CVE

Id
71687  
CVE No.
CVE-2014-4391  
Status
Candidate  
Description
The Code Signing feature in Apple OS X before 10.10 does not properly handle incomplete resource envelopes in signed bundles, which allows remote attackers to bypass intended app-author restrictions by omitting an execution-related resource.  
Phase
Assigned (20140620)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
681089 71687 CVE-2014-4391 CONFIRM:https://support.apple.com/kb/HT6535  View
681090 71687 CVE-2014-4391 APPLE:APPLE-SA-2014-10-16-1  View
681091 71687 CVE-2014-4391 URL:http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html  View
681092 71687 CVE-2014-4391 BID:70637  View
681093 71687 CVE-2014-4391 URL:http://www.securityfocus.com/bid/70637  View
681094 71687 CVE-2014-4391 SECTRACK:1031063  View
681095 71687 CVE-2014-4391 URL:http://www.securitytracker.com/id/1031063  View
681096 71687 CVE-2014-4391 XF:macosx-cve20144391-sec-bypass(97644)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
15473 JVNDB-2014-004348 Apple OS X の Intel Graphics Driver のサブシステムにおける任意のコードを実行される脆弱性 Apple OS X の Intel Graphics Driver のサブシステム内の不特定のインテグレーテッドグラフィックドライバルーチンは、呼び出しを適切に検証しないため、特権付きコンテキスト内で任意のコードを実行される脆弱性が存在します。 CVE-2014-4399 71687 6.9 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-004348.html  View