CVE-2013-5135 — Use of Externally-Controlled Format String in Apple Remote Desktop

CWE-134 — Use of Externally-Controlled Format String3 documents3 sources

Severity

7.5HIGHNVD

EPSS

3.0%

top 13.30%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Apple Remote Desktop Apple MAC OS X

Timeline

PublishedOct 24

Latest updateMay 14

Description

Format string vulnerability in Screen Sharing Server in Apple Mac OS X before 10.9 and Apple Remote Desktop before 3.5.4 allows remote attackers to execute arbitrary code via format string specifiers in a VNC username.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages2 packages

▶NVDapple/apple_remote_desktop3.5.3+12

▶NVDapple/mac_os_x10.8.5+6

🔴Vulnerability Details

GHSA

GHSA-8fr8-vc5w-ccvx: Format string vulnerability in Screen Sharing Server in Apple Mac OS X before 10↗2022-05-14

▶

CVEList

CVE-2013-5135: Format string vulnerability in Screen Sharing Server in Apple Mac OS X before 10↗2013-10-24

▶