cve/2014/CVE-2014-9862.md

CVE-2014-9862

Description

Integer signedness error in bspatch.c in bspatch in bsdiff, as used in Apple OS X before 10.11.6 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via a crafted patch file.

POC

Reference

• http://seclists.org/fulldisclosure/2020/Jul/8
• http://www.openwall.com/lists/oss-security/2020/07/09/2

Github

• https://github.com/VGtalion/bsdiff
• https://github.com/petervas/bsdifflib