Buffer overflow in CoreGraphics in Apple Mac OS X before 10.8.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted JBIG2 data in a PDF document.

According to its banner, the remote Apple TV 2nd generation or later device is prior to 6.0.  It is, therefore, reportedly affected by multiple vulnerabilities, the most serious issues of which could result in arbitrary code execution.

The mobile device is running a version of iOS that is older than version 7.  This version contains security-related fixes for the following components :

  - Certificate Trust Policy
  - CoreGraphics
  - CoreMedia
  - Data Protection
  - Data Security
  - dyld
  - File Systems
  - ImageIO
  - IOKit
  - IOKitUser
  - IOSerialFamily
  - IPSec
  - Kernel
  - Kext Management
  - libxml
  - libxslt
  - Passcode Lock
  - Personal Hotspot
  - Push Notifications
  - Safari
  - Sandbox
  - Social
  - Springboard
  - Telephony
  - Twitter
  - WebKit

The remote host is missing Mac OS X security update 2013-004 that fixes multiple security issues. 

The remote host is running a version of Mac OS X 10.8 that is older than 10.8.5. The newer version contains numerous security-related fixes for the following components :

  - Apache
  - Bind
  - Certificate Trust Policy
  - CoreGraphics
  - ImageIO
  - Installer
  - IPSec
  - Kernel
  - Mobile Device Management
  - OpenSSL
  - PHP
  - PostgreSQL
  - Power Management
  - QuickTime
  - Screen Lock
  - sudo

 This update also addresses an issue in which certain Unicode strings could cause applications to unexpectedly quit.

 Note that successful exploitation of the most serious issues could result in arbitrary code execution.

The remote host is running a version of Mac OS X 10.8.x that is prior to 10.8.5. The newer version contains multiple security-related fixes for the following components :

  - Apache
  - Bind
  - Certificate Trust Policy
  - CoreGraphics
  - ImageIO
  - Installer
  - IPSec
  - Kernel
  - Mobile Device Management
  - OpenSSL
  - PHP
  - PostgreSQL
  - Power Management
  - QuickTime
  - Screen Lock
  - sudo

This update also addresses an issue in which certain Unicode strings could cause applications to unexpectedly quit.

Note that successful exploitation of the most serious issues could result in arbitrary code execution.

According to its banner, the remote Apple iOS device is missing a security update.  Versions of Apple iOS older than 7.0 are affected by vulnerabilities within the following components :

 - Certificate Trust Policy
 - CoreGraphics
 - CoreMedia
 - Data Protection
 - Data Security
 - File Systems
 - IOKit
 - IOKitUser
 - IOSerialFamily
 - IPSec
 - ImageIO
 - Kernel
 - Kext Management
 - Passcode Lock
 - Personal Hotspot
 - Push Notifications
 - Safari
 - Sandbox
 - Social
 - Springboard
 - Telephony
 - Twitter
 - WebKit
 - dyld
 - libxml
 - libxslt

ID	Name	Product	Family	Type	Severity
70257	Apple TV < 6.0 Multiple Vulnerabilities	Nessus	Misc.	Remote	high
69984	Apple iOS < 7 Multiple Vulnerabilities	Nessus	Mobile Devices	Local	high
8008	Mac OS X 10.8 < 10.8.5 Multiple Vulnerabilities (Security Update 2013-004)	Nessus Network Monitor	Web Clients		critical
69877	Mac OS X 10.8.x < 10.8.5 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	Combined	critical
8013	Apple iOS < 7.0 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices		critical

Detections

Analytics

CVE-2013-1025

high

Tenable Plugins

high

high

critical

critical

critical