CVE-2013-3955

Severity: medium (CVSS 6.2 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2013-06-05 · updated 2026-06-16
Weakness: CWE-20

Description

The get_xattrinfo function in the XNU kernel in Apple iOS 5.x and 6.x through 6.1.3 on iPad devices does not properly validate the header of an AppleDouble file, which might allow local users to cause a denial of service (memory corruption) or have unspecified other impact via an invalid file on an msdosfs filesystem.

Affected products

Apple Ipad: all versions
Apple Ipad2: all versions
Apple Ipad Mini: all versions
Apple Iphone Os: 5.0, 5.0.1, 5.1, 5.1.1, 6.0, 6.0.1 (+4)

References

http://antid0te.com/syscan_2013/SyScan2013_Mountain_Lion_iOS_Vulnerabilities_Garage_Sale_Whitepaper.pdf
http://lists.apple.com/archives/security-announce/2013/Sep/msg00006.html
http://support.apple.com/kb/HT5934
http://www.securitytracker.com/id/1029054
http://www.syscan.org/index.php/sg/program/day/2
http://antid0te.com/syscan_2013/SyScan2013_Mountain_Lion_iOS_Vulnerabilities_Garage_Sale_Whitepaper.pdf
http://lists.apple.com/archives/security-announce/2013/Sep/msg00006.html
http://support.apple.com/kb/HT5934
http://www.securitytracker.com/id/1029054
http://www.syscan.org/index.php/sg/program/day/2

Get alerted when CVE-2013-3955 or the next vulnerability affects your stack