CVE-2014-8817

coresymbolicationd in CoreSymbolication in Apple OS X before 10.10.2 does not verify that expected data types are present in XPC messages, which allows attackers to execute arbitrary code in a privileged context via a crafted app, as demonstrated by lack of verification of xpc_dictionary_get_value API return values during handling of a (1) match_mmap_archives, (2) delete_mmap_archives, (3) write_mmap_archive, or (4) read_mmap_archive command.

• CWE-19

• http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.htmlVendor Advisory
• http://support.apple.com/HT204244Vendor Advisory
• http://www.securitytracker.com/id/1031650
• https://code.google.com/p/google-security-research/issues/detail?id=80Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/100496
• http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.htmlVendor Advisory
• http://support.apple.com/HT204244Vendor Advisory
• http://www.securitytracker.com/id/1031650
• https://code.google.com/p/google-security-research/issues/detail?id=80Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/100496

Published

Jan 30, 2015

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-8800Cross-site scripting (XSS) vulnerability in nextend-facebook…
• CVE-2014-8801Directory traversal vulnerability in services/getfile.php in…
• CVE-2014-8802The Pie Register plugin before 2.0.14 for WordPress does not…
• CVE-2014-8809Multiple cross-site scripting (XSS) vulnerabilities in the W…
• CVE-2014-8810SQL injection vulnerability in ajax/mail_functions.php in th…
• CVE-2014-8816CoreGraphics in Apple OS X before 10.10 allows remote attack…
• CVE-2014-8818Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2014-8819The Intel Graphics Driver in Apple OS X before 10.10.2 allow…
• CVE-2014-8820The Intel Graphics Driver in Apple OS X before 10.10.2 allow…
• CVE-2014-8821The Intel Graphics Driver in Apple OS X before 10.10.2 allow…
• CVE-2014-8822IOHIDFamily in Apple OS X before 10.10.2 allows attackers to…
• CVE-2014-8823The IOUSBControllerUserClient::ReadRegister function in the …