An issue was discovered in certain Apple products. macOS before 10.12 is affected. macOS before 10.12.1 is affected. The issue involves the "ImageIO" component. It allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and application crash) via a crafted SGI file.

The remote host is running a version of Mac OS X that is 10.10.5 but is missing Security Update 2016-006, or else it is version 10.11.6 but is missing Security Update 2016-002. It is, therefore, affected by multiple vulnerabilities :

  - A memory corruption issue exists in the     AppleGraphicsControl component due to improper lock     state checking. A local attacker can exploit this, via a     specially crafted application, to execute arbitrary code     with kernel-level privileges. (CVE-2016-4662)

  - A memory corruption issue exists in the NVIDIA Graphics     Driver due to improper validation of user-supplied     input. A local attacker can exploit this to cause a     denial of service condition. (CVE-2016-4663)

  - Multiple flaws exist in the System Boot component due to     improper validation of user-supplied input. A local     attacker can exploit these to terminate the system or     execute arbitrary code with kernel-level privileges.
    (CVE-2016-4669)

  - An out-of-bounds write error exists in the ImageIO     component when parsing PDF files due to improper bounds     checking. An unauthenticated, remote attacker can     exploit this, by convincing a user to open a specially     crafted PDF file, to execute arbitrary code.
    (CVE-2016-4671)

  - A memory corruption issue exists in the Core Image     component when handling JPEG files due to improper     validation of user-supplied input. An unauthenticated,     remote attacker can exploit this, by convincing a user     to open a specially crafted JPEG file, to execute     arbitrary code. (CVE-2016-4681)

  - An out-of-bounds read error exists in the ImageIO     component when parsing specially crafted SGI images. An     unauthenticated, remote attacker can exploit this to     disclose potentially sensitive information in process     memory. (CVE-2016-4682)

  - Multiple out-of-bounds read and write errors exist in     the ImageIO component when parsing specially crafted     SGI images. An unauthenticated, remote attacker can     exploit these to disclose potentially sensitive     information, cause a denial of service condition, or     execute arbitrary code. (CVE-2016-4683)

The remote host is running a version of Mac OS X version 10.x prior to 10.12.1, and is affected by multiple vulnerabilities in the following components :

 - AppleMobileFileIntegrity (CVE-2016-7584)
 - AppleGraphicsControl (CVE-2016-4662)
 - AppleSMC (CVE-2016-4678)
 - ATS (CVE-2016-4667, CVE-2016-4674)
 - CFNetwork Proxies (CVE-2016-7579)
 - CoreGraphics (CVE-2016-4673)
 - Core Image (CVE-2016-4681)
 - FaceTime (CVE-2016-7577)
 - FontParser (CVE-2016-4660, CVE-2016-4688)
 - IDS - Connectivity (CVE-2016-4721)
 - ImageIO (CVE-2016-4671, CVE-2016-4682, CVE-2016-4683)
 - Kernel (CVE-2016-4669, CVE-2016-7613)
 - libarchive (CVE-2016-4679)
 - libxpc (CVE-2016-4675)
 - ntfs (CVE-2016-4661)
 - NVIDIA Graphics Drivers (CVE-2016-4663)
 - Security (CVE-2016-4670)
 - Thunderbolt (CVE-2016-4780)

The remote host is running a version of Mac OS X that is prior to 10.10.5, 10.11.x prior to 10.11.6, or is not macOS 10.12. It is, therefore, affected by multiple vulnerabilities in the following components :

  - apache
  - apache_mod_php
  - Apple HSSPI Support
  - AppleEFIRuntime
  - AppleMobileFileIntegrity
  - AppleUCC
  - Application Firewall
  - ATS
  - Audio
  - Bluetooth
  - cd9660
  - CFNetwork
  - CommonCrypto
  - CoreCrypto
  - CoreDisplay
  - curl
  - Date & Time Pref Pane
  - DiskArbitration
  - File Bookmark
  - FontParser
  - IDS - Connectivity
  - ImageIO
  - Intel Graphics Driver
  - IOAcceleratorFamily
  - IOThunderboltFamily
  - Kerberos v5 PAM module
  - Kernel
  - libarchive
  - libxml2
  - libxpc
  - libxslt
  - mDNSResponder
  - NSSecureTextField
  - Perl
  - S2 Camera
  - Security
  - Terminal
  - WindowServer

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

ID	Name	Product	Family	Severity
100427	Mac OS X 10.10.5 / 10.11.6 Multiple Vulnerabilities (Security Update 2016-002 / 2016-006)	Nessus	MacOS X Local Security Checks	high
9758	Mac OS X 10.x < 10.12.1 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	high
93685	macOS < 10.12 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical

Detections

Analytics

CVE-2016-4682

high

Tenable Plugins

high

high

critical