CVE-2014-4391 in Mac OS X
Summary
The Code Signing feature in Apple OS X before 10.10 does not properly handle incomplete resource envelopes in signed bundles, which allows remote attackers to bypass intended app-author restrictions by omitting an execution-related resource.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Reservation
06/20/2014
Disclosure
10/17/2014
Status
Confirmed
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 68035 | Apple Mac OS X Code Signing cryptographic issue | 310 | Proof-of-Concept | Official fix | CVE-2014-4391 |