Integer overflow

Integer overflow in the ffsmountfs function in Mac OS X 10.4.8 and FreeBSD 6.1 allows local users to cause a denial of service panic and possibly gain privileges via a crafted DMG image that causes "allocation of a negative size buffer" leading to a heap-based buffer overflow, a related issue to...

CVE-2007-0229

CVE-2007-0229 involves an integer overflow in the ffs_mountfs() function used by Mac OS X 10.4.8 and FreeBSD 6.1 when mounting UFS disk images. A crafted DMG image can trigger a heap-based buffer overflow, potentially causing a denial of service and, per sources, possibly privilege escalation; ho...