Multiple Apple products libxpc component memory corruption vulnerability (CNVD-2019-12499)

Apple iOS is an operating system developed for mobile devices. apple tvOS is an operating system for smart TVs. apple macOS High Sierra is a specialized operating system developed for Mac computers. libxpc is one of the open source implementation of the AppleXPC library. A security vulnerability...

Multiple Apple Products libxpc Component Out-of-Bounds Read Vulnerability

Apple iOS is an operating system developed for mobile devices. apple tvOS is an operating system for smart TVs. apple macOS High Sierra is a specialized operating system developed for Mac computers. libxpc is one of the open source implementation of the AppleXPC library. An out-of-bounds read...

macOS < 10.14.3 / iOS < 12.1.3 - Arbitrary mach Port Name Deallocation in XPC Services due to Invalid mach Message Parsing in _xpc_serializer_unpack

/ xpcserializerunpack in libxpc parses mach messages which contain xpc messages. There are two reasons for an xpc mach message to contain descriptors: if the message body is large, then it's sent as a MACHMSGOOLDESCRIPTOR. Also if the message contains other port resources eg memory entry ports th...

macOS and Mac OS X Multiple Vulnerabilities (Security Update 2019-001)

The remote host is running Mac OS X 10.12.6 and is missing a security update. It is therefore, affected by multiple vulnerabilities in the following components: - CoreAnimation - Hypervisor - Intel Graphics Driver - IOKit - Kernel - libxpc - QuartzCore C Tenable Network Security, Inc...

macOS 10.14.x < 10.14.3 Multiple Vulnerabilities

The remote host is running a version of macOS / Mac OS X that is 10.14.x prior to 10.14.3. It is, therefore, affected by multiple vulnerabilities related to the following components: - AppleKeyStore - Bluetooth - Core Media - CoreAnimation - FaceTime - IOKit - Kernel - libxpc - Natural Language...

macOS 10.13.6 Multiple Vulnerabilities (Security Update 2019-001)

The remote host is running macOS 10.13.6 and is missing a security update. It is therefore, affected by multiple vulnerabilities in the following components: - Bluetooth - Core Media - CoreAnimation - FaceTime - Hypervisor - Intel Graphics Driver - IOKit - Kernel - libxpc - QuartzCore C Tenable...

Apple iOS, tvOS and macOS libxpc Arbitrary Code Execution Vulnerability

Apple iOS, tvOS, and macOS are all products of Apple Inc. Apple iOS is an operating system developed for mobile devices; tvOS is an operating system for smart TVs; and macOS is a specialized operating system developed for Mac computers. libxpc is an open-source implementation of the Apple XPC...

Safari - Proxy Object Type Confusion Exploit

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Safari Proxy Object Type Confusion', 'Description' = %q This module exploits a type confusion bug in the Javascript Proxy object in WebKit. The D...

Mac OS X - libxpc MITM Privilege Escalation (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Mac OS X libxpc MITM Privilege Escalation', 'Description' = %q This module exploits a vulnerablity in libxpc on macOS MSFLICENSE, 'Author' =...

Mac OS X libxpc MITM Privilege Escalation Exploit

This Metasploit module exploits a vulnerability in libxpc on macOS versions 10.13.3 and below. The tasksetspecialport API allows callers to overwrite their bootstrap port, which is used to communicate with launchd. This port is inherited across forks: child processes will use the same bootstrap...

Mac OS X libxpc MITM Privilege Escalation

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Mac OS X libxpc MITM Privilege Escalation', 'Description' = %q This module exploits a vulnerablity in libxpc on macOS MSFLICENSE, 'Author' =...

About the security content of tvOS 11.4.1 - Apple Support

About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page. For more information about security, se...

About the security content of watchOS 4.3.2 - Apple Support

About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page. For more information about security, se...

Apple iOS libxpc Elevation of Privilege Vulnerability

Apple iOS is an operating system developed by Apple for mobile devices. libxpc is an open source implementation of one of Apple's XPC libraries. A security vulnerability exists in the libxpc component in Apple iOS versions prior to 11.4. An attacker can exploit this vulnerability to execute...

About the security content of iOS 11.4.1

About the security content of iOS 11.4.1 This document describes the security content of iOS 11.4.1. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available...

CVE-2018-4237

An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. tvOS before 11.4 is affected. watchOS before 4.3.1 is affected. The issue involves the "libxpc" component. It allows attackers to gain privileges via a crafted app that leverages a...

CVE-2018-4237

An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. tvOS before 11.4 is affected. watchOS before 4.3.1 is affected. The issue involves the "libxpc" component. It allows attackers to gain privileges via a crafted app that leverages a...

CVE-2018-4237

CVE-2018-4237 refers to a libxpc logic/memory issue in multiple Apple platforms (iOS ≤11.4, macOS ≤10.13.5, tvOS ≤11.4, watchOS ≤4.3.1). The Apple entries describe a privileged-elevation and potential arbitrary-code-execution impact via a crafted app, caused by a logic error in libxpc with a corr...

CVE-2018-4237

An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. tvOS before 11.4 is affected. watchOS before 4.3.1 is affected. The issue involves the "libxpc" component. It allows attackers to gain privileges via a crafted app that leverages a...

CVE-2018-4237: Undefined Security Weakness

An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. tvOS before 11.4 is affected. watchOS before 4.3.1 is affected. The issue involves the "libxpc" component. It allows attackers to gain privileges via a crafted app that leverages a...