CVE-2012-3749

The extensions APIs in the kernel in Apple iOS before 6.0.1 provide kernel addresses in responses that contain an OSBundleMachOHeaders key, which makes it easier for remote attackers to bypass the ASLR protection mechanism via a crafted app.

Published: Nov 3, 2012
Updated: Nov 9, 2025
CVE: CVE-2012-3749
Severity: Medium
Exploit:

CVSS v2:

Severity: Medium
Score: 5
AV:N/AC:L/Au:N/C:P/I:N/A:N

CWEs:

CWE-200

Affected Software
References

Software	From	Fixed in
apple / iphone_os	3.0	3.0.x
apple / iphone_os	3.2	3.2.x
apple / iphone_os	3.1.3	3.1.3.x
apple / iphone_os	1.0.2	1.0.2.x
apple / iphone_os	4.3.2	4.3.2.x
apple / iphone_os	4.0.2	4.0.2.x
apple / iphone_os	2.2	2.2.x
apple / iphone_os	1.1.1	1.1.1.x
apple / iphone_os	4.2.8	4.2.8.x
apple / iphone_os	4.1	4.1.x
apple / iphone_os	2.0.0	2.0.0.x
apple / iphone_os	3.1.2	3.1.2.x
apple / iphone_os	3.0.1	3.0.1.x
apple / iphone_os	-	6.0.x
apple / iphone_os	4.3.1	4.3.1.x
apple / iphone_os	4.2.5	4.2.5.x
apple / iphone_os	1.1.2	1.1.2.x
apple / iphone_os	3.1	3.1.x
apple / iphone_os	1.1.3	1.1.3.x
apple / iphone_os	1.1.0	1.1.0.x
apple / iphone_os	1.0.1	1.0.1.x
apple / iphone_os	2.1	2.1.x
apple / iphone_os	4.3.5	4.3.5.x
apple / iphone_os	4.2.1	4.2.1.x
apple / iphone_os	1.1.5	1.1.5.x
apple / iphone_os	4.0.1	4.0.1.x
apple / iphone_os	4.3.3	4.3.3.x
apple / iphone_os	5.0.1	5.0.1.x
apple / iphone_os	2.1.1	2.1.1.x
apple / iphone_os	1.1.4	1.1.4.x
apple / iphone_os	5.0	5.0.x
apple / iphone_os	1.0.0	1.0.0.x
apple / iphone_os	5.1.1	5.1.1.x
apple / iphone_os	2.0.2	2.0.2.x
apple / iphone_os	2.0	2.0.x
apple / iphone_os	2.0.1	2.0.1.x
apple / iphone_os	4.0	4.0.x
apple / iphone_os	4.3.0	4.3.0.x
apple / iphone_os	2.2.1	2.2.1.x
apple / iphone_os	3.2.1	3.2.1.x
apple / iphone_os	3.2.2	3.2.2.x

Vulnerability Database

324,381

CVE-2012-3749

Deep Security Visibility Without the Complexity