iOS 10.1.1 / macOS 10.12 16A323 XNU Kernel - set_dp_control_port Lack of Locking Use-After-Free Vuln

Exploit for multiple platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=965 setdpcontrolport is a MIG method on the hostprivport so this bug is a root-kernel escalation. kernreturnt setdpcontrolport hostprivt hostpriv, ipcportt controlport if hostpriv...

Apple macOS 10.12 16A323 XNU Kernel / iOS 10.1.1 - 'set_dp_control_port' Lack of Locking Use-After-Free

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=965 setdpcontrolport is a MIG method on the hostprivport so this bug is a root-kernel escalation. kernreturnt setdpcontrolport hostprivt hostpriv, ipcportt controlport if hostpriv == HOSTPRIVNULL return KERNINVALIDHOST; if...

macOS 10.12.x < 10.12.2 Multiple Vulnerabilities

The remote host is running a version of macOS that is 10.12.x prior to 10.12.2. It is, therefore, affected by multiple vulnerabilities in the following components : - apachemodphp - AppleGraphicsPowerManagement - Assets - Audio - Bluetooth - CoreCapture - CoreFoundation - CoreGraphics - CoreMedia...

MacOS 10.12 - 'task_t' Privilege Escalation Exploit

Exploit for macOS platform in category local exploits Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=837 TL;DR you cannot hold or use a task struct pointer and expect the euid of that task to stay the same. Many many places in the kernel do this and there are a great many very...

Apple macOS 10.12 - 'task_t' Local Privilege Escalation

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=837 TL;DR you cannot hold or use a task struct pointer and expect the euid of that task to stay the same. Many many places in the kernel do this and there are a great many very exploitable bugs as a result. taskt is just a typedef...

Apple Mac OS X 10.12/iOS 10 SecureTransport SSL handshake OCSP MiTM and DoS

Exploit for macOS platform in category dos / poc Apple macOS 10.12/iOS 10 SecureTransport SSL handshake OCSP MiTM and DoS --- 0. Description ---- The latest macOS and iOS have weak OCSP validation process which allow attacker to send OCSP requests up to 200k in name of victim during MiTM attack...

The Unarchiver 3.11.1 - '.tar.Z' Crash (PoC)

Exploit Title: The Unarchiver 3.11.1 '.tar.Z' Local Crash PoC Date: 10-17-2016 Exploit Author: Antonio Z. Vendor Homepage: http://unarchiver.c3.cx/unarchiver Software Link: http://unarchiver.c3.cx/downloads/TheUnarchiver3.11.1.zip Version: 3.11.1 Tested on: OS X 10.10, OS X 10.11, OS X 10.12 More...

VOX Music Player 2.8.8 - .pls Denial of Service

VOX Music Player 2.8.8 - .pls Denial of Service Exploit Title: VOX Music Player 2.8.8 '.pls' Local Crash PoC Date: 10-12-2016 Exploit Author: Antonio Z. Vendor Homepage: http://coppertino.com/vox/mac/ Software Link: http://dl.devmate.com/com.coppertino.Vox/Vox.dmg Version: 2.8.8 Tested on: OS X...

Apple OS X libarchive Memory Corruption Vulnerability

Apple OS X is a specialized operating system developed by Apple for Mac computers. libarchive is a multi-format archive and compression library component of it. A memory corruption vulnerability exists in libarchive in Apple OS X versions prior to 10.12, which can be exploited by remote attackers...

CVE-2016-4750

S2 Camera in Apple iOS before 10 and OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service memory corruption via a crafted app...

CVE-2016-4713

CoreDisplay in Apple OS X before 10.12 allows attackers to view arbitrary users' screens by leveraging screen-sharing access...

CVE-2016-4696

AppleEFIRuntime in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service NULL pointer dereference via a crafted app...

Memory corruption

Bluetooth in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service memory corruption via a crafted app...

Memory corruption

Intel Graphics Driver in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service memory corruption via a crafted app...

Null pointer dereference

AppleEFIRuntime in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service NULL pointer dereference via a crafted app...

CVE-2016-4723

Intel Graphics Driver in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service memory corruption via a crafted app...

CVE-2016-4748

CVE-2016-4748 describes a localPrivilege bypass in Perl on macOS OS X before 10.12, where taint-mode protection can be bypassed via a crafted environment variable. The vulnerability affects Perl within macOS/OS X and is documented in Apple’s security content for macOS Sierra 10.12. The connected ...

CVE-2016-4736

CVE-2016-4736 : Apple OS X libarchive before 10.12 is affected. A crafted file can trigger memory corruption, leading to a denial of service (and potentially other impact). Affected component: libarchive in OS X. Root cause: memory corruption via crafted archive handling. Mitigation: apply the ma...

CVE-2016-4727

CVE-2016-4727 relates to IOThunderboltFamily in Apple OS X prior to 10.12. Public sources (NVD and ZDI) describe a local-privilege-escalation/ memory-corruption vulnerability in the IOThunderboltFamily kernel extension. The ZDI advisory specifies the attacker must first run low-privileged code on...

CVE-2016-4717

CVE-2016-4717 affects Apple macOS OS X File Bookmark component. The vulnerability arises because scoped-bookmark file descriptors are mishandled, which can allow a crafted application to cause a denial-of-service in pre-10.12 OS X. The Apple security content for macOS Sierra 10.12 notes the issue...