CVE-2014-7861
HighSummary
The IOHIDSecurePromptClient function in Apple OS X does not properly validate pointer values, allowing remote attackers to execute arbitrary code or cause a system crash via a crafted website.
Risk Assessment
Attackers can exploit this vulnerability to remotely take control of the system or cause it to crash, potentially leading to data loss and downtime for the organization.
Recommendation
It is recommended to update the operating system to the latest version to mitigate this vulnerability and implement additional security measures such as web content filtering.
Other vulnerabilities in Apple OS X
See all- CVE-2016-4647High
Audio in Apple OS X before 10.11.6 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted file.
- CVE-2016-4641High
The Login Window in Apple OS X before version 10.11.6 allows attackers to execute arbitrary code in a privileged context or obtain sensitive user information via a crafted app that leverages a 'type confusion.'
- CVE-2016-4640High
The Login Window in Apple OS X before version 10.11.6 allows attackers to execute arbitrary code in a privileged context, obtain sensitive user information, or cause a denial of service (memory corruption) via a crafted app.
- CVE-2016-4639High
The Login Window in Apple OS X before 10.11.6 does not properly initialize memory, allowing local users to cause a denial of service via unspecified vectors.
- CVE-2016-4638High
The Login Window in Apple OS X before version 10.11.6 allows attackers to gain privileges via a crafted app that leverages a 'type confusion.'
- CVE-2015-7052High
Kext tools in Apple OS X before 10.11.2 mishandle kernel-extension loading, allowing local users to gain privileges via unspecified vectors.
- CVE-2015-7044High
The System Integrity Protection feature in Apple OS X before 10.11.2 mishandles union mounts, allowing attackers to execute arbitrary code in a privileged context via a crafted app with root privileges.
- CVE-2015-5945High
The Sandbox subsystem in Apple OS X before 10.11.1 allows local users to gain privileges via vectors involving NVRAM parameters.
- CVE-2015-3775High
Apple OS X before 10.10.5 does not properly implement authentication, allowing local users to obtain admin privileges via unspecified vectors.
- CVE-2015-3767High
A vulnerability in Apple OS X before version 10.10.5 allows local users to gain privileges or cause a denial of service through a malformed DMG image.
Original NVD description (English source)
The IOHIDSecurePromptClient function in Apple OS X does not properly validate pointer values, which allows remote attackers to execute arbitrary code or cause a denial of service (system crash) via a crafted web site.