coresymbolicationd in CoreSymbolication in Apple OS X before 10.10.2 does not verify that expected data types are present in XPC messages, which allows attackers to execute arbitrary code in a privileged context via a crafted app, as demonstrated by lack of verification of xpc_dictionary_get_value API return values during handling of a (1) match_mmap_archives, (2) delete_mmap_archives, (3) write_mmap_archive, or (4) read_mmap_archive command.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: apple
Published: 2015-01-30T11:00:00
Updated: 2024-08-06T13:26:02.615Z
Reserved: 2014-11-14T00:00:00
Link: CVE-2014-8817
Vulnrichment
No data.
NVD
Status : Modified
Published: 2015-01-30T11:59:29.577
Modified: 2024-11-21T02:19:47.787
Link: CVE-2014-8817
Redhat
No data.