CVE-2014-4496

The mach_port_kobject interface in the kernel in Apple iOS before 8.1.3 and Apple TV before 7.0.3 does not properly restrict kernel-address and heap-permutation information, which makes it easier for attackers to bypass the ASLR protection mechanism via a crafted app.

• CWE-264

• http://lists.apple.com/archives/security-announce/2015/Jan/msg00000.htmlMailing List, Vendor Advisory
• http://lists.apple.com/archives/security-announce/2015/Jan/msg00001.htmlMailing List, Vendor Advisory
• http://lists.apple.com/archives/security-announce/2015/Mar/msg00002.htmlMailing List, Vendor Advisory
• http://support.apple.com/HT204245Vendor Advisory
• http://support.apple.com/HT204246Vendor Advisory
• http://www.securityfocus.com/bid/72334
• http://www.securitytracker.com/id/1031652Third Party Advisory, VDB Entry
• https://support.apple.com/HT204413Vendor Advisory
• http://lists.apple.com/archives/security-announce/2015/Jan/msg00000.htmlMailing List, Vendor Advisory
• http://lists.apple.com/archives/security-announce/2015/Jan/msg00001.htmlMailing List, Vendor Advisory
• http://lists.apple.com/archives/security-announce/2015/Mar/msg00002.htmlMailing List, Vendor Advisory
• http://support.apple.com/HT204245Vendor Advisory
• http://support.apple.com/HT204246Vendor Advisory
• http://www.securityfocus.com/bid/72334
• http://www.securitytracker.com/id/1031652Third Party Advisory, VDB Entry
• https://support.apple.com/HT204413Vendor Advisory

Published

Jan 30, 2015

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-4490Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2014-4491The extension APIs in the kernel in Apple iOS before 8.1.3, …
• CVE-2014-4492libnetcore in Apple iOS before 8.1.3, Apple OS X before 10.1…
• CVE-2014-4493The app-installation functionality in MobileInstallation in …
• CVE-2014-4494Springboard in Apple iOS before 8.1.3 does not properly vali…
• CVE-2014-4495The kernel in Apple iOS before 8.1.3, Apple OS X before 10.1…
• CVE-2014-4497Integer signedness error in IOBluetoothFamily in the Bluetoo…
• CVE-2014-4498The CPU Software in Apple OS X before 10.10.2 allows physica…
• CVE-2014-4499The App Store process in CommerceKit Framework in Apple OS X…
• CVE-2014-4501Multiple stack-based buffer overflows in sgminer before 4.2.…
• CVE-2014-4502Multiple heap-based buffer overflows in the parse_notify fun…
• CVE-2014-4503The parse_notify function in util.c in sgminer before 4.2.2 …