VULNERABILITY INTELLIGENCE
CVE-2013-3954
CVSS score6.9 MEDIUM
EPSS probability0.42%
CISA KEVNot currently listed
Published2013-06-05
Last modified2026-06-16
CVSS vectorAV:L/AC:M/Au:N/C:C/I:C/A:C
Description
The posix_spawn system call in the XNU kernel in Apple Mac OS X 10.8.x does not properly validate the data for file actions and port actions, which allows local users to (1) cause a denial of service (panic) via a size value that is inconsistent with a header count field, or (2) obtain sensitive information from kernel heap memory via a certain size value in conjunction with a crafted buffer.
Weakness classification
- CWE-20: Improper Input Validation