Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2007-6165 — Improper Input Validation in Apple MAC OS X

CWE-20 — Improper Input Validation5 documents4 sources
Severity
9.3CRITICALNVD
EPSS
38.6%
top 2.75%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
Apple MAC OS X
Timeline
PublishedNov 29
Latest updateMay 1

Description

Mail in Apple Mac OS X Leopard (10.5.1) allows user-assisted remote attackers to execute arbitrary code via an AppleDouble attachment containing an apparently-safe file type and script in a resource fork, which does not warn the user that a separate program is going to be executed. NOTE: this is a regression error related to CVE-2006-0395.

CVSS vector

AV:N/AC:M/C:C/I:C/A:CExploitability: 8.6 | Impact: 10.0

Affected Packages1 packages

▶NVDapple/mac_os_x10.5

🔴Vulnerability Details

1
GHSA
GHSA-9gxh-58f6-h4hh: Mail in Apple Mac OS X Leopard (10↗2022-05-01
▶

💥Exploits & PoCs

3
Exploit-DB
Apple Mail.app - Image Attachment Command Execution (Metasploit)↗2011-03-05
▶
Exploit-DB
Apple Mac OSX 10.5.x - Mail Arbitrary Code Execution↗2007-11-20
▶
Metasploit
Mail.app Image Attachment Command Execution↗
▶