CVE-2014-9862

Published: 22/07/2016 Updated: 17/09/2020

CVSS v2 Base Score: 7.2 | Impact Score: 10 | Exploitability Score: 3.9

CVSS v3 Base Score: 7.8 | Impact Score: 5.9 | Exploitability Score: 1.8

VMScore: 642

Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C

Integer signedness error in bspatch.c in bspatch in bsdiff, as used in Apple OS X prior to 10.11.6 and other products, allows remote malicious users to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via a crafted patch file.

Vulnerable Product	Search on Vulmon	Subscribe to Product
apple mac os x

Portable binary diff/patch library based on the binary diff/patch utilities bsdiff/bspatch

Binary diff/patch library (bsdifflib/bspatchlib) 12 is based on the original binary diff/patch utility (bsdiff/bspatch) by Colin Percival and the Win32 port by Andreas John Binary diff/patch library adds an API to make it usable as a cross-platform C/C++ library This library generates patches that are compatible with the original bsdiff tool The patch routine now works on m

Binary diff/patch utility

bsdiff 431 This is based on the source code of bsdiff 43 (and bspatch 43), from daemonology : wwwdaemonologynet/bsdiff/ The folloowing debian patches have been applyed : 10-no-bsd-makepatch 20-CVE-2014-9862patch 30-bug-632585-mmap-src-file-instead-of-malloc-read-itpatch 31-bug-632585-mmap-dst-file-instead-of-malloc-read-itpatch 32-bug-632585-use-int32_t-inste

CWE-190 https://android.googlesource.com/platform/external/bsdiff/+/4d054795b673855e3a7556c6f2f7ab99ca509998 https://chromium.googlesource.com/chromiumos/third_party/bsdiff/+/d0307d1711bd74e51b783a49f9160775aa22e659 http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html https://support.apple.com/HT206903 https://bugs.chromium.org/p/chromium/issues/detail?id=372525 https://security.FreeBSD.org/advisories/FreeBSD-SA-16:25.bspatch.asc http://www.securityfocus.com/bid/91824 http://lists.opensuse.org/opensuse-updates/2016-08/msg00026.html http://www.securitytracker.com/id/1036438 https://lists.debian.org/debian-lts-announce/2019/11/msg00028.html https://security.gentoo.org/glsa/202003-44 http://www.openwall.com/lists/oss-security/2020/07/09/2 http://seclists.org/fulldisclosure/2020/Jul/8 https://usn.ubuntu.com/4500-1/https://nvd.nist.gov http://seclists.org/fulldisclosure/2020/Jul/8 https://github.com/petervas/bsdifflib

CVE-2014-9862

Vulnerability Summary

Vulnerability Trend

Mailing Lists

Github Repositories

References

Vulmon Search

About

Products

Connect