CVE-2015-3795
HighSummary
libxpc in Apple iOS before 8.4.1 and OS X before 10.10.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app that sends a malformed XPC message.
Risk Assessment
This vulnerability can lead to serious security breaches, including system takeover or destabilization. Organizations may be at risk of data loss and service disruption.
Recommendation
It is recommended to update systems to the latest versions to eliminate this vulnerability. Additionally, monitoring applications and their communications is advised to detect potential malicious activities.
Other vulnerabilities in libxpc
See all- CVE-2017-7047High
An issue was discovered in certain Apple products related to the 'libxpc' component, allowing attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
- CVE-2016-4675High
An issue was discovered in certain Apple products related to the 'libxpc' component. It allows attackers to execute arbitrary code in a privileged context via a crafted app.
- CVE-2016-4617High
An issue was discovered in certain Apple products, including macOS before 10.12, involving a sandbox escape related to launchctl process spawning in the 'libxpc' component.
- CVE-2014-8835High
The xpc_data_get_bytes function in libxpc in Apple OS X before 10.10.2 does not verify that a dictionary's Attributes key has the xpc_data data type. This allows attackers to execute arbitrary code by providing a crafted dictionary to sysmond, related to an 'XPC type confusion' issue.
Original NVD description (English source)
libxpc in Apple iOS before 8.4.1 and OS X before 10.10.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app that sends a malformed XPC message.