CVE-2007-6427: apple mac_os_x Out-of-bounds Write

CVSS: 9.3v2.0HighModified

AliasesDEBIAN-CVE-2007-6427

Published 18-01-2008Last modified 07-08-2024

Vulnerability summary

CVE-2007-6427 is a high (CVSS 9.3) Out-of-bounds Write vulnerability in apple mac_os_x. EPSS estimates a 4.28% chance of exploitation in the next 30 days, higher than 90.9% of scored vulnerabilities.

Overall risk

70/100

0100

High · default modelHow is this calculated?

CVSS score

9.3/10

010

High · v2.0 (NVD)

EPSS score

4.28%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 6 · Related 1

DSA-1466-2 DTSA-110-1 OPENSUSE-SU-2024:11525-1 RHSA-2008:0029 RHSA-2008:0030 RHSA-2008:0031

Timeline

18-01-2008
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

The XInput extension in X.Org Xserver before 1.4.1 allows context-dependent attackers to execute arbitrary code via requests related to byte swapping and heap corruption within multiple functions, a different vulnerability than CVE-2007-4990.

CVSS metrics

1 score · 1 source · 1 version

v2.09.3

EPSS trend

Probability

4.28%

Chance of exploitation in the next 30 days

Percentile

91%

Versus all other CVEs

30-day change

0.00 pp

From 4.28% on 19-09-2026

19-09-202619-10-2026

EPSS score

4.28%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.

Affected systems

Suse5 products

linux10.1
linux_enterprise_desktop9 | 10 | 10:sp1
linux_enterprise_server8 | 9 | 10:sp1
linux_enterprise_software_development_kit10:sp1
open_enterprise_serverna

Debian2 products

xorg-server< 2:1.4.1~git20080105-2
debian_linuxEOL3.1 | 4.0

Apple1 product

mac_os_x< 10.4.11 | ≥ 10.5.0, < 10.5.2

Canonical1 product

ubuntu_linuxEOL6.06 | 6.10 | 7.04 | 7.10

Fedoraproject1 product

fedoraEOL7 | 8

Opensuse1 product

opensuse10.2 | 10.3

X.org1 product

x_server< 1.4.1

7 vendors · 12 products

References

68 links

oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10372VDB EntrySignatureX Refsource OVALThird Party Advisory
secunia.com/advisories/28542Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/29139Third Party AdvisoryX Refsource SECUNIA
www.securityfocus.com/bid/27336VDB EntryX Refsource BIDPatchThird Party Advisory
www.vupen.com/english/advisories/2008/0184VDB EntryX Refsource VUPENThird Party Advisory
secunia.com/advisories/29622Third Party AdvisoryX Refsource SECUNIA
www.redhat.com/archives/fedora-package-announce/2008-January/msg00704.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2008-01/msg00004.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2008-04/msg00005.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
secunia.com/advisories/28532Third Party AdvisoryX Refsource SECUNIA

Show all 68 references

secunia.com/advisories/29707Third Party AdvisoryX Refsource SECUNIA
support.avaya.com/elmodocs2/security/ASA-2008-078.htmX Refsource CONFIRMThird Party Advisory
secunia.com/advisories/28843Third Party AdvisoryX Refsource SECUNIA
www.debian.org/security/2008/dsa-1466Vendor AdvisoryX Refsource DEBIANThird Party Advisory
www.securityfocus.com/bid/27351VDB EntryX Refsource BIDThird Party Advisory
secunia.com/advisories/28540Third Party AdvisoryX Refsource SECUNIA
h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01543321Vendor AdvisoryX Refsource HPBroken Link
www.securityfocus.com/archive/1/487335/100/0/threadedMailing ListX Refsource BUGTRAQThird Party AdvisoryVDB Entry
www.vupen.com/english/advisories/2008/0703VDB EntryX Refsource VUPENThird Party Advisory
www.mandriva.com/security/advisories?name=MDVSA-2008:021Vendor AdvisoryX Refsource MANDRIVAThird Party Advisory
www.vupen.com/english/advisories/2008/0924/referencesVDB EntryX Refsource VUPENThird Party Advisory
secunia.com/advisories/28718Third Party AdvisoryX Refsource SECUNIA
sunsolve.sun.com/search/document.do?assetkey=1-26-200153-1Vendor AdvisoryX Refsource SUNALERTBroken Link
www.redhat.com/support/errata/RHSA-2008-0029.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
secunia.com/advisories/28584Third Party AdvisoryX Refsource SECUNIA
www.openbsd.org/errata41.htmlVendor AdvisoryX Refsource OPENBSDThird Party Advisory
secunia.com/advisories/28941Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/28592Third Party AdvisoryX Refsource SECUNIA
support.avaya.com/elmodocs2/security/ASA-2008-039.htmX Refsource CONFIRMThird Party Advisory
secunia.com/advisories/29420Third Party AdvisoryX Refsource SECUNIA
www.mandriva.com/security/advisories?name=MDVSA-2008:022Vendor AdvisoryX Refsource MANDRIVAThird Party Advisory
lists.apple.com/archives/security-announce/2008/Mar/msg00001.htmlVendor AdvisoryX Refsource APPLEMailing List
secunia.com/advisories/30161Third Party AdvisoryX Refsource SECUNIA
www.gentoo.org/security/en/glsa/glsa-200805-07.xmlVendor AdvisoryX Refsource GENTOOThird Party Advisory
www.redhat.com/support/errata/RHSA-2008-0030.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
secunia.com/advisories/28543Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/28273Third Party AdvisoryX Refsource SECUNIA
www.redhat.com/support/errata/RHSA-2008-0031.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
secunia.com/advisories/28550Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2008/0497/referencesVDB EntryX Refsource VUPENThird Party Advisory
bugs.gentoo.org/show_bug.cgi?id=204362X Refsource CONFIRMIssue TrackingPatchThird Party Advisory
www.mandriva.com/security/advisories?name=MDVSA-2008:023Vendor AdvisoryX Refsource MANDRIVAThird Party Advisory
secunia.com/advisories/28885Third Party AdvisoryX Refsource SECUNIA
sunsolve.sun.com/search/document.do?assetkey=1-26-103200-1Vendor AdvisoryX Refsource SUNALERTBroken Link
www.mandriva.com/security/advisories?name=MDVSA-2008:025Vendor AdvisoryX Refsource MANDRIVAThird Party Advisory
usn.ubuntu.com/571-1/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
security.gentoo.org/glsa/glsa-200804-05.xmlVendor AdvisoryX Refsource GENTOOThird Party Advisory
secunia.com/advisories/28535Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2008/3000VDB EntryX Refsource VUPENThird Party Advisory
docs.info.apple.com/article.html?artnum=307562X Refsource CONFIRMBroken Link
labs.idefense.com/intelligence/vulnerabilities/display.php?id=643Third Party AdvisoryX Refsource IDEFENSEBroken Link
lists.freedesktop.org/archives/xorg/2008-January/031918.htmlMailing ListX Refsource MLISTThird Party Advisory
www14.software.ibm.com/webapp/…X Refsource CONFIRMMitigationThird Party Advisory
secunia.com/advisories/32545Third Party AdvisoryX Refsource SECUNIA
exchange.xforce.ibmcloud.com/vulnerabilities/39759VDB EntryX Refsource XFThird Party Advisory
secunia.com/advisories/28838Third Party AdvisoryX Refsource SECUNIA
securitytracker.com/id?1019232VDB EntryX Refsource SECTRACKThird Party Advisory
issues.rpath.com/browse/RPL-2010X Refsource CONFIRMBroken Link
www.openbsd.org/errata42.htmlVendor AdvisoryX Refsource OPENBSDThird Party Advisory
secunia.com/advisories/28539Third Party AdvisoryX Refsource SECUNIA
lists.opensuse.org/opensuse-security-announce/2008-02/msg00003.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
secunia.com/advisories/28616Third Party AdvisoryX Refsource SECUNIA
www.redhat.com/archives/fedora-package-announce/2008-January/msg00641.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
secunia.com/advisories/28536Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/28693Third Party AdvisoryX Refsource SECUNIA
security.gentoo.org/glsa/glsa-200801-09.xmlVendor AdvisoryX Refsource GENTOOThird Party Advisory
www.vupen.com/english/advisories/2008/0179VDB EntryX Refsource VUPENThird Party Advisory
security-tracker.debian.org/tracker/CVE-2007-6427Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities