CVE-2014-4488

CriticalCVSS 10.0/10Last modified Jun 17, 2026

Description

IOHIDFamily in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not properly validate resource-queue metadata, which allows attackers to execute arbitrary code in a privileged context via a crafted app.

Metrics

CVSS 2.0 10.0/10AV:N/AC:L/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-19

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.apple.com/archives/security-announce/2015/Jan/msg00000.htmlVendor Advisory
http://lists.apple.com/archives/security-announce/2015/Jan/msg00001.htmlVendor Advisory
http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.htmlVendor Advisory
http://support.apple.com/HT204244Vendor Advisory
http://support.apple.com/HT204245Vendor Advisory
http://support.apple.com/HT204246Vendor Advisory
http://www.securitytracker.com/id/1031650
http://lists.apple.com/archives/security-announce/2015/Jan/msg00000.htmlVendor Advisory
http://lists.apple.com/archives/security-announce/2015/Jan/msg00001.htmlVendor Advisory
http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.htmlVendor Advisory
http://support.apple.com/HT204244Vendor Advisory
http://support.apple.com/HT204245Vendor Advisory
http://support.apple.com/HT204246Vendor Advisory
http://www.securitytracker.com/id/1031650

Timeline

Published: Jan 30, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-448910.0IOHIDFamily in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not properly initialize event queues, which CVE-2014-44915.0The extension APIs in the kernel in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 do not prevent the presence CVE-2014-44927.5libnetcore in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not verify that certain values have the expe CVE-2014-44937.5The app-installation functionality in MobileInstallation in Apple iOS before 8.1.3 allows attackers to obtain control of the local app conta CVE-2014-44946.8Springboard in Apple iOS before 8.1.3 does not properly validate signatures when determining whether to solicit an app trust decision from t CVE-2014-449510.0The kernel in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not enforce the read-only attribute of a sha CVE-2014-44965.0The mach_port_kobject interface in the kernel in Apple iOS before 8.1.3 and Apple TV before 7.0.3 does not properly restrict kernel-address CVE-2014-449710.0Integer signedness error in IOBluetoothFamily in the Bluetooth implementation in Apple OS X before 10.10 allows attackers to execute arbitra CVE-2014-44984.7The CPU Software in Apple OS X before 10.10.2 allows physically proximate attackers to modify firmware during the EFI update process by inse CVE-2014-44992.1The App Store process in CommerceKit Framework in Apple OS X before 10.10.2 places Apple ID credentials in App Store logs, which allows loca CVE-2014-450110.0Multiple stack-based buffer overflows in sgminer before 4.2.2, cgminer before 4.3.5, and BFGMiner before 3.3.0 allow remote pool servers to CVE-2014-450210.0Multiple heap-based buffer overflows in the parse_notify function in sgminer before 4.2.2, cgminer before 4.3.5, and BFGMiner before 4.1.0 a