Overview
Apple Mac OS X ATS contains a memory corruption vulnerability that may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system.
Description
Apple Mac OS X ATS (Apple Type Services) fails to properly handle malformed data-font (.dfont) files, resulting in memory corruption. |
Impact
By convincing a user to open a specially-crafted font in Font Book, a remote, unauthenticated attacker may be able to execute arbitrary code on a vulnerable system. |
Solution
Apply an update This issue is addressed in OS X Lion v10.7.3 and Security Update 2012-001. |
Vendor Information
403593
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | 9 | AV:N/AC:M/Au:N/C:C/I:C/A:P |
| Temporal | 7 | E:POC/RL:OF/RC:C |
| Environmental | 7 | CDP:ND/TD:ND/CR:ND/IR:ND/AR:ND |
References
Acknowledgements
This vulnerability was reported by Will Dormann of the CERT/CC.
This document was written by Will Dormann.
Other Information
| CVE IDs: | CVE-2011-3446 |
| Severity Metric: | 2.57 |
| Date Public: | 2012-02-02 |
| Date First Published: | 2012-02-02 |
| Date Last Updated: | 2012-03-28 14:53 UTC |
| Document Revision: | 20 |