Apple Mac OS X ImageIO GIF Memory Failure Vulnerability (CVE-2006-3502)

Key Information Summary Vulnerability Title Apple Mac OS X ImageIO contains undetected memory failure in GIF image handling Vulnerability ID VU#651844 Release Date Original Release Date: 2006-08-02 Last Revised: 2006-08-14 Vulnerability Overview A memory allocation flaw exists in Apple Mac OS X's ImageIO framework, potentially allowing remote attackers to execute arbitrary code on affected systems. Vulnerability Description Apple's ImageIO is an image processing framework used to handle various image formats, including GIF. ImageIO is utilized by multiple applications such as WebCore and Safari. The framework contains an unspecified memory allocation failure vulnerability when processing GIF images. Impact Attackers can exploit this vulnerability by tricking users into viewing specially crafted GIF images (e.g., embedded in web pages), leading to arbitrary code execution with user privileges. Attackers may also cause applications using the ImageIO library to crash. Any application that uses ImageIO may be affected. Solution Apply updates. Refer to Apple Security Update 2006-004 for details on the update. Vendor Information Apple Computer, Inc. — Affected CVSS Metrics References http://docs.info.apple.com/article.html?artnum=304063 http://secunia.com/advisories/21253/ CVE Identifier CVE-2006-3502 Severity Metric 7.43 Public Disclosure Date Date Public: 2006-08-01 First Published Date Date First Published: 2006-08-02 Last Updated Date Date Last Updated: 2006-08-14 13:19 UTC Document Revision 12

Goal Reached Thanks to every supporter — we hit 100%!

Apple Mac OS X ImageIO GIF Memory Failure Vulnerability (CVE-2006-3502)