Design/Logic Flaw

The posixspawn system call in the XNU kernel in Apple Mac OS X 10.8.x does not properly validate the data for file actions and port actions, which allows local users to 1 cause a denial of service panic via a size value that is inconsistent with a header count field, or 2 obtain sensitive...

Memory corruption

The getxattrinfo function in the XNU kernel in Apple iOS 5.x and 6.x through 6.1.3 on iPad devices does not properly validate the header of an AppleDouble file, which might allow local users to cause a denial of service memory corruption or have unspecified other impact via an invalid file on an...

CVE-2013-3953

The machportspaceinfo function in osfmk/ipc/machdebug.c in the XNU kernel in Apple Mac OS X 10.8.x does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel heap memory via a crafted call...

CVE-2013-3949

The CVE-2013-3949 entry concerns the XNU kernel used in Apple Mac OS X 10.8.x. The issue arises in the posix_spawn system call, which does not prevent the use of _POSIX_SPAWN_DISABLE_ASLR and _POSIX_SPAWN_ALLOW_DATA_EXEC flags for setuid/setgid programs. This enables local users to bypass intende...

CVE-2013-3955

The getxattrinfo function in the XNU kernel in Apple iOS 5.x and 6.x through 6.1.3 on iPad devices does not properly validate the header of an AppleDouble file, which might allow local users to cause a denial of service memory corruption or have unspecified other impact via an invalid file on an...

CVE-2013-3955

The CVE-2013-3955 issue affects Apple iOS XNU kernel (iOS 5.x–6.x up to 6.1.3 on iPad). It stems from get_xattrinfo failing to validate the AppleDouble file header, enabling a local attacker to trigger memory corruption (DoS) or other impact via an invalid AppleDouble file on msdosfs. The vulnera...

CVE-2013-3952

The CVE affects Apple Mac OS X 10.8.x, specifically the XNU kernel’s fill_pipeinfo in bsd/kern/sys_pipe.c. The vulnerability allows local users to defeat KASLR by abusing the PROC_PIDFDPIPEINFO option to the proc_info system call on a kernel pipe handle. Potential impact is exposure of kernel add...

CVE-2013-3949

The posixspawn system call in the XNU kernel in Apple Mac OS X 10.8.x does not prevent use of the POSIXSPAWNDISABLEASLR and POSIXSPAWNALLOWDATAEXEC flags for setuid and setgid programs, which allows local users to bypass intended access restrictions via a wrapper program that calls the...

CVE-2013-3952

The fillpipeinfo function in bsd/kern/syspipe.c in the XNU kernel in Apple Mac OS X 10.8.x allows local users to defeat the KASLR protection mechanism via the PROCPIDFDPIPEINFO option to the procinfo system call for a kernel pipe handle...

CVE-2013-3954

CVE-2013-3954 affects Apple OS X/macOS kernels (e.g., OS X 10.8.x) where the posix_spawn API arguments to file/port actions are not properly validated. The underlying cause is insufficient bounds checking on data for file actions and port actions, enabling a local attacker to trigger a panic (DoS...

CVE-2013-3953

CVE-2013-3953 concerns the XNU kernel on macOS, where the mach_port_space_info API in osfmk/ipc/mach_debug.c does not initialize a structure member. This causes information disclosure from kernel heap memory via a crafted call on affected systems (OS X 10.8.x). Connected documents confirm the ker...

BSD derived RFC3173 IPComp encapsulation will expand arbitrarily nested payload

BSD derived RFC3173 IPComp encapsulation will expand arbitrarily nested payload ------------------------------------------------------------------------------- Gruezi, this document describes CVE-2011-1547. RFC3173 ip payload compression, henceforth ipcomp, is a protocol intended to provide...

Apple Mac OS X IPv6 PIM Denial of Service Vulnerability

This vulnerability allows remote attackers to denial of service the IPv6 stack of an installation of Apple Mac OSX. No authentication or user interaction is required in order to exploit this vulnerability. The specific flaw exists within OSX's IPv6 stack. A NULL pointer dereference vulnerability...

Apple MACOS X xnu <= 1228.9.59 Local Kernel Root Exploit

No description provided by source. / xnu-workq-v2-64.c Copyright c 2008 by [email protected] Apple MACOS X xnu = 1228.9.59 local kernel root exploit by mu-b - Sat 16 Feb 2008 - Tested on: Apple MACOS X 10.5.1 xnu-1228.0.21/RELEASEI386 Apple MACOS X 10.5.2 xnu-1228.3.131/RELEASEI386...

Apple Mac OSX xnu 1228.9.59 - Kernel Privilege Escalation

Apple Mac OSX xnu 1228.9.59 - Kernel Privilege Escalation / xnu-workq-v2-64.c Copyright c 2008 by Apple MACOS X xnu include include include include include include / profil defines / define PROFILITEMSIZE 64 define PROFILBLKSIZE 65536 define PROFILBLKNUM 84 / workq defines / define WQOPSQUEUEADD ...

Apple MACOS X xnu <= 1228.9.59 Local Kernel Root Exploit

Exploit for macOS platform in category local exploits ======================================================== Apple MACOS X xnu Apple MACOS X xnu include include include include include include / profil defines / define PROFILITEMSIZE 64 define PROFILBLKSIZE 65536 define PROFILBLKNUM 84 / workq...

Apple Mac OSX xnu 1228.9.59 - Kernel Privilege Escalation

/ xnu-workq-v2-64.c Copyright c 2008 by Apple MACOS X xnu include include include include include include / profil defines / define PROFILITEMSIZE 64 define PROFILBLKSIZE 65536 define PROFILBLKNUM 84 / workq defines / define WQOPSQUEUEADD 1 define WORKQUEUEPRIOSMIN -2 define WORKQUEUEPRIOSMAX 2 /...

iDefense Security Advisory 05.14.09: Apple Mac OS X xnu Kernel workqueue_additem/workqueue_removeitem Index Validation Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 iDefense Security Advisory 05.12.09 http://labs.idefense.com/intelligence/vulnerabilities/ May 12, 2009 I. BACKGROUND Mac OS X is a computer operating systems available from Apple Inc. OS X is the tenth major version of Apple's operating system for...

Design/Logic Flaw

Array index error in the xnu Mach kernel in Apple Mac OS X 10.5 before 10.5.7 allows local users to gain privileges or cause a denial of service system shutdown via unspecified vectors related to workqueues...

CVE-2008-1517

Array index error in the xnu Mach kernel in Apple Mac OS X 10.5 before 10.5.7 allows local users to gain privileges or cause a denial of service system shutdown via unspecified vectors related to workqueues...