CVE-2018-4043

Summary of CVE-2018-4043 and related details: CleanMyMac X (version 4.04) is affected by a set of local privilege-escalation vulnerabilities in the helper protocol. The root cause across these flaws is improper input validation and lack of validation of the calling application in various function...

CVE-2018-4047

CVE-2018-4047 affects CleanMyMac X 4.04. The vulnerability lies in the helper service, specifically the disableLaunchdAgentAtPath function, where user-controlled input is passed to launchtl without validation. This allows a local attacker to run root-level operations and uninstall launchd scripts...

CVE-2019-5011

CVE-2019-5011 affects CleanMyMac X v4.20. The vulnerability is a privilege escalation in the helper service caused by an incomplete update: vulnerable components were not removed when upgrading, leaving the system exposed. A local attacker can modify the filesystem as root. TALOS advisory TALOS-2...

CVE-2018-4045

CVE-2018-4045 affects CleanMyMac X 4.04. The vulnerability resides in the securelyRemoveItemAtPath function of the helper protocol, where a user-supplied argument is passed to securelyRemoveFileAtPath without validation. An attacker with local access could exploit this to delete files from the ro...

CVE-2018-4034

CVE-2018-4034 affects CleanMyMac X 4.04. The vulnerability resides in the removeItemAtPath function of the helper protocol, where a user-supplied argument is passed to a privileged root-level operation without validation. This allows a local attacker to run the function as root and delete files f...

CVE-2018-4033

CVE-2018-4033 affects MacPaw’s CleanMyMac X (tested with version 4.04). The vulnerability resides in the helper protocol’s moveToTrashItemAtPath function: a nil fourth argument allows any local application to call the function as root, enabling modification/deletion of root-file-system items. Cis...

CVE-2018-4037

The CVE-2018-4037 issue affects CleanMyMac X (v4.04 affected) and stems from improper input validation in the removeDiagnosticsLogs helper function. An attacker with local access can trigger the function to delete main log data, crossing a privilege boundary and allowing root-level modification o...

CVE-2018-4042

CVE-2018-4042 affects CleanMyMac X 4.04. The vulnerability is in the helper service’s removeLaunchdAgentAtPath function, where there is no validation of the calling application, allowing a local attacker to run as root and modify/delete root-owned files. The advisory notes this is addressed by up...

CVE-2018-4044

CVE-2018-4044 affects Clean My Mac X, version 4.04. The vulnerability exists in the helper protocol’s removePackageWithID function, where calling applications can pass the privileged command via an unvalidated path. Attackers with local access could exploit this to delete package receipts using t...

CVE-2018-4046

CleanMyMac X (MacPaw) version 4.04 contains a locally exploitable denial-of-service vulnerability in the helper service, specifically the pleaseTerminate function, caused by improper input validation. An attacker with local access can cause the root daemon to terminate itself, effectively crossin...

CVE-2018-4032

The CVE-2018-4032 family targets CleanMyMac X. Affects version 4.04; root privilege escalation arises from input validation flaws in the helper protocol functions (notably moveItemAtPath, moveToTrashItemAtPath, removeItemAtPath, truncateFileAtPath, removeKextAtPath, removeDiagnosticsLogs, and oth...

CVE-2018-4035

The CVE-2018-4035 issue affects CleanMyMac X 4.04 and stems from an input validation flaw in the truncateFileAtPath function of the helper protocol. Because the privileged helper runs as root, a local attacker can supply a crafted argument, enabling execution of this function with root privileges...

CVE-2018-4036

The CVE-2018-4036 item pertains to CleanMyMac X. TALOS describes a privilege-escalation flaw in the removeKextAtPath function of the helper protocol, where a user-supplied argument is not validated, allowing a local attacker to run as root and modify or remove kernel extensions. Talos lists affec...

CVE-2018-4041

CVE-2018-4041 corresponds to a privilege-escalation in CleanMyMac X 4.04 due to improper input validation in the helper protocol’s enableLaunchdAgentAtPath function. The attack requires local access and could let a non-root user load a root-privileged launch agent, effectively enabling root-level...