{"schemaVersion":3,"id":"CVE-2008-1573","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"The BMP and GIF image decoding engine in ImageIO in Apple Mac OS X before 10.5.3 allows remote attackers to obtain sensitive information (memory contents) via a crafted (1) BMP or (2) GIF image, which causes an out-of-bounds read.","dates":{"published":"2008-06-02T14:00:00.000Z","modified":"2024-08-07T08:24:42.790Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.1,"severity":"high","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:M/Au:N/C:C/I:N/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":7.1,"severity":"high","vector":"AV:N/AC:M/Au:N/C:C/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.02137,"percentile":0.81713,"severity":"low","asOf":"2026-10-18T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-18T00:00:00.000Z","baselineScore":0.02137},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.02137,"percentile":0.81713}],"last30":[{"date":"2026-09-18T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.02137,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.02137,"percentile":0.81713}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-119","name":"Improper Restriction of Operations within the Bounds of a Memory Buffer","description":"The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.","type":"weakness","status":"Stable","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/119.html"}],"affected":[{"vendor":"apple","product":"mac_os_x","name":"mac os x","label":"mac_os_x","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 10.5.2","noFixRecorded":false,"fixedIn":null},{"text":"10.4.11","noFixRecorded":false,"fixedIn":null},{"text":"10.5","noFixRecorded":false,"fixedIn":null},{"text":"10.5.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 10.5.2 | 10.4.11 | 10.5 | 10.5.1","eol":null,"hubHref":"/vendor/apple/mac_os_x"},{"vendor":"apple","product":"mac_os_x_server","name":"mac os x server","label":"mac_os_x_server","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 10.5.2","noFixRecorded":false,"fixedIn":null},{"text":"10.4.11","noFixRecorded":false,"fixedIn":null},{"text":"10.5","noFixRecorded":false,"fixedIn":null},{"text":"10.5.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 10.5.2 | 10.4.11 | 10.5 | 10.5.1","eol":null,"hubHref":"/vendor/apple/mac_os_x_server"}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://secunia.com/advisories/30775","label":"secunia.com/advisories/30775","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Vendor Advisory"]},{"url":"http://www.vupen.com/english/advisories/2008/1882/references","label":"www.vupen.com/english/advisories/2008/1882/references","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN","Vendor Advisory"]},{"url":"http://www.us-cert.gov/cas/techalerts/TA08-150A.html","label":"www.us-cert.gov/cas/techalerts/TA08-150A.html","hostname":"www.us-cert.gov","tags":["Third Party Advisory","X Refsource CERT","US Government Resource"]},{"url":"http://secunia.com/advisories/30430","label":"secunia.com/advisories/30430","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Vendor Advisory"]},{"url":"http://lists.apple.com/archives/security-announce/2008//May/msg00001.html","label":"lists.apple.com/archives/security-announce/2008//May/msg00001.html","hostname":"lists.apple.com","tags":["Vendor Advisory","X Refsource APPLE"]},{"url":"http://securitytracker.com/id?1020144","label":"securitytracker.com/id?1020144","hostname":"securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK","Patch"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/42721","label":"exchange.xforce.ibmcloud.com/vulnerabilities/42721","hostname":"exchange.xforce.ibmcloud.com","tags":["VDB Entry","X Refsource XF"]},{"url":"http://lists.apple.com/archives/security-announce/2008//Jun/msg00001.html","label":"lists.apple.com/archives/security-announce/2008//Jun/msg00001.html","hostname":"lists.apple.com","tags":["Vendor Advisory","X Refsource APPLE"]},{"url":"http://www.vupen.com/english/advisories/2008/1697","label":"www.vupen.com/english/advisories/2008/1697","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/29513","label":"www.securityfocus.com/bid/29513","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID"]},{"url":"http://www.securityfocus.com/bid/29412","label":"www.securityfocus.com/bid/29412","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2008-06-02T14:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-07T08:24:42.790Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":29,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T09:51:22.996Z","stale":false,"partial":false}}