CVE-2005-1331 Code injection in n/a
Remote attackers can trick users into executing malicious code by exploiting AppleScript Editor's improper display of applescript URIs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2005-1331?
CVE-2005-1331 is a medium-severity code injection vulnerability in Apple Mac Os X, published on 4 May 2005. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The AppleScript Editor in Mac OS X 10.3.9 does not properly display script code for an applescript: URI, which can result in code that is different than the actual code that would be run, which could allow remote attackers to trick users into executing malicious code via certain URI characters such as NULL, control characters, and homographs.
Which versions are affected by CVE-2005-1331?
It affects 3 products.
Products include Apple Applescript, Apple Mac Os X, Apple Mac Os X Server.
How do I fix CVE-2005-1331?
No fix has been published for CVE-2005-1331 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2005-1331 being exploited?
There is no known exploitation of CVE-2005-1331 in the wild and no public exploit code.
Other vulnerabilities in Apple Mac Os X
Sources
Also known as GHSA-6qxm-23hq-hvpc.