macos

Apple macOS – Kernel Code Execution due to Lack of Bounds Checking in AppleIntelCapriController::GetLinkConfig

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1375

Apple macOS XNU Kernel – Memory Disclosure due to bug in Kernel API for Detecting Kernel Memory Disclosures

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1372

Apple macOS – ‘getrusage’ Stack Leak Through struct Padding

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1405

Apple macOS – ‘necp_get_socket_attributes’ so_pcb Type Confusion

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1392&desc=2

Apple macOS High Sierra 10.13 – ‘ctl_ctloutput-leak’ Information Leak

#if 0

Hashicorp vagrant-vmware-fusion 5.0.0 – Local Privilege Escalation

# After three CVEs and multiple exploits disclosed to Hashicorp they have finally upped their game with this plugin. ...

Arq 5.9.7 – Local Privilege Escalation

=begin

Murus 1.4.11 – Local Privilege Escalation

# I recently blogged about the prevalence of escalation hijack vulnerabilities amongst macOS applications. One exampl...

Arq 5.9.6 – Local Privilege Escalation

# Arq Backup from Haystack Software is a great application for backing up macs and

Hashicorp vagrant-vmware-fusion 5.0.3 – Local Privilege Escalation

# Another day, another root privesc bug in this plugin. Not quite so serious this

Hashicorp vagrant-vmware-fusion 5.0.1 – Local Privilege Escalation

# I recently blogged about how the installation process of version 5.0.0 of this

Sera 1.2 – Local Privilege Escalation / Password Disclosure

# Sera is a free app for mac and iOS that lets you unlock your mac automatically

Hashicorp vagrant-vmware-fusion 4.0.24 – Local Privilege Escalation

# I have previously disclosed a couple of bugs in Hashicorp's vagrant-vmware-fusion plugin for vagrant.

Hashicorp vagrant-vmware-fusion 4.0.23 – Local Privilege Escalation

# A couple of weeks ago I disclosed a local root privesc in Hashicorp's

Proxifier for Mac 2.19 – Local Privilege Escalation

# With CVE-2017-7643 I disclosed a command injection vulnerablity in the KLoader

Apple macOS 10.13.1 (High Sierra) – Insecure Cron System Local Privilege Escalation

Recently I was working on an security issue in some other software that has yet to be disclosed which created a rathe...

Apple macOS 10.13.1 (High Sierra) – ‘Blank Root’ Local Privilege Escalation (Metasploit)

##

Apple macOS 10.13.1 (High Sierra) – ‘Blank Root’ Local Privilege Escalation

## Source: https://twitter.com/lemiorhan/status/935578694541770752 & https://forums.developer.apple.com/thread/79235

Apple macOS Sierra 10.12.1 – ‘IOFireWireFamily’ FireWire Port Denial of Service

#include

Apple macOS Sierra 10.12.3 – ‘IOFireWireFamily-null-deref’ FireWire Port Denial of Service

#include

Xamarin Studio for Mac 6.2.1 (build 3) / 6.3 (build 863) – Local Privilege Escalation

Source: https://www.securify.nl/advisory/SFY20170403/xamarin-studio-for-mac-api-documentation-update-affected-by-loca...

Hashicorp vagrant-vmware-fusion < 4.0.20 - Local Privilege Escalation

I'm a big fan of Hashicorp but this is an awful bug to have in software of their

Apple macOS – Disk Arbitration Daemon Race Condition

#!/bin/bash

Apple Safari 10.1 – Spread Operator Integer Overflow Remote Code Execution

Sources:

Apple macOS – Lack of Bounds Checking in HIServices Custom CFObject Serialization Local Privilege Escalation

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1219

Apple macOS – ‘stackshot’ Raw Frame Pointers

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1164

Apple macOS – ’32-bit syscall exit’ Kernel Register Leak

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1149

Apple Safari 10.0.3 – ‘JSC::CachedCall’ Use-After-Free

click here for cute cat picz!

HideMyAss Pro VPN Client for macOS 3.x – Local Privilege Escalation

Source: https://www.securify.nl/advisory/SFY20170408/local_privilege_escalation_vulnerability_in_hidemyass_pro_vpn_cl...

Proxifier for Mac 2.18 – Multiple Vulnerabilities

Source: https://www.securify.nl/advisory/SFY20170401/multiple_local_privilege_escalation_vulnerabilities_in_proxifier...

Proxifier for Mac 2.17/2.18 – Privesc Escalation

# Source: https://m4.rkw.io/blog/cve20177643-local-root-privesc-in-proxifier-for-mac--218.html

Apple macOS Kernel 10.12.2 (16C67) – ‘AppleIntelCapriController::GetLinkConfig’ Code Execution Due to Lack of Bounds Checking

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1071

Apple macOS Kernel 10.12.3 (16D32) – Use-After-Free Due to Double-Release in posix_spawn

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1104

Apple macOS Kernel 10.12.3 (16D32) – ‘audit_pipe_open’ Off-by-One Memory Corruption

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1126

Apple macOS Kernel 10.12.2 (16C67) – Memory Disclosure Due to Lack of Bounds Checking in AppleIntelCapriController::getDisplayPipeCapability

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1069

Apple WebKit 10.0.2 – ‘FrameLoader::clear’ Universal Cross-Site Scripting

Apple macOS HelpViewer 10.12.1 – XSS Leads to Arbitrary File Execution / Arbitrary File Read

Apple macOS Sierra 10.12.1 – ‘physmem’ Local Privilege Escalation

## physmem

Apple macOS 10.12.1 Kernel – Writable Privileged IOKit Registry Properties Code Execution

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=974

Apple macOS 10.12 – Double vm_deallocate in Userspace MIG Code Use-After-Free

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=954

Apple macOS < 10.12.2 / iOS < 10.2 - '_kernelrpc_mach_port_insert_right_trap' Kernel Reference Count Leak / Use-After-Free

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=941

Apple macOS < 10.12.2 / iOS < 10.2 - Broken Kernel Mach Port Name uref Handling Privileged Port Name Replacement Privilege Escalation

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=959

Apple macOS 10.12 – ‘task_t’ Local Privilege Escalation

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=837