Apple patched two issues in Xcode Tools 2.5 on Tuesday, including one flaw that could allow remote code execution.
A newly patched buffer overflow flaw exists in the gdb application's handling of Tektronix Hex (TekHex) Format files. The bug could be exploited by an attacker to run arbitrary code if a user is enticed to run gdb's restore command on a maliciously crafted TekHex file, according to an advisory released Tuesday by Apple.
The update fixes the issue by performing additional validation of TekHex records.
The patch release also fixes a flaw in Xcode Tools' WebObjects that an unprivileged user could exploit to obtain system privileges.
The flaw exists in the demo version of OpenBase contained in Xcode WebObjects, which is disabled to fix the issue.
Apple credited researcher Kevin Finisterre of Netragard for reporting both issues.
A newly patched buffer overflow flaw exists in the gdb application's handling of Tektronix Hex (TekHex) Format files. The bug could be exploited by an attacker to run arbitrary code if a user is enticed to run gdb's restore command on a maliciously crafted TekHex file, according to an advisory released Tuesday by Apple.
The update fixes the issue by performing additional validation of TekHex records.
The patch release also fixes a flaw in Xcode Tools' WebObjects that an unprivileged user could exploit to obtain system privileges.
The flaw exists in the demo version of OpenBase contained in Xcode WebObjects, which is disabled to fix the issue.
Apple credited researcher Kevin Finisterre of Netragard for reporting both issues.
