CoreText released earlier than Apple Mac OS X 10.7.3 and reused Code Execution Vulnerability

Release date:
Updated on:

Affected Systems:
Apple Mac OS X 10.7.2
Apple Mac OS X 10.7.1
Apple MacOS X Server 10.7.2
Apple MacOS X Server 10.7.1
Apple MacOS X Server 10.7
Apple MacOS X Server 10.6.8
Unaffected system:
Apple Mac OS X 10.7.3
Apple MacOS X Server 10.7.3
Description:
--------------------------------------------------------------------------------
Bugtraq id: 51812
Cve id: CVE-2011-3449

Mac OS is an operating system running on Apple's Macintosh series computers.

The memory corruption vulnerability exists when Apple Mac OS X opens malicious fonts embedded in the document. Attackers can exploit this vulnerability to execute arbitrary code in the affected applications.

<* Source: Will Dormann

Link: http://www.kb.cert.org/vuls/id/410281
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Apple
-----
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://support.apple.com/