CVE-2016-7655

An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. The issue involves the "CoreMedia External Displays" component. It allows local users to gain privileges or cause a denial of service type confusion via unspecified vectors...

CVE-2016-7603

An issue was discovered in certain Apple products. macOS before 10.12.2 is affected. The issue involves the "CoreStorage" component. It allows local users to cause a denial of service NULL pointer dereference via unspecified vectors...

CVE-2016-7625

An issue was discovered in certain Apple products. macOS before 10.12.2 is affected. The issue involves the "IOKit" component. It allows local users to obtain sensitive kernel memory-layout information via unspecified vectors...

CVE-2016-4683

An issue was discovered in certain Apple products. macOS before 10.12.1 is affected. The issue involves the "ImageIO" component. It allows remote attackers to execute arbitrary code or cause a denial of service out-of-bounds memory access and application crash via a crafted SGI file...

Apple macOS Sierra Graphics Driver Memory Corruption Vulnerability

Apple macOS Sierra is a specialized operating system developed by Apple for Mac computers.Graphics Driver is one of the graphics driver components. A memory corruption vulnerability exists in Graphics Driver in Apple macOS Sierra. The vulnerability can be exploited by an application to execute...

Apple macOS 10.12.1 iOS Kernel - host_self_trap Use-After-Free

Apple macOS 10.12.1 iOS Kernel - hostselftrap Use-After-Free / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1034 The task struct has a lock itklockdata, taken via the itklock macros which is supposed to protect the task-itk ports. The hostselftrap mach trap accesses...

Apple macOS 10.12.1 / iOS < 10.2 - powerd Arbitrary Port Replacement

/ Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=976 powerd running as root hosts the com.apple.PowerManagement.control mach service. It checks in with launchd to get a server port and then wraps that in a CFPort: pmServerMachPort = SCCFMachPortCreateWithPort "PowerManagement",...

Apple macOS < 10.12.2 / iOS < 10.2 - Broken Kernel Mach Port Name uref Handling Privileged Port Name Replacement Privilege Escalation

/ Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=959 Proofs of Concept: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40957.zip When sending and receiving mach messages from userspace there are two important kernel objects; ipcentry and...

Apple macOS Security Bypass Vulnerability

Apple macOS is a specialized operating system developed by Apple for Mac computers. A security bypass vulnerability exists in Apple macOS. An attacker could use this vulnerability to bypass security restrictions and perform unauthorized operations...

Apple macOS Sierra Mail Denial of Service Vulnerability

Apple macOS Sierra is a dedicated operating system for Mac computers developed by Apple Inc. Mail is one of the mail modules. A denial of service vulnerability exists in Mail in Apple macOS Sierra versions prior to 10.12.1. An attacker can exploit this vulnerability to cause a denial of service v...

Apple macOS 10.12 - 'task_t' Local Privilege Escalation

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=837 TL;DR you cannot hold or use a task struct pointer and expect the euid of that task to stay the same. Many many places in the kernel do this and there are a great many very exploitable bugs as a result. taskt is just a typedef...

Apple macOS Sierra ATS memory corruption vulnerability

Apple macOS Sierra is a specialized operating system developed for Mac computers. A memory corruption vulnerability exists in the ATS of Apple macOS Sierra, allowing remote attackers to exploit the vulnerability to build malicious applications that execute arbitrary code with kernel privileges...

Apple macOS Sierra NVIDIA Graphics Drivers Memory Corruption Vulnerability

Apple macOS Sierra is a specialized operating system developed for Mac computers. A memory corruption vulnerability exists in NVIDIA Graphics Drivers in Apple macOS Sierra, which allows remote attackers to exploit the vulnerability to build malicious applications that can execute arbitrary code...

Apple macOS 10.12.1 / iOS 10 SecureTransport SSL Handshake MitM / DoS

Apple macOS 10.12.1/iOS 10 SecureTransport SSL handshake OCSP MiTM and DoS Credit: Maksymilian Arciemowicz https://cxsecurity.com/ URL: https://cxsecurity.com/issue/WLB-2016100213 --- 0. Description ---- The latest macOS and iOS have weak OCSP validation process which allow attacker to send OCSP...

Apple OS X DiskArbitration Arbitrary Code Execution Vulnerability

Apple OS X is a suite of operating systems developed by Apple for Mac computers.Address Book is an address book or contact framework.DiskArbitration is a component that handles disk mounting.... An arbitrary code execution vulnerability exists in diskutil in DiskArbitration in Apple OS X versions...

Apple OS X Information Disclosure Vulnerability (CNVD-2016-08245)

Apple OS X is a specialized operating system developed by Apple for Mac computers. The SecKeyDeriveFromPassword function in Apple OS X versions prior to 10.12 has an information disclosure vulnerability that can be exploited by an attacker to gain access to sensitive information in process memory...

CVE-2016-4703

Bluetooth in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service memory corruption via a crafted app...

CVE-2016-4701

Application Firewall in Apple OS X before 10.12 allows local users to cause a denial of service via vectors involving a crafted SOEXECPATH environment variable...

Apple OS X QuickTime memory corruption vulnerability (CNVD-2016-05733)

Apple OS X is a proprietary operating system developed by Apple for Mac computers, with QuickTime as one of the multimedia playback components. A memory corruption vulnerability exists in QuickTime in Apple OS X versions prior to 10.11.6. A remote attacker could exploit this vulnerability to...

Apple OS X CFNetwork Information Disclosure Vulnerability

Apple OS X is a specialized operating system developed for Mac computers. Apple OS X's CFNetwork uses weak privileges on web-browser cookies. A local attacker could exploit this vulnerability to obtain sensitive information...