cnvd - cnvd-2025-25554

cnvd-2025-25554

Vulnerability from cnvd

Title

Apple Xcode路径处理不当漏洞

Description

Apple Xcode是运行在操作系统Mac OS X上的集成开发工具。 Apple Xcode存在路径处理不当漏洞，攻击者可利用该漏洞导致进程崩溃。

Severity

低

Patch Name

Apple Xcode路径处理不当漏洞的补丁

Patch Description

Apple Xcode是运行在操作系统Mac OS X上的集成开发工具。 Apple Xcode存在路径处理不当漏洞，攻击者可利用该漏洞导致进程崩溃。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

目前厂商已发布升级程序修复该安全问题，详情见厂商官网: https://support.apple.com/en-us/125117

Reference

https://nvd.nist.gov/vuln/detail/CVE-2025-43370

Impacted products

Name
Apple Xcode <26

Show details on source website

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2025-43370",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2025-43370"
    }
  },
  "description": "Apple Xcode\u662f\u8fd0\u884c\u5728\u64cd\u4f5c\u7cfb\u7edfMac OS X\u4e0a\u7684\u96c6\u6210\u5f00\u53d1\u5de5\u5177\u3002\n\nApple Xcode\u5b58\u5728\u8def\u5f84\u5904\u7406\u4e0d\u5f53\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u8fdb\u7a0b\u5d29\u6e83\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u7a0b\u5e8f\u4fee\u590d\u8be5\u5b89\u5168\u95ee\u9898\uff0c\u8be6\u60c5\u89c1\u5382\u5546\u5b98\u7f51:\r\nhttps://support.apple.com/en-us/125117",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2025-25554",
  "openTime": "2025-10-28",
  "patchDescription": "Apple Xcode\u662f\u8fd0\u884c\u5728\u64cd\u4f5c\u7cfb\u7edfMac OS X\u4e0a\u7684\u96c6\u6210\u5f00\u53d1\u5de5\u5177\u3002\r\n\r\nApple Xcode\u5b58\u5728\u8def\u5f84\u5904\u7406\u4e0d\u5f53\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u8fdb\u7a0b\u5d29\u6e83\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Apple Xcode\u8def\u5f84\u5904\u7406\u4e0d\u5f53\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Apple Xcode \u003c26"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2025-43370",
  "serverity": "\u4f4e",
  "submitTime": "2025-09-18",
  "title": "Apple Xcode\u8def\u5f84\u5904\u7406\u4e0d\u5f53\u6f0f\u6d1e"
}

CVE-2025-43370 (GCVE-0-2025-43370)

Vulnerability from cvelistv5

Published

2025-09-15 22:34

Modified

2025-11-03 18:12

Severity ?

4.0 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE

Processing an overly large path value may crash a process

Summary

A path handling issue was addressed with improved validation. This issue is fixed in Xcode 26. Processing an overly large path value may crash a process.

References

URL

Tags

https://support.apple.com/en-us/125117

Impacted products

	Vendor	Product	Version
	Apple	Xcode	Version: unspecified < 26

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "LOW",
              "baseScore": 4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-43370",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-16T15:01:11.182130Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-120",
                "description": "CWE-120 Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-16T15:02:24.169Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T18:12:46.055Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://seclists.org/fulldisclosure/2025/Sep/60"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Xcode",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A path handling issue was addressed with improved validation. This issue is fixed in Xcode 26. Processing an overly large path value may crash a process."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Processing an overly large path value may crash a process",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-15T22:34:21.797Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/125117"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2025-43370",
    "datePublished": "2025-09-15T22:34:21.797Z",
    "dateReserved": "2025-04-16T15:24:37.114Z",
    "dateUpdated": "2025-11-03T18:12:46.055Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Log in or create an account to share your comment.

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.