CVE-2015-3696

Vulnerability

A buffer overflow exists in the Intel Graphics Driver component of Apple OS X. This vulnerability affects OS X Mavericks v10.9.5 and OS X Yosemite v10.10 through v10.10.3. The overflow can be triggered by local users through unspecified vectors, as disclosed by Apple [1]. No further technical details are publicly available due to Apple's disclosure policy [1].

Exploitation

An attacker requires local access to the system to exploit this vulnerability. No authentication beyond the initial user session is necessary, and no user interaction is needed. The exact sequence of steps is not disclosed, but the attack vector involves triggering a buffer overflow in the Intel Graphics Driver [1].

Impact

Successful exploitation allows the attacker to gain elevated privileges, likely root, on the affected system. This can lead to full compromise of the confidentiality, integrity, and availability of the system [1].

Mitigation

The vulnerability is fixed in OS X Yosemite v10.10.4 and Security Update 2015-005, released on July 3, 2015 [1]. Users should update to the latest supported version of OS X. No workarounds are documented. This CVE is not listed in CISA's Known Exploited Vulnerabilities catalog [1].