CVE-2011-0170

Related Files

iDEFENSE Security Advisory 2011-03-02.1

Posted Mar 3, 2011

Authored by iDefense Labs | Site idefense.com

iDefense Security Advisory 03.02.11 - Remote exploitation of a heap memory corruption vulnerability in Apple Inc.'s CoreGraphics library could allow an attacker to execute arbitrary code with the privileges of the current user. This vulnerability occurs during the processing of an embedded International Color Consortium (ICC) profile within a JPEG image. A small block of heap memory may be allocated for processing certain profile data. An index value is used to reference locations within this heap block. The index value can be manipulated in a manner that results in multiple memory writes to locations outside the bounds of the heap allocated block. This condition may lead to arbitrary code execution.

tags | advisory, remote, arbitrary, code execution

systems | apple

advisories | CVE-2011-0170

SHA-256 | 5d8ce00016e6e084ef0137a0b05bd32f312d8df1e68e87c3acaed784c103df61

Download | Favorite | View