NVD

Id
32476  
Name
CVE-2014-4492  
Description
libnetcore in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not verify that certain values have the expected data type, which allows attackers to execute arbitrary code in an _networkd context via a crafted XPC message from a sandboxed app, as demonstrated by lack of verification of the XPC dictionary data type.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2015-01-30  
Modified Date
2016-12-06  
Seq
2014-4492  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
171359 32476 CVE-2014-4492 APPLE-SA-2015-01-27-1  View
171360 32476 CVE-2014-4492 APPLE-SA-2015-01-27-2  View
171361 32476 CVE-2014-4492 APPLE-SA-2015-01-27-4  View
171362 32476 CVE-2014-4492 http://packetstormsecurity.com/files/134393/Mac-OS-X-Networkd-XPC-Type-Confusion-Sandbox-Escape.html  View
171363 32476 CVE-2014-4492 http://support.apple.com/HT204244  View
171364 32476 CVE-2014-4492 http://support.apple.com/HT204245  View
171365 32476 CVE-2014-4492 http://support.apple.com/HT204246  View
171366 32476 CVE-2014-4492 35847  View
171367 32476 CVE-2014-4492 https://code.google.com/p/google-security-research/issues/detail?id=92  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
5956 JVNDB-2015-001276 複数の Apple 製品の libnetcore における _networkd コンテキスト内の任意のコードを実行される脆弱性 Apple iOS、Apple OS X、および Apple TV の libnetcore は、特定の値が予想されるデータ型であることを確認しないため、_networkd コンテキスト内の任意のコードを実行される脆弱性が存在します。 CVE-2014-4492 71780 CVE-2014-4492 32476 7.5 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-001276.html 2015-01-27 2015-02-12 View