CVE-2014-8829

Vulnerability

SceneKit in Apple OS X prior to version 10.10.2 contains an out-of-bounds write vulnerability. The issue exists in the handling of crafted applications, allowing an attacker to trigger a memory corruption condition. Affected versions include OS X Yosemite 10.10 and 10.10.1, as well as earlier versions [1].

Exploitation

An attacker must convince a user to run a specially crafted application on the affected system. No additional privileges or network access are required beyond the ability to execute the malicious app. The exploitation does not require user interaction beyond launching the app [1].

Impact

Successful exploitation can lead to arbitrary code execution in the context of the current user, or cause a denial of service due to the out-of-bounds write. The attacker gains the ability to execute arbitrary code or crash the application [1].

Mitigation

Apple addressed this vulnerability in OS X Yosemite v10.10.2 and Security Update 2015-001, released on January 27, 2015. Users should update to the latest version of OS X to remediate the issue. No workarounds are available [1].