Description
HelpViewer in Mac OS X 10.3.3 and 10.2.8 processes scripts that it did not initiate, which can allow attackers to execute arbitrary code, an issue that was originally reported as a directory traversal vulnerability in the Safari web browser using the runscript parameter in a help: URI handler.
Exploits (1)
exploitdb
WORKING POC
VERIFIED
by Troels Bay · textremoteosx
https://www.exploit-db.com/exploits/24121
References (9)
Core 9
Core References
Patch, Third Party Advisory, US Government Resource third-party-advisory
x_refsource_cert-vn
http://www.kb.cert.org/vuls/id/578798
Patch, Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/11622/
Mailing List vendor-advisory
x_refsource_apple
http://lists.apple.com/mhonarc/security-announce/msg00053.html
Exploit, Patch, Vendor Advisory vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/10356
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://www.osvdb.org/6184
Third Party Advisory mailing-list
x_refsource_fulldisc
http://archives.neohapsis.com/archives/fulldisclosure/2004-05/0837.html
Vendor Advisory x_refsource_misc
http://www.fundisom.com/owned/warning
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/16166
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://securitytracker.com/id?1010167
Scores
EPSS
0.1388
EPSS Percentile
94.4%
Details
Status
published
Products (8)
apple/mac_os_x
10.3
apple/mac_os_x
10.3.1
apple/mac_os_x
10.3.2
apple/mac_os_x
10.3.3
apple/mac_os_x_server
10.3
apple/mac_os_x_server
10.3.1
apple/mac_os_x_server
10.3.2
apple/mac_os_x_server
10.3.3
Published
Jul 07, 2004
Tracked Since
Feb 18, 2026