CVE-2016-4752

The SecKeyDeriveFromPassword function in Apple OS X before 10.12 does not use the CFRETURNSRETAINED keyword, which allows attackers to obtain sensitive information from process memory by triggering key derivation...

CVE-2016-4752

CVE-2016-4752 affects Apple OS X pre-10.12. The issue is in the SecKeyDeriveFromPassword function, where the CF_RETURNS_RETAINED keyword was not used, enabling memory handling that may allow memory content to be leaked or exposed during key derivation. The connected Apple security content confirm...