CVE-2014-4491: Infoleak
The extension APIs in the kernel in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 do not prevent the presence of addresses within an OSBundleMachOHeaders key in a response, which makes it easier for attackers to bypass the ASLR protection mechanism via a crafted app.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-4491?
CVE-2014-4491 is considered a high severity vulnerability due to its potential to bypass ASLR protection.
How do I fix CVE-2014-4491?
To fix CVE-2014-4491, you should update your Apple iOS, macOS, or tvOS to the latest version available.
What systems are affected by CVE-2014-4491?
CVE-2014-4491 affects Apple iOS before 8.1.3, macOS before 10.10.2, and tvOS before 7.0.3.
What mitigations are in place for CVE-2014-4491?
Mitigations for CVE-2014-4491 include implementing stricter checks on OSBundleMachOHeaders to prevent address exposure.
Is there a workaround for CVE-2014-4491?
There are no widely recognized workarounds for CVE-2014-4491; the primary resolution is to update the affected systems.