CVE-2014-4459

Vulnerability

CVE-2014-4459 is a use-after-free vulnerability in WebKit, the rendering engine used by Apple OS X (prior to version 10.10.1). The bug is triggered when processing crafted page objects in an HTML document. Affected versions include all OS X Yosemite releases before 10.10.1 [3][4].

Exploitation

An attacker can exploit this vulnerability by hosting a malicious HTML document and persuading a user to view it in a browser that uses WebKit (e.g., Safari). No special authentication or network position beyond serving the page is required; the attack is conducted remotely via the web.

Impact

Successful exploitation leads to arbitrary code execution in the context of the WebKit process. This could allow an attacker to read, modify, or delete data, install additional software, or otherwise compromise the user's system.

Mitigation

Apple addressed this vulnerability in OS X Yosemite v10.10.1 [3][4]. Users should update to that version or later. No workarounds are documented, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.