CVE-2013-3951

sys/openbsd/stack_protector.c in libc in Apple iOS 6.1.3 and Mac OS X 10.8.x does not properly parse the Apple strings employed in the user-space stack-cookie implementation, which allows local users to bypass cookie randomization by executing a program with a call-path beginning with the stack-guard= substring, as demonstrated by an iOS untethering attack or an attack against a setuid Mac OS X program.

• CWE-20

• http://antid0te.com/syscan_2013/SyScan2013_Mountain_Lion_iOS_Vulnerabilities_Garage_Sale_Whitepaper.pdfExploit
• http://lists.apple.com/archives/security-announce/2015/Sep/msg00001.htmlVendor Advisory
• http://lists.apple.com/archives/security-announce/2015/Sep/msg00005.htmlVendor Advisory
• http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.htmlVendor Advisory
• http://www.securitytracker.com/id/1033703
• http://www.syscan.org/index.php/sg/program/day/2
• https://support.apple.com/HT205212Vendor Advisory
• https://support.apple.com/HT205213Vendor Advisory
• https://support.apple.com/HT205267Vendor Advisory
• http://antid0te.com/syscan_2013/SyScan2013_Mountain_Lion_iOS_Vulnerabilities_Garage_Sale_Whitepaper.pdfExploit
• http://lists.apple.com/archives/security-announce/2015/Sep/msg00001.htmlVendor Advisory
• http://lists.apple.com/archives/security-announce/2015/Sep/msg00005.htmlVendor Advisory
• http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.htmlVendor Advisory
• http://www.securitytracker.com/id/1033703
• http://www.syscan.org/index.php/sg/program/day/2
• https://support.apple.com/HT205212Vendor Advisory
• https://support.apple.com/HT205213Vendor Advisory
• https://support.apple.com/HT205267Vendor Advisory

Published

Jun 5, 2013

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-3945The MrSID plugin (MrSID.dll) before 4.37 for IrfanView allow…7.8
• CVE-2013-3946Heap-based buffer overflow in the MrSID plugin (MrSID.dll) b…7.8
• CVE-2013-3947Buffer overflow in MedCoreD.sys in AhnLab V3 Internet Securi…
• CVE-2013-3948Apple iOS 6.1.3 does not follow redirects during determinati…
• CVE-2013-3949The posix_spawn system call in the XNU kernel in Apple Mac O…
• CVE-2013-3950Stack-based buffer overflow in the openSharedCacheFile funct…
• CVE-2013-3952The fill_pipeinfo function in bsd/kern/sys_pipe.c in the XNU…
• CVE-2013-3953The mach_port_space_info function in osfmk/ipc/mach_debug.c …
• CVE-2013-3954The posix_spawn system call in the XNU kernel in Apple Mac O…
• CVE-2013-3955The get_xattrinfo function in the XNU kernel in Apple iOS 5.…
• CVE-2013-3956The NICM.SYS kernel driver 3.1.11.0 in Novell Client 4.91 SP…
• CVE-2013-3957SQL injection vulnerability in the login screen in the Web N…