关联漏洞
标题：
Apple iOS和Apple TV 缓冲区溢出漏洞
(CVE-2014-4378)
描述：Apple iOS和Apple TV都是美国苹果（Apple）公司的产品。Apple iOS是为移动设备所开发的一套操作系统；Apple TV是一款高清电视机顶盒产品。 Apple iOS 7.1.2及之前版本和Apple TV 6.2及之前版本的CoreGraphics中存在安全漏洞。远程攻击者可通过特制的PDF文档利用该漏洞获取敏感信息或造成拒绝服务（越边界读或应用程序崩溃）。
介绍
CoreGraphics Information Disclosure - CVE-2014-4378
===================================================
This article explores the exploitability of MobileSafari on IOS 7.1.x. Using a crafted PDF file as an HTML image makes it possible to leak information about the memory layout to the browser Javascript interpreter. Apple CoreGraphics library fails to validate input when parsing the colorspace specification of an inline image embedded in a PDF content stream. he issue results in an information leak vulnerability that improves the adversary capability of exploit other vulnerabilities in any application linked with this library. This is also proved useful to bypass a several exploit mitigations such as ASLR, DEP and CodeSigning.
Sumary:
=======
* Title: Apple CoreGraphics Information Disclosure
* CVE Name: CVE-2014-4378
* Permalink: http://blog.binamuse.com/2014/09/coregraphics-information-disclosure.html
* Date published: 2014-09-18
* Date of last update: 2014-09-18
* Class: Client side / Out of bounds memory read
* Advisory: HT6441 HT6443
文件快照
[4.0K] /data/pocs/5e6c31d09fc7863e979df363680e941e90782f54
├── [4.0K] cgi-bin
│ ├── [ 78] leak_code.pdf
│ └── [ 77] leak_data.pdf
├── [9.1K] index.html
├── [1.0K] LICENSE
├── [3.6K] miniPDF.py
├── [ 10K] mkLeakCode.py
├── [1.9K] mkLeakData.py
├── [7.3K] PORTING
├── [1.0K] README.md
├── [ 622] run.py
└── [4.0K] tools
├── [ 948] calcbase.py
└── [4.3K] gadgets.py
2 directories, 12 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。