Code injection

Little Snitch versions 4.0 to 4.0.6 use the SecStaticCodeCheckValidityWithErrors function without the kSecCSCheckAllArchitectures flag and therefore do not validate all architectures stored in a fat binary. An attacker can maliciously craft a fat binary containing multiple architectures that may...

CVE-2018-10470

Little Snitch versions 4.0 to 4.0.6 use the SecStaticCodeCheckValidityWithErrors function without the kSecCSCheckAllArchitectures flag and therefore do not validate all architectures stored in a fat binary. An attacker can maliciously craft a fat binary containing multiple architectures that may...

CVE-2018-10470

Summary: CVE-2018-10470 affects Objective Development Little Snitch 4.0–4.0.6. The root cause is failing to pass the kSecCSCheckAllArchitectures flag to SecStaticCodeCheckValidityWithErrors(), so fat binaries with multiple architectures may cause the running process to appear unsigned while the o...