Unscored CVE-2014-4391 EUVD-2014-4318GHSA-r9x3-v3cq-9vm6

The Code Signing feature in Apple OS X before 10.10 does not properly handle incomplete resource envelopes in signed bundles, which allows …

Published Oct 18, 2014 · Updated Aug 6, 2024 · Assigned by apple

Description

The Code Signing feature in Apple OS X before 10.10 does not properly handle incomplete resource envelopes in signed bundles, which allows remote attackers to bypass intended app-author restrictions by omitting an execution-related resource.

References

macosx-cve20144391-sec-bypass(97644) vdb-entry
APPLE-SA-2014-10-16-1 vendor-advisory
70637 vdb-entry
1031063 vdb-entry
https://support.apple.com/kb/HT6535