CVE-2014-8835 in Apple Mac OS X

Summary

The xpc_data_get_bytes function in libxpc in Apple OS X before 10.10.2 does not verify that a dictionary's Attributes key has the xpc_data data type, which allows attackers to execute arbitrary code by providing a crafted dictionary to sysmond, related to an "XPC type confusion" issue.

Reservation

11/14/2014

Disclosure

01/30/2015

Entries

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerability	CWE	Exp	Cou	CVE
69012	Apple Mac OS X sysmond data processing	19	Proof-of-Concept	Unavailable	CVE-2014-8835
68916	Apple Mac OS X sysmond data processing	19	Proof-of-Concept	Official fix	CVE-2014-8835