Overview
Apple Mac OS X CoreText contains a use-after-free vulnerability that may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system.
Description
Apple Mac OS X CoreText is a text layout and font processing engine that is used to handle embedded fonts.CoreText contains a use-after-free vulnerability that can allow arbitrary code execution. |
Impact
By convincing a user to open a document with a specially-crafted embedded font, a remote, unauthenticated attacker may be able to execute arbitrary code on a vulnerable system. |
Solution
Apply an update This issue is addressed in OS X Lion v10.7.3 and Security Update 2012-001. |
Vendor Information
410281
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | 9 | AV:N/AC:M/Au:N/C:C/I:C/A:P |
| Temporal | 7 | E:POC/RL:OF/RC:C |
| Environmental | 7 | CDP:ND/TD:ND/CR:ND/IR:ND/AR:ND |
References
Acknowledgements
This vulnerability was reported by Will Dormann of the CERT/CC.
This document was written by Will Dormann.
Other Information
| CVE IDs: | CVE-2011-3449 |
| Severity Metric: | 5.77 |
| Date Public: | 2012-02-02 |
| Date First Published: | 2012-02-02 |
| Date Last Updated: | 2012-03-28 14:54 UTC |
| Document Revision: | 7 |