About the security content of macOS Ventura 13.6

About the security content of macOS Ventura 13.6 This document describes the security content of macOS Ventura 13.6. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases...

About the security content of macOS Monterey 12.7

About the security content of macOS Monterey 12.7 This document describes the security content of macOS Monterey 12.7. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or release...

PT-2023-5658 · Apple · Macos Monterey +8

Name of the Vulnerable Software and Affected Versions: macOS Ventura versions prior to 13.6 tvOS versions prior to 17 iOS versions prior to 16.7 iPadOS versions prior to 16.7 macOS Monterey versions prior to 12.7 watchOS versions prior to 10 iOS versions prior to 17 iPadOS versions prior to 17...

The vulnerability of the libxpc library in iOS, iPadOS, macOS Big Sur, macOS Monterey, watchOS, and macOS Ventura allows attackers to elevate their privileges to the root level.

The vulnerability of the libxpc library in iOS, iPadOS, macOS Big Sur, macOS Monterey, watchOS, and macOS Ventura systems is related to the use of an insecure search path. Exploiting this vulnerability allows an attacker to elevate their privileges to the root level...

PT-2023-4191 · Apple · Libxpc +1

Name of the Vulnerable Software and Affected Versions: libxpc versions prior to macOS Monterey 12.6.8 libxpc versions prior to iOS 16.6 libxpc versions prior to iPadOS 16.6 libxpc versions prior to macOS Big Sur 11.7.9 libxpc versions prior to macOS Ventura 13.5 libxpc versions prior to watchOS 9...

PT-2023-4190 · Apple · Macos Monterey +7

Name of the Vulnerable Software and Affected Versions: macOS Monterey versions prior to 12.6.8 iOS versions prior to 16.6 iPadOS versions prior to 16.6 macOS Big Sur versions prior to 11.7.9 macOS Ventura versions prior to 13.5 watchOS versions prior to 9.6 Description: A logic issue was addresse...

About the security content of tvOS 16.6

About the security content of tvOS 16.6 This document describes the security content of tvOS 16.6. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available...

Microsoft gives Apple a migraine

On May 18, 2023, Apple published security content for macOS Ventura 13.4, macOS Monterey 12.6.6, and macOS Big Sur 11.7.7 that addressed a logic issue in libxpc. The Common Vulnerabilities and Exposures CVE database lists publicly disclosed computer security flaws. The CVE we are going to discuss...

The vulnerability of the libxpc library in MacOS operating systems allows a hacker to execute arbitrary code with root privileges.

The vulnerability of the libxpc library in MacOS operating systems is related to insecure management of privileges. Exploiting this vulnerability could allow an attacker to execute arbitrary code with root privileges...

The vulnerability of the libxpc library in MacOS operating systems allows attackers to modify any part of the file system at will.

The vulnerability of the libxpc library in MacOS operating systems is related to insecure management of privileges. Exploiting this vulnerability could allow an attacker to modify arbitrary parts of the file system...

PT-2023-2894 · Apple · Macos Monterey +4

Name of the Vulnerable Software and Affected Versions: macOS Big Sur versions 11.7.7 and earlier macOS Monterey versions 12.6.6 and earlier macOS Ventura versions 13.4 and earlier Description: A logic issue was addressed with improved checks, which may allow an app to gain root privileges. The...

PT-2023-2900 · Apple · Libxpc +1

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 11.7.7 macOS versions prior to 12.6.6 macOS versions prior to 13.4 Description: The issue is related to a logic problem with improved state management, allowing an app to modify protected parts of the file system. This...

The vulnerability of the libxpc library in operating systems such as Mac OS, tvOS, iOS, iPadOS, and watchOS allows attackers to escalate their privileges.

The vulnerability of the libxpc library in Mac OS, tvOS, iOS, iPadOS, and watchOS is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow attackers to gain increased privileges...

Apple OS X libxpc Arbitrary File Overwrite Vulnerability

Apple OS X is a specialized operating system developed by Apple for Mac computers. A security vulnerability exists in OS X libxpc due to a product design flaw that does not restrict file uploads, which allows malicious applications to overwrite arbitrary files. No details of the vulnerability are...

In-the-wild iOS Exploit Chain 3

Posted by Ian Beer, Project Zero TL;DR This chain targeted iOS 11-11.4.1, spanning almost 10 months. This is the first chain we observed which had a separate sandbox escape exploit. The sandbox escape vulnerability was a severe security regression in libxpc, where refactoring lead to a bounds che...

Multiple Apple products libxpc component memory corruption vulnerability (CNVD-2019-12499)

Apple iOS is an operating system developed for mobile devices. apple tvOS is an operating system for smart TVs. apple macOS High Sierra is a specialized operating system developed for Mac computers. libxpc is one of the open source implementation of the AppleXPC library. A security vulnerability...

Multiple Apple Products libxpc Component Out-of-Bounds Read Vulnerability

Apple iOS is an operating system developed for mobile devices. apple tvOS is an operating system for smart TVs. apple macOS High Sierra is a specialized operating system developed for Mac computers. libxpc is one of the open source implementation of the AppleXPC library. An out-of-bounds read...

macOS < 10.14.3 / iOS < 12.1.3 - Arbitrary mach Port Name Deallocation in XPC Services due to Invalid mach Message Parsing in _xpc_serializer_unpack

/ xpcserializerunpack in libxpc parses mach messages which contain xpc messages. There are two reasons for an xpc mach message to contain descriptors: if the message body is large, then it's sent as a MACHMSGOOLDESCRIPTOR. Also if the message contains other port resources eg memory entry ports th...

macOS and Mac OS X Multiple Vulnerabilities (Security Update 2019-001)

The remote host is running Mac OS X 10.12.6 and is missing a security update. It is therefore, affected by multiple vulnerabilities in the following components: - CoreAnimation - Hypervisor - Intel Graphics Driver - IOKit - Kernel - libxpc - QuartzCore C Tenable Network Security, Inc...

macOS 10.13.6 Multiple Vulnerabilities (Security Update 2019-001)

The remote host is running macOS 10.13.6 and is missing a security update. It is therefore, affected by multiple vulnerabilities in the following components: - Bluetooth - Core Media - CoreAnimation - FaceTime - Hypervisor - Intel Graphics Driver - IOKit - Kernel - libxpc - QuartzCore C Tenable...