libnetcore in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not verify that certain values have the expected data type, which allows attackers to execute arbitrary code in an _networkd context via a crafted XPC message from a sandboxed app, as demonstrated by lack of verification of the XPC dictionary data type.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Iphone_os | Apple | * | 8.1.2 (including) |
| Mac_os_x | Apple | * | 10.10.1 (including) |
| Tvos | Apple | * | 7.0.1 (including) |