Description
The bundle API in CoreFoundation in Apple Mac OS X 10.3.9 and 10.4.6 loads dynamic libraries even if the client application has not directly requested it, which allows attackers to execute arbitrary code from an untrusted bundle.
References
- 17951 vdb-entry
- 25586 vdb-entry
- macos-corefoundation-bundle-code-execution(26407) vdb-entry
- ADV-2006-1779 vdb-entry
- TA06-132A third-party-advisory
- APPLE-SA-2006-05-11 vendor-advisory
- 20077 third-party-advisory
- 1016080 vdb-entry