CVE-2015-3692

Apple Mac EFI before 2015-001, as used in OS X before 10.10.4 and other products, does not enforce a locking protection mechanism upon being woken from sleep, which allows local users to conduct EFI flash attacks by leveraging root privileges.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.8 UNKNOWN
LOCAL
LOW
AV:L/AC:L/Au:S/C:C/I:C/A:C
appleCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 9%
VendorProductVersion
applemac_os_x
𝑥
≤ 10.10.3
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html
http://lists.apple.com/archives/security-announce/2015/Jun/msg00003.html
http://support.apple.com/kb/HT204934
http://support.apple.com/kb/HT204942
http://www.securityfocus.com/bid/75495
http://www.securitytracker.com/id/1032444
http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html
http://lists.apple.com/archives/security-announce/2015/Jun/msg00003.html
http://support.apple.com/kb/HT204934
http://support.apple.com/kb/HT204942
http://www.securityfocus.com/bid/75495
http://www.securitytracker.com/id/1032444