CVE-2014-4492

CVE-2014-4492 involves a type confusion vulnerability in libnetcore affecting Apple devices (iOS before 8.1.3, OS X before 10.10.2, Apple TV before 7.0.3) where an attacker can craft an XPC message to sandboxed applications to trigger arbitrary code execution in the networkd context. The root cau...

CVE-2014-8817

CVE-2014-8817 affects CoreSymbolicationd in CoreSymbolication on macOS up to OS X 10.10.1. The flaw is improper verification of data types in XPC messages, specifically during handling of commands (match_mmap_archives, delete_mmap_archives, write_mmap_archive, read_mmap_archive), due to missing v...

CVE-2014-4492

libnetcore in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not verify that certain values have the expected data type, which allows attackers to execute arbitrary code in an networkd context via a crafted XPC message from a sandboxed app, as demonstrated by la...

CVE-2014-8835

CVE-2014-8835 affects Apple OS X prior to 10.10.2, where libxpc’s xpc_data_get_bytes does not verify the data type of a dictionary’s Attributes key, enabling a type-confusion path via crafted dictionaries to sysmond that can lead to arbitrary code execution. The documented impact is local to OS X...

CVE-2014-8835

The xpcdatagetbytes function in libxpc in Apple OS X before 10.10.2 does not verify that a dictionary's Attributes key has the xpcdata data type, which allows attackers to execute arbitrary code by providing a crafted dictionary to sysmond, related to an "XPC type confusion" issue...

CVE-2014-8817

coresymbolicationd in CoreSymbolication in Apple OS X before 10.10.2 does not verify that expected data types are present in XPC messages, which allows attackers to execute arbitrary code in a privileged context via a crafted app, as demonstrated by lack of verification of xpcdictionarygetvalue A...

Apple Mac OSX networkd - 'effective_audit_token' XPC Type Confusion Sandbox Escape

// Requires Lorgnette: https://github.com/rodionovd/liblorgnette // clang -o networkdexploit networkdexploit.c liblorgnette/lorgnette.c -framework CoreFoundation // ianbeer include include include include include include include include include include include include include...

OS X networkd (effective_audit_token) XPC Type Confusion Sandbox Escape Exploit

Exploit for macOS platform in category local exploits // Requires Lorgnette: https://github.com/rodionovd/liblorgnette // clang -o networkdexploit networkdexploit.c liblorgnette/lorgnette.c -framework CoreFoundation // ianbeer include include include include include include include include includ...

Apple Mac OSX networkd - effective_audit_token XPC Type Confusion Sandbox Escape

Apple Mac OSX networkd - effectiveaudittoken XPC Type Confusion Sandbox Escape // Requires Lorgnette: https://github.com/rodionovd/liblorgnette // clang -o networkdexploit networkdexploit.c liblorgnette/lorgnette.c -framework CoreFoundation // ianbeer include include include include include inclu...

Apple Mac OS X XPC Type Obfuscated Local Elevation of Privilege Vulnerability

Apple Mac OS X is a BSD-based operating system of a commercial nature. A local elevation of privilege vulnerability exists in Apple Mac OS X XPC type obfuscation, which allows local attackers to exploit this vulnerability to elevate privileges...

OS X 10.9.x - sysmond XPC Privilege Escalation Vulnerability

Exploit for macOS platform in category local exploits / Source: https://code.google.com/p/google-security-research/issues/detail?id=121 / / tested on OS X 10.9.5 - uses some hard-coded offsets which will have to be fixed-up for other versions! this poc uses liblorgnette to resolve some private...

Apple Mac OSX 10.9.x - sysmond XPC Privilege Escalation

/ Source: https://code.google.com/p/google-security-research/issues/detail?id=121 / / tested on OS X 10.9.5 - uses some hard-coded offsets which will have to be fixed-up for other versions! this poc uses liblorgnette to resolve some private symbols; grab the code from github: git clone...

Apple Mac OSX 10.9.x - sysmond XPC Privilege Escalation

Apple Mac OSX 10.9.x - sysmond XPC Privilege Escalation / Source: https://code.google.com/p/google-security-research/issues/detail?id=121 / / tested on OS X 10.9.5 - uses some hard-coded offsets which will have to be fixed-up for other versions! this poc uses liblorgnette to resolve some private...

Firefox Same-origin violations in XMLHttpRequest and XPCNativeWrapper.toString

Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey do not properly implement the Same Origin Policy for 1 XMLHttpRequest, involving a mismatch for a document's principal, and 2 XPCNativeWrapper.toString, involving an incorrect proto scope, which allows remote attackers to conduct cross-site...

Firefox JavaScript privilege escalation

Multiple unspecified vulnerabilities in Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 allow remote attackers to run arbitrary JavaScript with chrome privileges via unknown vectors in which "page content can pollute...

Mozilla privilege escalation via XPCnativeWrapper pollution

The XPConnect component in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allows remote attackers to "pollute XPCNativeWrappers" and execute arbitrary code with chrome privileges via vectors related to 1 chrome XBL and 2 chrome JS...

security flaw

Mozilla Firefox before 2.0.0.8 and SeaMonkey before 1.1.5 allow remote attackers to execute arbitrary Javascript with user privileges by using the Script object to modify XPCNativeWrappers in a way that causes the script to be executed when a chrome action is performed...

security flaw

Multiple unspecified vulnerabilities in Mozilla Firefox before 2.0.0.5 allow remote attackers to execute arbitrary code via a crafted XPCNativeWrapper...

security flaw

Multiple unspecified vulnerabilities in Mozilla Firefox before 2.0.0.5 allow remote attackers to execute arbitrary code via a crafted XPCNativeWrapper...

security flaw

Cross-site scripting XSS vulnerability in Mozilla Firefox 1.5 before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3 allows remote attackers to inject arbitrary web script or HTML via the XPCNativeWrapperwindow.Function construct...