MacOS 10.12 - 'task_t' Privilege Escalation Exploit

Exploit for macOS platform in category local exploits Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=837 TL;DR you cannot hold or use a task struct pointer and expect the euid of that task to stay the same. Many many places in the kernel do this and there are a great many very...

Apple OS XiOS Kernel - IOSurface Use-After-Free

Apple OS XiOS Kernel - IOSurface Use-After-Free Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=831 IOSurfaceRootUserClient stores a task struct pointer passed in via IOServiceOpen in the field at +0xf0 without taking a reference. By killing the corrisponding task we can free th...

Apple macOS 10.12 - task_t Local Privilege Escalation

Apple macOS 10.12 - taskt Local Privilege Escalation Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=837 TL;DR you cannot hold or use a task struct pointer and expect the euid of that task to stay the same. Many many places in the kernel do this and there are a great many very...

The vulnerability of the Mac OS X operating system, which allows a hacker to increase their privileges

The vulnerability of the IOSurface component in the Mac OS X operating system is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker, operating locally, to increase their privileges using undefined vectors...

Apple OS X El Capitan IOSurface Memory Misreference Vulnerability

Apple OS X is a specialized operating system developed for Mac computers. A memory misreference vulnerability exists in IOSurface for Apple OS X El Capitan 1, which can be exploited by a local attacker to elevate privileges...

CVE-2016-4625

Use-after-free vulnerability in IOSurface in Apple OS X before 10.11.6 allows local users to gain privileges via unspecified vectors...

CVE-2016-4625

Use-after-free vulnerability in IOSurface in Apple OS X before 10.11.6 allows local users to gain privileges via unspecified vectors...

Design/Logic Flaw

Use-after-free vulnerability in IOSurface in Apple OS X before 10.11.6 allows local users to gain privileges via unspecified vectors...

CVE-2016-4625

Use-after-free vulnerability in IOSurface in Apple OS X before 10.11.6 allows local users to gain privileges via unspecified vectors...

CVE-2016-4625

CVE-2016-4625 is a local privilege escalation in Apple macOS OS X El Capitan involving IOSurface. A use-after-free in IOSurface leads to kernel- or system-level code execution with local access prior to patch. Affected: OS X El Capitan v10.11 (and related 10.11.x builds) before 10.11.6; patch sup...

The vulnerability of the OS X operating system, which allows a malicious attacker to execute arbitrary code.

The vulnerability of the IOSurface component allows a remote attacker to execute arbitrary code with elevated privileges using a malicious application that exploits type mismatch errors...

The vulnerability of the iOS operating system, which allows a malicious attacker to execute arbitrary code.

The vulnerability of the IOSurface component allows a remote attacker to execute arbitrary code with elevated privileges using a malicious application that exploits type mismatch errors...

Design/Logic Flaw

CoreAnimation in Apple iOS before 9 allows attackers to bypass intended IOSurface restrictions and obtain screen-framebuffer access via a crafted background app...

CVE-2015-5880

CoreAnimation in Apple iOS before 9 allows attackers to bypass intended IOSurface restrictions and obtain screen-framebuffer access via a crafted background app...

CVE-2015-5880

CVE-2015-5880 affects Apple iOS CoreAnimation, where a background app could bypass IOSurface restrictions and obtain screen-framebuffer access. The root cause is insufficient access control on IOSurfaces prior to the fix, enabling potential exposure of screen content. Public details in connected ...

Apple TV < 7.0.4 Multiple Vulnerabilities

Binary data 8674.prm...

Mac OS X < 10.10.3 Multiple Vulnerabilities

Binary data 8672.prm...

APPLE-SA-2015-03-19-1 Security Update 2015-003

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2015-03-19-1 Security Update 2015-003 Security Update 2015-003 is now available and addresses the following: iCloud Keychain Available for: OS X Yosemite v10.10.2 Impact: An attacker with a privileged network position may be able to execute...

Mac OS X Multiple Vulnerabilities (Security Update 2015-003)

The remote host is running a version of Mac OS X 10.10.2 that is missing Security Update 2015-003. It is, therefore, affected by the following vulnerabilities : - A type confusion flaw exists in how IOSurface handles serialized objects, which an attacker can use to execute arbitrary code with...

APPLE-SA-2015-03-09-1 iOS 8.2

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2015-03-09-1 iOS 8.2 iOS 8.2 is now available and addresses the following: CoreTelephony Available for: iPhone 4s and later, iPod touch 5th generation and later, iPad 2 and later Impact: A remote attacker can cause a device to unexpectedly...