CVE-2014-8817 — Apple MAC OS X vulnerability

CWE-193 documents3 sources
Severity
10.0CRITICALNVD
EPSS
1.2%
top 21.38%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apple MAC OS XApple OS X Yosemite V10.10.2 AND Security Update 2015-001
Timeline
PublishedJan 30
Latest updateMay 17

Description

coresymbolicationd in CoreSymbolication in Apple OS X before 10.10.2 does not verify that expected data types are present in XPC messages, which allows attackers to execute arbitrary code in a privileged context via a crafted app, as demonstrated by lack of verification of xpc_dictionary_get_value API return values during handling of a (1) match_mmap_archives, (2) delete_mmap_archives, (3) write_mmap_archive, or (4) read_mmap_archive command.

CVSS vector

AV:N/AC:L/C:C/I:C/A:CExploitability: 10.0 | Impact: 10.0

Affected Packages2 packages

▶NVDapple/mac_os_x10.10.1

🔴Vulnerability Details

1
GHSA
GHSA-76gf-6532-gxwj: coresymbolicationd in CoreSymbolication in Apple OS X before 10↗2022-05-17
▶

📋Vendor Advisories

1
Apple
CVE-2014-8817: OS X Yosemite v10.10.2 and Security Update 2015-001↗
▶