CVE-2008-2310

Summary

CVE	CVE-2008-2310
State	PUBLISHED
Assigner	mitre
Source Priority	CVE Program / NVD first with legacy fallback
Published	2008-07-01 18:41:00 UTC
Updated	2026-04-23 00:35:47 UTC
Description	Format string vulnerability in c++filt in Apple Mac OS X 10.5 before 10.5.4 allows user-assisted attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted string in (1) C++ or (2) Java source code.

Primary CVSS: v2.0 6.8 from [email protected]

AV:N/AC:M/Au:N/C:P/I:P/A:P

Problem Types: CWE-134 | n/a

Access Vector

Network

Access Complexity

Medium

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

AV:N/AC:M/Au:N/C:P/I:P/A:P

Type	Vendor	Product	Version	Update	Edition	Language
Operating System	Apple	Mac Os X	10.4.1	All	All	All
Operating System	Apple	Mac Os X	10.4.10	All	All	All
Operating System	Apple	Mac Os X	10.4.11	All	All	All
Operating System	Apple	Mac Os X	10.4.2	All	All	All
Operating System	Apple	Mac Os X	10.4.3	All	All	All
Operating System	Apple	Mac Os X	10.4.4	All	All	All
Operating System	Apple	Mac Os X	10.4.5	All	All	All
Operating System	Apple	Mac Os X	10.4.6	All	All	All
Operating System	Apple	Mac Os X	10.4.7	All	All	All
Operating System	Apple	Mac Os X	10.4.8	All	All	All
Operating System	Apple	Mac Os X	10.4.9	All	All	All
Operating System	Apple	Mac Os X	10.5	All	All	All
Operating System	Apple	Mac Os X	10.5.1	All	All	All
Operating System	Apple	Mac Os X	10.5.2	All	All	All
Operating System	Apple	Mac Os X	All	All	All	All
Operating System	Apple	Mac Os X Server	10.4.1	All	All	All
Operating System	Apple	Mac Os X Server	10.4.10	All	All	All
Operating System	Apple	Mac Os X Server	10.4.11	All	All	All
Operating System	Apple	Mac Os X Server	10.4.2	All	All	All
Operating System	Apple	Mac Os X Server	10.4.3	All	All	All
Operating System	Apple	Mac Os X Server	10.4.4	All	All	All
Operating System	Apple	Mac Os X Server	10.4.5	All	All	All
Operating System	Apple	Mac Os X Server	10.4.6	All	All	All
Operating System	Apple	Mac Os X Server	10.4.7	All	All	All
Operating System	Apple	Mac Os X Server	10.4.8	All	All	All
Operating System	Apple	Mac Os X Server	10.4.9	All	All	All
Operating System	Apple	Mac Os X Server	10.5	All	All	All
Operating System	Apple	Mac Os X Server	10.5.1	All	All	All
Operating System	Apple	Mac Os X Server	10.5.2	All	All	All
Operating System	Apple	Mac Os X Server	All	All	All	All

Source	Vendor	Product	Version	Platforms
CNA	Na	N/a	affected n/a	Not specified

Reference	Source	Link	Tags
About the security content of Security Update 2008-004 and Mac OS X 10.5.4	af854a3a-2127-422b-91ae-364da2661108	support.apple.com	Patch
IBM X-Force Exchange	af854a3a-2127-422b-91ae-364da2661108	exchange.xforce.ibmcloud.com
Mac OS X Format String Flaw in c++filt() Lets Users Execute Arbitrary Code - SecurityTracker	af854a3a-2127-422b-91ae-364da2661108	securitytracker.com
Apple Mac OS X 2008-004 Multiple Security Vulnerabilities	af854a3a-2127-422b-91ae-364da2661108	www.securityfocus.com
APPLE-SA-2008-06-30 Security Update 2008-004 and Mac OS X v10.5.4	af854a3a-2127-422b-91ae-364da2661108	lists.apple.com
Apple Mac OS X Security Update Fixes Multiple Vulnerabilities - Secunia Advisories - Vulnerability Intelligence - Secunia.com	af854a3a-2127-422b-91ae-364da2661108	secunia.com	Vendor Advisory
Webmail : Solution de messagerie professionnelle - OVHcloud- OVH	af854a3a-2127-422b-91ae-364da2661108	www.vupen.com
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

Organization	Published	Contributor	Statement
Red Hat	2008-07-04	Mark J Cox	Not vulnerable. This issue does not affect the version of c++filt as shipped with binutils in Red Hat Enterprise Linux 3 or 4. Although this bug is present in the version of c++filt as shipped with binutils in Red Hat Enterprise Linux 5, the format string protection from FORTIFY_SOURCE makes this unexploitable.

There are currently no legacy QID mappings associated with this CVE.