CVE-2018-10404

An issue was discovered in Objective-See KnockKnock, LuLu, TaskExplorer, WhatsYourSign, and procInfo. A maliciously crafted Universal/fat binary can evade third-party code signing checks. By not completing full inspection of the Universal/fat binary, the user of the third-party tool will believe...

CVE-2018-10405: Improper Certificate Validation

An issue was discovered in Google Santa and molcodesignchecker. A maliciously crafted Universal/fat binary can evade third-party code signing checks. By not completing full inspection of the Universal/fat binary, the user of the third-party tool will believe that the code is signed by Apple, but...

CVE-2018-10407: Improper Verification of Cryptographic Signature

An issue was discovered in Carbon Black Cb Response. A maliciously crafted Universal/fat binary can evade third-party code signing checks. By not completing full inspection of the Universal/fat binary, the user of the third-party tool will believe that the code is signed by Apple, but the malicio...

CVE-2018-10408: Improper Certificate Validation

An issue was discovered in VirusTotal. A maliciously crafted Universal/fat binary can evade third-party code signing checks. By not completing full inspection of the Universal/fat binary, the user of the third-party tool will believe that the code is signed by Apple, but the malicious unsigned co...

CVE-2018-10406: Improper Certificate Validation

An issue was discovered in Yelp OSXCollector. A maliciously crafted Universal/fat binary can evade third-party code signing checks. By not completing full inspection of the Universal/fat binary, the user of the third-party tool will believe that the code is signed by Apple, but the malicious...

Code injection

Little Snitch versions 4.0 to 4.0.6 use the SecStaticCodeCheckValidityWithErrors function without the kSecCSCheckAllArchitectures flag and therefore do not validate all architectures stored in a fat binary. An attacker can maliciously craft a fat binary containing multiple architectures that may...

CVE-2018-10470

Little Snitch versions 4.0 to 4.0.6 use the SecStaticCodeCheckValidityWithErrors function without the kSecCSCheckAllArchitectures flag and therefore do not validate all architectures stored in a fat binary. An attacker can maliciously craft a fat binary containing multiple architectures that may...

CVE-2018-10470

Summary: CVE-2018-10470 affects Objective Development Little Snitch 4.0–4.0.6. The root cause is failing to pass the kSecCSCheckAllArchitectures flag to SecStaticCodeCheckValidityWithErrors(), so fat binaries with multiple architectures may cause the running process to appear unsigned while the o...

CVE-2018-10470

Little Snitch versions 4.0 to 4.0.6 use the SecStaticCodeCheckValidityWithErrors function without the kSecCSCheckAllArchitectures flag and therefore do not validate all architectures stored in a fat binary. An attacker can maliciously craft a fat binary containing multiple architectures that may...

CVE-2018-10470: Improper Verification of Cryptographic Signature

Little Snitch versions 4.0 to 4.0.6 use the SecStaticCodeCheckValidityWithErrors function without the kSecCSCheckAllArchitectures flag and therefore do not validate all architectures stored in a fat binary. An attacker can maliciously craft a fat binary containing multiple architectures that may...