8.4high
CVE-2016-8661
Little Snitch version 3.0 through 3.6.1 suffer from a buffer overflow vulnerability that could be locally exploited which could lead to an…
Published 9 y ago · modified 4 mo ago · JSON
CVSS
8.4
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.4%
percentile 36%
Public exploits
0
none known
Summary
Little Snitch version 3.0 through 3.6.1 suffer from a buffer overflow vulnerability that could be locally exploited which could lead to an escalation of privileges (EoP) and unauthorised ring0 access to the operating system. The buffer overflow is related to insufficient checking of parameters to the "OSMalloc" and "copyin" kernel API calls.
Exploit prediction (EPSS)
0.42% probability of exploitation in the next 30 days, higher than 36% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 8.4 | CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.2 | AV:L/AC:L/Au:N/C:C/I:C/A:C |
Affected products
- n/a Little Snitch version 3.0 through 3.6.1
Classification
- Weakness
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
References
- securityfocus.com /bid/94352 · vdb-entry, x_refsource_BID, x_transferred
- speakerdeck.com /patrickwardle/defcon-2016-i-got-99-problems-but-little-snitch-aint-one · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2016-8661
- NVD: CVE-2016-8661
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.