CVE-2016-4675
HighSummary
An issue was discovered in certain Apple products related to the 'libxpc' component. It allows attackers to execute arbitrary code in a privileged context via a crafted app.
Risk Assessment
This vulnerability could lead to an attacker gaining control over the system, posing a serious threat to user data security.
Recommendation
It is recommended to update iOS, macOS, tvOS, and watchOS to the latest versions to mitigate the risks associated with this vulnerability.
Other vulnerabilities in libxpc
See all- CVE-2017-7047High
An issue was discovered in certain Apple products related to the 'libxpc' component, allowing attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
- CVE-2016-4617High
An issue was discovered in certain Apple products, including macOS before 10.12, involving a sandbox escape related to launchctl process spawning in the 'libxpc' component.
- CVE-2015-3795High
libxpc in Apple iOS before 8.4.1 and OS X before 10.10.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app that sends a malformed XPC message.
- CVE-2014-8835High
The xpc_data_get_bytes function in libxpc in Apple OS X before 10.10.2 does not verify that a dictionary's Attributes key has the xpc_data data type. This allows attackers to execute arbitrary code by providing a crafted dictionary to sysmond, related to an 'XPC type confusion' issue.
Original NVD description (English source)
An issue was discovered in certain Apple products. iOS before 10.1 is affected. macOS before 10.12.1 is affected. tvOS before 10.0.1 is affected. watchOS before 3.1 is affected. The issue involves the "libxpc" component. It allows attackers to execute arbitrary code in a privileged context via a crafted app.