PT-2013-4758

CVE-2013-3953

Published

2013-06-05

Updated

2013-10-11

Description by

CVSS 2.0

4.9

Medium

MetricsAV:L/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apple Mac OS X version 10.8.x

Description The issue concerns the mach port space info function in the XNU kernel, which fails to initialize a certain structure member. This allows local users to obtain sensitive information from kernel heap memory by making a crafted call.

Recommendations For Apple Mac OS X version 10.8.x, update to a version that includes the fix for this issue to prevent local users from obtaining sensitive information from kernel heap memory.

Exploitability

Exploit

Fix

Impacts

Researchers

Stefan Esser

Vendors

Affected products

Weakness enumeration

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Related identifiers

CVE-2013-3953