CVE-2006-1471CWE-134

CVE-2006-1471

Medium · published June 28, 2006

CVSS v2.0
4.6
EPSS
0%
Percentile
33.4
In the wild
Unconfirmed
What it is

Format string vulnerability in the CF_syslog function launchd in Apple Mac OS X 10.4 up to 10.4.6 allows local users to execute arbitrary code via format string specifiers that are not properly handled in a syslog call in the logging facility, as demonstrated by using a crafted plist file.

The record
Technical detail
CVSS v2.0
4.6 · MEDIUM
Vector
AV:L/AC:L/Au:N/C:P/I:P/A:P
CVSS v4.0
Not supplied
EPSS
0.00403 · 33.4th percentile
Weakness
CWE-134 · Use of Externally-Controlled Format String
Published
2006-06-28T02:13Z
Affected products (14)
ProductVersionsFixed in
apple/mac_os_xall versions—
apple/mac_os_xall versions—
apple/mac_os_xall versions—
apple/mac_os_xall versions—
apple/mac_os_xall versions—
apple/mac_os_xall versions—
apple/mac_os_xall versions—
apple/mac_os_x_serverall versions—
apple/mac_os_x_serverall versions—
apple/mac_os_x_serverall versions—
apple/mac_os_x_serverall versions—
apple/mac_os_x_serverall versions—
apple/mac_os_x_serverall versions—
apple/mac_os_x_serverall versions—
References (18)
http://lists.apple.com/archives/security-announce/2006/Jun/msg00000.html · [email protected]http://secunia.com/advisories/20877 · [email protected]http://securitytracker.com/id?1016397 · [email protected]http://www.osvdb.org/26933 · [email protected]http://www.securityfocus.com/archive/1/438699/100/0/threaded · [email protected]http://www.securityfocus.com/bid/18686 · [email protected]http://www.securityfocus.com/bid/18724 · [email protected]http://www.vupen.com/english/advisories/2006/2566 · [email protected]https://exchange.xforce.ibmcloud.com/vulnerabilities/27479 · [email protected]http://lists.apple.com/archives/security-announce/2006/Jun/msg00000.html · af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/20877 · af854a3a-2127-422b-91ae-364da2661108http://securitytracker.com/id?1016397 · af854a3a-2127-422b-91ae-364da2661108http://www.osvdb.org/26933 · af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/438699/100/0/threaded · af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/18686 · af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/18724 · af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2006/2566 · af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/27479 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 27 JUN 22:00Z
    Format string vulnerability in the CF_syslog function launchd in Apple Mac OS X 10.4 up to 10.4.6 allows local users to execute arbitrary code via format…
    cvelistv5