CVE-2009-1237

Severity: medium (CVSS 4.9 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2009-04-02 · updated 2026-06-16
Weakness: CWE-399

Description

Multiple memory leaks in XNU 1228.3.13 and earlier on Apple Mac OS X 10.5.6 and earlier allow local users to cause a denial of service (kernel memory consumption) via a crafted (1) SYS_add_profil or (2) SYS___mac_getfsstat system call.

Affected products

macOS: through 10.5.6; 10.0, 10.0.0, 10.0.1, 10.0.2, 10.0.3, 10.0.4 (+49)
Apple Mac Os X Server: through 10.5.6; 10.0, 10.0.0, 10.0.1, 10.0.2, 10.0.3, 10.0.4 (+48)

References

http://secunia.com/advisories/34424
http://www.digit-labs.org/files/exploits/xnu-macfsstat-leak.c
http://www.digit-labs.org/files/exploits/xnu-profil-leak.c
http://www.informationweek.com/news/hardware/mac/showArticle.jhtml?articleID=216401181
http://www.securityfocus.com/bid/34202
https://www.exploit-db.com/exploits/8263
https://www.exploit-db.com/exploits/8264
http://secunia.com/advisories/34424
http://www.digit-labs.org/files/exploits/xnu-macfsstat-leak.c
http://www.digit-labs.org/files/exploits/xnu-profil-leak.c
http://www.informationweek.com/news/hardware/mac/showArticle.jhtml?articleID=216401181
http://www.securityfocus.com/bid/34202

Get alerted when CVE-2009-1237 or the next vulnerability affects your stack