« Volver al listado

CVE-2011-3446

Estado: ModificadaAlta (7.5)—

Apple Type Services (ATS) in Apple Mac OS X before 10.7.3 does not properly manage memory for data-font files, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted font that is accessed by Font Book.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Apple — MAC OS XApple — MAC OS X Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2011-3446",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "product-security@apple.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2012-02-02T18:55:01.067",
  "references": [
    {
      "url": "http://support.apple.com/kb/HT5130",
      "source": "product-security@apple.com"
    },
    {
      "url": "http://support.apple.com/kb/HT5130",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Apple Type Services (ATS) in Apple Mac OS X before 10.7.3 does not properly manage memory for data-font files, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted font that is accessed by Font Book."
    },
    {
      "lang": "es",
      "value": "Apple Type Services (ATS) en Apple Mac OS X antes de v10.7.3 no maneja correctamente la memoria para archivos de datos-fuente, lo que permite a atacantes remotos ejecutar código de su elección causar una denegación de servicio (caída de la aplicación) a través de una fuente de letra manipulada que es accedida por Font Book."
    }
  ],
  "lastModified": "2026-06-16T23:33:18.253",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B52C3912-5F34-4C5C-9B02-953C5DE8DE49",
              "versionEndIncluding": "10.7.2"
            },
            {
              "criteria": "cpe:2.3:o:apple:mac_os_x:10.7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8961F444-48C4-4B54-829B-A1A2D0F2716C"
            },
            {
              "criteria": "cpe:2.3:o:apple:mac_os_x:10.7.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "09A0FA11-6211-4962-A6E0-F00732818012"
            },
            {
              "criteria": "cpe:2.3:o:apple:mac_os_x_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "19E02215-21EA-41A7-B977-01CE5CB2424F",
              "versionEndIncluding": "10.7.2"
            },
            {
              "criteria": "cpe:2.3:o:apple:mac_os_x_server:10.7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "38823717-65A1-4587-8F05-32EA9A01084C"
            },
            {
              "criteria": "cpe:2.3:o:apple:mac_os_x_server:10.7.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7BD4E77C-3F87-476B-BB66-75EECDFDB18E"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "product-security@apple.com"
}