CVE-2015-7078 : Use-after-free vulnerability in Hypervisor in Apple OS X before 10.11.2 allows local users to gain privileges via vector

Use-after-free vulnerability in Hypervisor in Apple OS X before 10.11.2 allows local users to gain privileges via vectors involving VM objects.

Published 2015-12-11 11:59:44

Updated 2017-09-13 01:29:07

Source Apple Inc.

View at NVD, CVE.org

Vulnerability category: Memory Corruption

Exploit prediction scoring system (EPSS) score for CVE-2015-7078

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2015-7078

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
7.2	HIGH	AV:L/AC:L/Au:N/C:C/I:C/A:C	3.9	10.0	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete

References for CVE-2015-7078

http://lists.apple.com/archives/security-announce/2015/Dec/msg00005.html

Apple - Lists.apple.com
Vendor Advisory

CVEs referencing this url
http://www.securitytracker.com/id/1034344

Apple OS X Multiple Flaws Let Remote and Local Users Execute Arbitrary Code and Deny Service and Let Local Users Obtain Potentially Sensitive Information and Gain Elevated Privileges - SecurityTracker

CVEs referencing this url
https://support.apple.com/HT205637

About the security content of OS X El Capitan 10.11.2, Security Update 2015-005 Yosemite, and Security Update 2015-008 Mavericks - Apple Support
Vendor Advisory

CVEs referencing this url
https://www.exploit-db.com/exploits/39370/

Apple Mac OSX Kernel - Hypervisor Driver Use-After-Free

Products affected by CVE-2015-7078

Apple » Mac Os X
Versions up to, including, (<=) 10.11.1
cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
Matching versions