libnetcore in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not verify that certain values have the expected data type, which allows attackers to execute arbitrary code in an _networkd context via a crafted XPC message from a sandboxed app, as demonstrated by lack of verification of the XPC dictionary data type.
CVSS Details
- CVSS 3.1 Base Score: 8.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Ios | — | Upgrade to the latest version of Apple iOS | Feb 3, 2015 | Jan 30, 2015 |
| Apple Osx Afpserver | — | Apply Apple macOS Security Update 2015-001 | Aug 28, 2015 | Jan 30, 2015 |
| Apple Osx Libnetcore | — | Apply Apple macOS Security Update 2015-001Upgrade macOS to the latest version | Mar 29, 2016 | Jan 30, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub