Overview
Apple's ImageIO framework contains an memory corruption vulnerability that may allow an attacker to execute code on a vulnerable system.
Description
The RAW Image file format is a popular image format supported by many Apple Mac OS X applications. The ImageIO framework allows applications to read and write various image file formats, including RAW. From Apple Security Update 2007-003: |
Impact
A remote unauthenticated attacker may be able to execute arbitrary code or cause a denial-of-service condition. The specially crafted RAW file used to exploit this vulnerability may be supplied on a web page, as an email attachment or inside an email, or by some other means to convince the user into opening the malicious file. |
Solution
Upgrade Apple has published Mac OS X 10.4.9 for Mac OS X 10.4 (Tiger) systems and Security Update 2007-003 for Mac OS X 10.3 (Panther) systems in response to this issue. See Apple Security Update 2007-003 for more details. |
Vendor Information
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | ||
| Temporal | ||
| Environmental |
References
Acknowledgements
Apple credits Luke Church of the Computer Laboratory, University of Cambridge, for reporting this issue.
This document was written by Ryan Giobbi.
Other Information
| CVE IDs: | CVE-2007-0733 |
| Severity Metric: | 3.08 |
| Date Public: | 2007-03-13 |
| Date First Published: | 2007-03-14 |
| Date Last Updated: | 2007-03-15 19:30 UTC |
| Document Revision: | 19 |