CVE Vulnerabilities

CVE-2011-1516

Published: Nov 15, 2011 | Modified: Oct 09, 2018
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
7.6 HIGH
AV:N/AC:H/Au:N/C:C/I:C/A:C
RedHat/V2
RedHat/V3
Ubuntu

The kSBXProfileNoNetwork and kSBXProfileNoInternet sandbox profiles in Apple Mac OS X 10.5.x through 10.7.x do not propagate restrictions to all created processes, which allows remote attackers to access network resources via a crafted application, as demonstrated by use of osascript to send Apple events to the launchd daemon, a related issue to CVE-2008-7303.

Affected Software

Name Vendor Start Version End Version
Mac_os_x Apple 10.5.8 10.5.8
Mac_os_x Apple 10.6.8 10.6.8
Mac_os_x Apple 10.6.7 10.6.7
Mac_os_x Apple 10.5.6 10.5.6
Mac_os_x Apple 10.5.5 10.5.5
Mac_os_x Apple 10.6.3 10.6.3
Mac_os_x Apple 10.5.1 10.5.1
Mac_os_x Apple 10.7.2 10.7.2
Mac_os_x Apple 10.5.3 10.5.3
Mac_os_x Apple 10.5.0 10.5.0
Mac_os_x Apple 10.6.6 10.6.6
Mac_os_x Apple 10.5.2 10.5.2
Mac_os_x Apple 10.6.1 10.6.1
Mac_os_x Apple 10.6.0 10.6.0
Mac_os_x Apple 10.5.7 10.5.7
Mac_os_x Apple 10.6.2 10.6.2
Mac_os_x Apple 10.7.0 10.7.0
Mac_os_x Apple 10.6.4 10.6.4
Mac_os_x Apple 10.6.5 10.6.5
Mac_os_x Apple 10.5.4 10.5.4
Mac_os_x Apple 10.7.1 10.7.1

References