CVE-2015-1130

CVE-2015-1130 affects Apple OS X, specifically the XPC implementation in the Admin Framework, before 10.10.3. It allows local users to bypass authentication and obtain admin privileges via unspecified vectors. Exploitation has been demonstrated (e.g., ROOTPIPE/Rootpipe PoC and Metasploit/CANVAS r...

CVE-2015-1130

The XPC implementation in Admin Framework in Apple OS X before 10.10.3 allows local users to bypass authentication and obtain admin privileges via unspecified vectors. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker Value: 0...

CVE-2015-1130: Improper Link Resolution Before File Access

The XPC implementation in Admin Framework in Apple OS X before 10.10.3 allows local users to bypass authentication and obtain admin privileges via unspecified vectors...

CVE-2014-4492

libnetcore in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not verify that certain values have the expected data type, which allows attackers to execute arbitrary code in an networkd context via a crafted XPC message from a sandboxed app, as demonstrated by la...

Design/Logic Flaw

libnetcore in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not verify that certain values have the expected data type, which allows attackers to execute arbitrary code in an networkd context via a crafted XPC message from a sandboxed app, as demonstrated by la...

Type confusion

The xpcdatagetbytes function in libxpc in Apple OS X before 10.10.2 does not verify that a dictionary's Attributes key has the xpcdata data type, which allows attackers to execute arbitrary code by providing a crafted dictionary to sysmond, related to an "XPC type confusion" issue...

Command injection

coresymbolicationd in CoreSymbolication in Apple OS X before 10.10.2 does not verify that expected data types are present in XPC messages, which allows attackers to execute arbitrary code in a privileged context via a crafted app, as demonstrated by lack of verification of xpcdictionarygetvalue A...

CVE-2014-4492

libnetcore in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not verify that certain values have the expected data type, which allows attackers to execute arbitrary code in an networkd context via a crafted XPC message from a sandboxed app, as demonstrated by la...

CVE-2014-8817

coresymbolicationd in CoreSymbolication in Apple OS X before 10.10.2 does not verify that expected data types are present in XPC messages, which allows attackers to execute arbitrary code in a privileged context via a crafted app, as demonstrated by lack of verification of xpcdictionarygetvalue A...

CVE-2014-8835

The xpcdatagetbytes function in libxpc in Apple OS X before 10.10.2 does not verify that a dictionary's Attributes key has the xpcdata data type, which allows attackers to execute arbitrary code by providing a crafted dictionary to sysmond, related to an "XPC type confusion" issue...

CVE-2014-4492

CVE-2014-4492 involves a type confusion vulnerability in libnetcore affecting Apple devices (iOS before 8.1.3, OS X before 10.10.2, Apple TV before 7.0.3) where an attacker can craft an XPC message to sandboxed applications to trigger arbitrary code execution in the networkd context. The root cau...

CVE-2014-8835

CVE-2014-8835 affects Apple OS X prior to 10.10.2, where libxpc’s xpc_data_get_bytes does not verify the data type of a dictionary’s Attributes key, enabling a type-confusion path via crafted dictionaries to sysmond that can lead to arbitrary code execution. The documented impact is local to OS X...

CVE-2014-8817

CVE-2014-8817 affects CoreSymbolicationd in CoreSymbolication on macOS up to OS X 10.10.1. The flaw is improper verification of data types in XPC messages, specifically during handling of commands (match_mmap_archives, delete_mmap_archives, write_mmap_archive, read_mmap_archive), due to missing v...

PT-2015-3755

Name of the Vulnerable Software and Affected Versions libnetcore in Apple iOS versions prior to 8.1.3 libnetcore in Apple OS X versions prior to 10.10.2 libnetcore in Apple TV versions prior to 7.0.3 Description The issue allows attackers to execute arbitrary code in a networkd context via a...

PT-2015-4101

Name of the Vulnerable Software and Affected Versions Apple OS X versions prior to 10.10.2 Description The issue is related to an "XPC type confusion" problem in the xpc data get bytes function within the libxpc library. This function does not properly verify the data type of a dictionary's...

PT-2015-4084

Name of the Vulnerable Software and Affected Versions Apple OS X versions prior to 10.10.2 Description The issue allows attackers to execute arbitrary code in a privileged context via a crafted app. This is due to the lack of verification of expected data types in XPC messages. Specifically, the...

CVE-2014-8835: Undefined Security Weakness

The xpcdatagetbytes function in libxpc in Apple OS X before 10.10.2 does not verify that a dictionary's Attributes key has the xpcdata data type, which allows attackers to execute arbitrary code by providing a crafted dictionary to sysmond, related to an "XPC type confusion" issue...

CVE-2014-4492: Undefined Security Weakness

libnetcore in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not verify that certain values have the expected data type, which allows attackers to execute arbitrary code in an networkd context via a crafted XPC message from a sandboxed app, as demonstrated by la...

CVE-2014-8817: Undefined Security Weakness

coresymbolicationd in CoreSymbolication in Apple OS X before 10.10.2 does not verify that expected data types are present in XPC messages, which allows attackers to execute arbitrary code in a privileged context via a crafted app, as demonstrated by lack of verification of xpcdictionarygetvalue A...

OS X networkd (effective_audit_token) XPC Type Confusion Sandbox Escape Exploit

Exploit for macOS platform in category local exploits // Requires Lorgnette: https://github.com/rodionovd/liblorgnette // clang -o networkdexploit networkdexploit.c liblorgnette/lorgnette.c -framework CoreFoundation // ianbeer include include include include include include include include includ...