CVE-2014-1370: Apple Mac OS X

Medium severity, CVSS 6.8. EPSS: 2.2% chance of exploitation in the next 30 days.

The byte-swapping implementation in copyfile in Apple OS X before 10.9.4 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds memory access and application crash) via a crafted AppleDouble file in a ZIP archive.

Affected products

• Apple Mac OS X: up to and including 10.9.3; version 10.7.0 only; version 10.7.1 only; version 10.7.2 only; version 10.7.3 only; version 10.7.4 only; …
• Apple Mac OS X Server: version 10.7.0 only; version 10.7.1 only; version 10.7.2 only; version 10.7.3 only; version 10.7.4 only; version 10.7.5 only

Published 2014-07-01. Last modified 2026-06-17.