CVE-2014-8830

Vulnerability

A heap-based buffer overflow vulnerability exists in the SceneKit component of Apple OS X versions prior to 10.10.2. The issue is triggered when processing a specially crafted accessor element within a Collada (DAE) file. This can lead to memory corruption.

Exploitation

An attacker can exploit this vulnerability by convincing a user to open a maliciously crafted Collada file, for example, via a web page or email attachment. No authentication or special privileges are required; the user simply needs to view the file using an application that leverages SceneKit.

Impact

Successful exploitation can result in arbitrary code execution in the context of the affected application or the kernel, potentially allowing full system compromise. Alternatively, an attacker could cause a denial of service by crashing the application.

Mitigation

Apple addressed this issue in OS X Yosemite v10.10.2, which was released on January 27, 2015. Users should update to OS X 10.10.2 or later via Software Update or Apple's security update process [1]. No workarounds are known.