CVE-2017-7047
HighSummary
An issue was discovered in certain Apple products related to the 'libxpc' component, allowing attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
Risk Assessment
Organizations may be exposed to arbitrary code execution or system crashes, potentially leading to data loss or service interruptions.
Recommendation
It is recommended to update systems to the latest versions to mitigate the risks associated with this vulnerability.
Other vulnerabilities in libxpc
See all- CVE-2016-4675High
An issue was discovered in certain Apple products related to the 'libxpc' component. It allows attackers to execute arbitrary code in a privileged context via a crafted app.
- CVE-2016-4617High
An issue was discovered in certain Apple products, including macOS before 10.12, involving a sandbox escape related to launchctl process spawning in the 'libxpc' component.
- CVE-2015-3795High
libxpc in Apple iOS before 8.4.1 and OS X before 10.10.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app that sends a malformed XPC message.
- CVE-2014-8835High
The xpc_data_get_bytes function in libxpc in Apple OS X before 10.10.2 does not verify that a dictionary's Attributes key has the xpc_data data type. This allows attackers to execute arbitrary code by providing a crafted dictionary to sysmond, related to an 'XPC type confusion' issue.
Original NVD description (English source)
An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. macOS before 10.12.6 is affected. tvOS before 10.2.2 is affected. watchOS before 3.2.3 is affected. The issue involves the "libxpc" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.