CVE-2016-4617
HighSummary
An issue was discovered in certain Apple products, including macOS before 10.12, involving a sandbox escape related to launchctl process spawning in the 'libxpc' component.
Risk Assessment
This vulnerability allows attackers to perform unauthorized actions on the system, potentially leading to serious security breaches.
Recommendation
It is recommended to update macOS to version 10.12 or later to mitigate the risk associated with this vulnerability.
Other vulnerabilities in libxpc
See all- CVE-2017-7047High
An issue was discovered in certain Apple products related to the 'libxpc' component, allowing attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
- CVE-2016-4675High
An issue was discovered in certain Apple products related to the 'libxpc' component. It allows attackers to execute arbitrary code in a privileged context via a crafted app.
- CVE-2015-3795High
libxpc in Apple iOS before 8.4.1 and OS X before 10.10.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app that sends a malformed XPC message.
- CVE-2014-8835High
The xpc_data_get_bytes function in libxpc in Apple OS X before 10.10.2 does not verify that a dictionary's Attributes key has the xpc_data data type. This allows attackers to execute arbitrary code by providing a crafted dictionary to sysmond, related to an 'XPC type confusion' issue.
Original NVD description (English source)
An issue was discovered in certain Apple products. macOS before 10.12 is affected. The issue involves a sandbox escape related to launchctl process spawning in the "libxpc" component.