PT-2016-2722

CVE-2016-4630

Published

2016-07-22

Updated

2017-09-01

Description by

CVSS 3.1

8.8

High

MetricsAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apple OS X versions prior to 10.11.6

Description The issue allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted EXR image with B44 compression. This is due to a buffer overflow in the ImageIO component.

Recommendations For versions prior to 10.11.6, update to version 10.11.6 or later to resolve the issue. As a temporary workaround, consider avoiding the use of B44 compression in EXR images until the update is applied.

Exploitability

Exploit

Fix

Impacts

Researchers

Tyler Bohan

Vendors

Affected products

Weakness enumeration

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

Related identifiers

CVE-2016-4630