CVE-2014-4398 : An unspecified integrated graphics driver routine in the Intel Graphics Driver subsystem in Apple OS X before 10.9.5 doe

An unspecified integrated graphics driver routine in the Intel Graphics Driver subsystem in Apple OS X before 10.9.5 does not properly validate calls, which allows attackers to execute arbitrary code in a privileged context via a crafted application, a different vulnerability than CVE-2014-4394, CVE-2014-4395, CVE-2014-4396, CVE-2014-4397, CVE-2014-4399, CVE-2014-4400, CVE-2014-4401, and CVE-2014-4416.

Published 2014-09-19 10:55:04

Updated 2017-08-29 01:35:00

Source Apple Inc.

View at NVD, CVE.org

Vulnerability category: Input validationExecute code

Threat overview for CVE-2014-4398

Top countries where our scanners detected CVE-2014-4398

Top open port discovered on systems with this issue 548

IPs affected by CVE-2014-4398 453

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2014-4398!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2014-4398

EPSS FAQ

0.69%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 78 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2014-4398

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
6.9	MEDIUM	AV:L/AC:M/Au:N/C:C/I:C/A:C	3.4	10.0	NIST
Access Vector: Local Access Complexity: Medium Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete

CWE ids for CVE-2014-4398

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2014-4398

http://support.apple.com/kb/HT6443

About the security content of OS X Mavericks v10.9.5 and Security Update 2014-004 - Apple Support
Vendor Advisory

CVEs referencing this url
http://www.securityfocus.com/bid/69894

Apple Mac OS X CVE-2014-4398 Arbitrary Code Execution Vulnerability
https://code.google.com/p/google-security-research/issues/detail?id=32

32 - OS X IOKit kernel code execution due to lack of bounds checking in IGAccelVideoContextMain::process_token_ColorSpaceConversion - project-zero - Monorail
https://exchange.xforce.ibmcloud.com/vulnerabilities/96058

Apple Mac OS X code execution CVE-2014-4398 Vulnerability Report
http://www.securitytracker.com/id/1030868

Apple OS X Multiple Flaws Let Remote Users Execute Arbitrary Code and Local Users Gain Elevated Privileges and Obtain Potentially Sensitive Information - SecurityTracker

CVEs referencing this url

Products affected by CVE-2014-4398