CVE-2014-4492

No fix known EPSS 20%

libnetcore in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not verify that certain values have the expected data type, which allows attackers to execute arbitrary code in an _networkd context via a crafted XPC message from a sandboxed app, as demonstrated by lack of verification of the XPC dictionary data type.

Published 2015-01-30 · CVE record · OSV

Products: apple iphone_os, apple mac_os_x, apple tvos