Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

iOS/Apple TV apps can gain system privileges

CVE-2014-4461 · published 11 years ago
Summary

iOS versions before 8.1.1 and Apple TV versions before 7.0.2 may let a specially crafted app run code with high-level system rights. This could let an attacker take control of the device or access sensitive data. Update the devices to the latest iOS or tvOS release to protect against this risk.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
apple iphone_os <= 8.1
8.0
8.0.1
8.0.2
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
apple mac_os_x <= 10.10.1
10.8.5
10.9.5
10.10.0
cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
apple tvos <= 7.0.1
6.0
6.0.1
6.0.2
6.1
6.1.1
6.1.2
6.2
6.2.1
7.0
cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
Original advisory text
The kernel in Apple iOS before 8.1.1 and Apple TV before 7.0.2 does not properly validate IOSharedDataQueue object metadata, which allows attackers to execute arbitrary code in a privileged context...
The kernel in Apple iOS before 8.1.1 and Apple TV before 7.0.2 does not properly validate IOSharedDataQueue object metadata, which allows attackers to execute arbitrary code in a privileged context via a crafted application.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
9.3 Critical
Exploitation
3% chance of attack within 30 days
Type
CWE-20Improper Input Validation
Timeline
Published18 Nov 2014
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2014-4461 · NVD
Track software like this
Free during beta