWE-122 — Heap-based Buffer OverflowCWE-787 — Out-of-bounds WriteCWE-195 — Signed to Unsigned Conversion Error7 documents3 sources
Severity
7.8HIGHNVD
EPSS
0.7%
top 26.86%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Apple MAC OS X
Timeline
PublishedNov 15
Latest updateMay 1

Description

Integer signedness error in the Networking component in Apple Mac OS X 10.4 through 10.4.10 allows local users to execute arbitrary code via a crafted AppleTalk message with a negative value, which satisfies a signed comparison during mbuf allocation but is later interpreted as an unsigned value, which triggers a heap-based buffer overflow.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages1 packages

▶NVDapple/mac_os_x10.4.0 — 10.4.10

🔴Vulnerability Details

1
GHSA
GHSA-25vf-27mm-c4fh: Integer signedness error in the Networking component in Apple Mac OS X 10↗2022-05-01
▶

📐Framework References

5
CWE
Access of Memory Location After End of Buffer↗
▶
CWE
Heap-based Buffer Overflow↗
▶
CWE
Out-of-bounds Write↗
▶
CWE
Signed to Unsigned Conversion Error↗
▶
CWE
Incorrect Conversion between Numeric Types↗
▶