Medium 4.0Published Aug 1, 1997

CVE-1999-0524ICMP information such as (1) netmask and (2) timestamp is allowed from arbitrary hosts.

Updated under an hour ago (Nov 2, 2026, 2:40 AM ET)

Does this affect you?

It affects apple mac_os_x and 13 other products. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 32.15%, higher than 98% of scored CVEs. That is high: schedule it on your emergency patch path.

Do this next

Start free and add your stackFree account, 3 products Every CVE for apple mac_os_x Exploited in the last 30 days

ICMP information such as (1) netmask and (2) timestamp is allowed from arbitrary hosts.

CVSS: 4.0 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness (CWE): CWE-200
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 32.15% (percentile 98)
Assigned by: Not given
NVD analysis: Modified
Record last updated: Jun 16, 2026
First seen by InfoSec Signals: Nov 1, 2026

Affected products

Affected products

apple mac_os_x apple:mac_os_x	all versions	NVD
apple macos apple:macos	all versions	NVD
cisco ios cisco:ios	all versions	NVD
hp hp-ux hp:hp-ux	all versions	NVD
hp tru64 hp:tru64	all versions	NVD
ibm aix ibm:aix	all versions	NVD
ibm os2 ibm:os2	all versions	NVD
linux linux_kernel linux:linux_kernel	all versions	NVD
microsoft windows microsoft:windows	all versions	NVD
novell netware novell:netware	all versions	NVD
1–10 of 14

References

References

http://descriptions.securescout.com/tc/11010	broken-link
http://descriptions.securescout.com/tc/11011	broken-link
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705	third-party-advisory
http://kb.vmware.com/selfservice/microsites/search.do?cmd=displayKC&externalId=1434	third-party-advisory
http://www.osvdb.org/95	broken-link
https://exchange.xforce.ibmcloud.com/vulnerabilities/306	third-party-advisory, vdb-entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/322	third-party-advisory, vdb-entry
https://kc.mcafee.com/corporate/index?page=content&id=SB10053	broken-link
https://support.f5.com/csp/article/K15277

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.