CVE-2014-1252 : Double free vulnerability in Apple Pages 2.x before 2.1 and 5.x before 5.1 allow

Double free vulnerability in Apple Pages 2.x before 2.1 and 5.x before 5.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted Microsoft Word file.

Published 2014-01-24 15:08:01

Updated 2025-04-11 00:51:22

Source Apple Inc.

View at NVD, CVE.org

Vulnerability category: Memory CorruptionExecute codeDenial of service

Products affected by CVE-2014-1252

Apple » Mac Os X
Versions up to, including, (<=) 10.9.1
cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
Matching versions
Apple » Iphone Os
Versions up to, including, (<=) 7.0
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
Matching versions
Apple » Pages » Version: 2.0.2
cpe:2.3:a:apple:pages:2.0.2:*:*:*:*:*:*:*
Matching versions
Apple » Pages » Version: 2.0
cpe:2.3:a:apple:pages:2.0:*:*:*:*:*:*:*
Matching versions
Apple » Pages » Version: 2.0.1
cpe:2.3:a:apple:pages:2.0.1:*:*:*:*:*:*:*
Matching versions
Apple » Pages » Version: 5.0
cpe:2.3:a:apple:pages:5.0:*:*:*:*:*:*:*
Matching versions
Apple » Pages » Version: 5.0.1
cpe:2.3:a:apple:pages:5.0.1:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2014-1252

EPSS FAQ

2.89%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 85 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2014-1252

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P	10.0	6.4	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial

CWE ids for CVE-2014-1252

CWE-415 Double Free

The product calls free() twice on the same memory address.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2014-1252

https://exchange.xforce.ibmcloud.com/vulnerabilities/90672

Apple Pages Microsoft Word document code execution CVE-2014-1252 Vulnerability Report
http://support.apple.com/kb/HT6162

About the security content of iOS 7.1 - Apple Support
Vendor Advisory

CVEs referencing this url
http://www.securityfocus.com/bid/65113

Apple Pages File Processing Remote Code Execution Vulnerability
Third Party Advisory;VDB Entry
http://secunia.com/advisories/56630

Sign in
Permissions Required
http://www.securitytracker.com/id/1029683

Apple Pages Double Free Memory Error Lets Remote Users Execute Arbitrary Code - SecurityTracker
Third Party Advisory;VDB Entry
http://secunia.com/advisories/56615

Sign in
Permissions Required
http://support.apple.com/kb/HT6117

About the security content of Pages 5.1 and Pages 2.1 - Apple Support
Vendor Advisory
http://osvdb.org/102460

Broken Link
http://support.apple.com/kb/HT6150

About the security content of OS X Mavericks v10.9.2 and Security Update 2014-001 - Apple Support
Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2014-1252

Products affected by CVE-2014-1252

Exploit prediction scoring system (EPSS) score for CVE-2014-1252

CVSS scores for CVE-2014-1252

CWE ids for CVE-2014-1252

References for CVE-2014-1252