Heise Security has discovered a bug in mach_loader.c that can cause a Kernel panic. An integer overflow in the load_threadstack function can be induced when Mach-O binaries are processed.

This issue is only found in the OSX 10.4.11 update, in Leopard 10.5 and 10.5.1. Although CVE says it’s in all 10.4 versions. Another important factor is that this can not be run remotely. Users have to have direct access to the machine either via Keyboard and Mouse or with Apple Remote Desktop. So pretty much the average user doesn’t have to worry about this vulnerability.

The bad news is that if the average user is hit with it, it looks like it’d take a reinstall of OS X to fix. Luckily Apple’s Archive and Install feature is pretty good and simple.

No related posts.