CVE-2015-3762
published 2015-08-16CVE-2015-3762: The Text Formats component in Apple OS X before 10.10.5, as used in TextEdit, allows remote attackers to read arbitrary files via a text file containing an XML…
PriorityP430medium5CVSS 2.0
AVNACLAuNCPINAN
EPSS
2.14%
80.2th percentile
The Text Formats component in Apple OS X before 10.10.5, as used in TextEdit, allows remote attackers to read arbitrary files via a text file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | mac_os_x | <= 10.10.4 | — |
| apple | os_x_yosemite_v10.10.5_and_security_update_2015-006 | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Apple
CVE-2015-3762: OS X Yosemite v10.10.5 and Security Update 2015-006
vendor_apple·CVSS 5.0
CVE-2015-3762 [MEDIUM] CVE-2015-3762: OS X Yosemite v10.10.5 and Security Update 2015-006
Apple Security Update: About the security content of OS X Yosemite v10.10.5 and Security Update 2015-006
Product: OS X Yosemite v10.10.5 and Security Update 2015-006
CVE: CVE-2015-3762
Component: CVE-ID
Impact: Processing a maliciously crafted DMG file may lead to an unexpected application termination or arbitrary code execution with system privileges
Description: A memory corruption issue existed in parsing of malformed DMG images. This issue was addressed through improved memory handling.
GHSA
GHSA-cxwp-3qmp-2569: The Text Formats component in Apple OS X before 10
ghsa_unreviewed·2022-05-17
CVE-2015-3762 [MEDIUM] CWE-200 GHSA-cxwp-3qmp-2569: The Text Formats component in Apple OS X before 10
The Text Formats component in Apple OS X before 10.10.5, as used in TextEdit, allows remote attackers to read arbitrary files via a text file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.htmlhttp://www.securityfocus.com/bid/76340http://www.securitytracker.com/id/1033276https://support.apple.com/kb/HT205031http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.htmlhttp://www.securityfocus.com/bid/76340http://www.securitytracker.com/id/1033276https://support.apple.com/kb/HT205031
2015-08-16
Published