An issue was discovered in certain Apple products. macOS before 10.12.1 is affected. The issue involves the "Core Image" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted JPEG file.

The remote host is running a version of Mac OS X that is 10.10.5 but is missing Security Update 2016-006, or else it is version 10.11.6 but is missing Security Update 2016-002. It is, therefore, affected by multiple vulnerabilities :

  - A memory corruption issue exists in the     AppleGraphicsControl component due to improper lock     state checking. A local attacker can exploit this, via a     specially crafted application, to execute arbitrary code     with kernel-level privileges. (CVE-2016-4662)

  - A memory corruption issue exists in the NVIDIA Graphics     Driver due to improper validation of user-supplied     input. A local attacker can exploit this to cause a     denial of service condition. (CVE-2016-4663)

  - Multiple flaws exist in the System Boot component due to     improper validation of user-supplied input. A local     attacker can exploit these to terminate the system or     execute arbitrary code with kernel-level privileges.
    (CVE-2016-4669)

  - An out-of-bounds write error exists in the ImageIO     component when parsing PDF files due to improper bounds     checking. An unauthenticated, remote attacker can     exploit this, by convincing a user to open a specially     crafted PDF file, to execute arbitrary code.
    (CVE-2016-4671)

  - A memory corruption issue exists in the Core Image     component when handling JPEG files due to improper     validation of user-supplied input. An unauthenticated,     remote attacker can exploit this, by convincing a user     to open a specially crafted JPEG file, to execute     arbitrary code. (CVE-2016-4681)

  - An out-of-bounds read error exists in the ImageIO     component when parsing specially crafted SGI images. An     unauthenticated, remote attacker can exploit this to     disclose potentially sensitive information in process     memory. (CVE-2016-4682)

  - Multiple out-of-bounds read and write errors exist in     the ImageIO component when parsing specially crafted     SGI images. An unauthenticated, remote attacker can     exploit these to disclose potentially sensitive     information, cause a denial of service condition, or     execute arbitrary code. (CVE-2016-4683)

The remote host is running a version of Mac OS X version 10.x prior to 10.12.1, and is affected by multiple vulnerabilities in the following components :

 - AppleMobileFileIntegrity (CVE-2016-7584)
 - AppleGraphicsControl (CVE-2016-4662)
 - AppleSMC (CVE-2016-4678)
 - ATS (CVE-2016-4667, CVE-2016-4674)
 - CFNetwork Proxies (CVE-2016-7579)
 - CoreGraphics (CVE-2016-4673)
 - Core Image (CVE-2016-4681)
 - FaceTime (CVE-2016-7577)
 - FontParser (CVE-2016-4660, CVE-2016-4688)
 - IDS - Connectivity (CVE-2016-4721)
 - ImageIO (CVE-2016-4671, CVE-2016-4682, CVE-2016-4683)
 - Kernel (CVE-2016-4669, CVE-2016-7613)
 - libarchive (CVE-2016-4679)
 - libxpc (CVE-2016-4675)
 - ntfs (CVE-2016-4661)
 - NVIDIA Graphics Drivers (CVE-2016-4663)
 - Security (CVE-2016-4670)
 - Thunderbolt (CVE-2016-4780)

ID	Name	Product	Family	Severity
100427	Mac OS X 10.10.5 / 10.11.6 Multiple Vulnerabilities (Security Update 2016-002 / 2016-006)	Nessus	MacOS X Local Security Checks	high
9758	Mac OS X 10.x < 10.12.1 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	high

Detections

Analytics

CVE-2016-4681

high

Tenable Plugins

high

high