CVE-2014-8817

State: Published
Severity: Not scored
Published: Jan 30, 2015
Updated: Aug 6, 2024
Reserved: Nov 14, 2014

Description

coresymbolicationd in CoreSymbolication in Apple OS X before 10.10.2 does not verify that expected data types are present in XPC messages, which allows attackers to execute arbitrary code in a privileged context via a crafted app, as demonstrated by lack of verification of xpc_dictionary_get_value API return values during handling of a (1) match_mmap_archives, (2) delete_mmap_archives, (3) write_mmap_archive, or (4) read_mmap_archive command.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
n/an/a	n/aAffected

References

1031650vdb-entry
https://code.google.com/p/google-security-research/issues/detail?id=80
http://support.apple.com/HT204244
macosx-cve20148817-priv-esc(100496)vdb-entry
APPLE-SA-2015-01-27-4vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.