CVE-2014-1303

37Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 35%

from disclosure to weapon757 days

Published on NVDMar 26

1st PoC+757d

exploitation probability

35%top 2% of all CVEs

observed exploitation

nono source reports it

3 public exploit(s)

Heap-based buffer overflow in Apple Safari 7.0.2 allows remote attackers to execute arbitrary code and bypass a sandbox protection mechanism via unspecified vectors, as demonstrated by Liang Chen during a Pwn2Own competition at CanSecWest 2014.

Affected products

n/a · n/a

public PoCs found — 3

githubgithub.com/RKX1209/CVE-2014-1303★ 24 exploitdbwww.exploit-db.com/exploits/44200unverified exploitdbwww.exploit-db.com/exploits/44204unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html http://archives.neohapsis.com/archives/bugtraq/2014-04/0135.html http://archives.neohapsis.com/archives/bugtraq/2014-04/0136.html https://support.apple.com/kb/HT6537 http://twitter.com/thezdi/statuses/444157530139136000 http://www.pwn2own.com/2014/03/pwn2own-results-thursday-day-two/