CVE-2008-2320 Stack-based buffer overflow in CarbonCore in Apple Mac OS X 10.4.11 and 10.5.4, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows context-dependent attackers to execut...
HighCVSS 9.3
EPSS 3.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Stack-based buffer overflow in CarbonCore in Apple Mac OS X 10.4.11 and 10.5.4, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via a long filename to the file management API.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apple carboncore | All versions | No fix listed |
References
- APPLE-SA-2008-07-31 patch vendor-advisory
- APPLE-SA-2009-06-17-1 patch vendor-advisory
- APPLE-SA-2009-06-08-1 patch vendor-advisory
- 31326 third-party-advisory vendor-advisory
- 35379 third-party-advisory vendor-advisory
- support.apple.com patch vendor-advisory
- support.apple.com patch vendor-advisory
- 20080801 n.runs-SA-2008.005 - Apple Inc. - CoreServices Frameworkâ??s CarbonCore Framework - Arbitrary Code Execution (remote) mailing-list
- 30483 patch vdb-entry
- 30487 patch vdb-entry
- 1020602 vdb-entry
- ADV-2008-2268 vdb-entry vendor-advisory
- ADV-2009-1522 patch vdb-entry vendor-advisory
- ADV-2009-1621 patch vdb-entry vendor-advisory
- macosx-carboncore-bo(44126) vdb-entry