Patch/Configuration Management, Vulnerability Management

Apple patches pair of Xcode Tools flaws

November 1, 2007

Apple patched two issues in Xcode Tools 2.5 on Tuesday, including one flaw that could allow remote code execution.

A newly patched buffer overflow flaw exists in the gdb application's handling of Tektronix Hex (TekHex) Format files. The bug could be exploited by an attacker to run arbitrary code if a user is enticed to run gdb's restore command on a maliciously crafted TekHex file, according to an advisory released Tuesday by Apple.

The update fixes the issue by performing additional validation of TekHex records.

The patch release also fixes a flaw in Xcode Tools' WebObjects that an unprivileged user could exploit to obtain system privileges.

The flaw exists in the demo version of OpenBase contained in Xcode WebObjects, which is disabled to fix the issue.

Apple credited researcher Kevin Finisterre of Netragard for reporting both issues.

Frank Washkuch Jr.

Vulnerability Management

Unauthorized file access possible with chained Mitel MiCollab flaws

SC StaffDecember 9, 2024

Intrusions leveraging CVE-2024-41713, which stems from insufficient input validation in MiCollab's NuPoint Unified Messaging component, could facilitate not only unauthenticated provisioning data access but also unauthenticated admin task execution, according to an analysis from watchTowr Labs.

Network Security

Intrusions targeting I-O Data router zero-days underway

SC StaffDecember 9, 2024

Most severe of the vulnerabilities is the undocumented features inclusion issue, tracked as CVE-2024-52564, which could be exploited to facilitate remote firewall deactivation, device setting manipulation, and arbitrary OS command execution, according to Japan's Computer Emergency Response Team Coordination Center.

Computer repair concept. Hardware or software error.

Vulnerability Management

Updated CISA vulnerabilities catalog includes trio of new flaws

SC StaffDecember 9, 2024

Most severe of the newly added vulnerabilities was the critical improper authentication flaw in the open-source file sharing web app ProjectSend, tracked as CVE-2024-11680, which could be leveraged to enable malicious account creation, webshell uploads, and JavaScript embedding.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

Related Terms

Bug Buffer Overflow Disassembly