Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

Xcode 11 may let attackers run code when compiling

CVE-2019-8724 · published 6 years ago
Summary

The Xcode development tool (version 11.0) contains a flaw in its ld64 component that does not properly check input when building software. An attacker who can supply malicious code to the compiler could cause that code to run with the same permissions as the user running Xcode. Updating Xcode to version 11.0 or later fixes the problem.

What to do
  • Update apple xcode to version 11.0 or later.
Affected software
VendorProductAffected versions
apple xcode < 11.0
cpe:2.3:a:apple:xcode:*:*:*:*:*:*:*:*
Original advisory text
Multiple issues in ld64 in the Xcode toolchains were addressed by updating to version ld64-507.4. This issue is fixed in Xcode 11.0. Compiling code without proper input validation could lead to arb...
Multiple issues in ld64 in the Xcode toolchains were addressed by updating to version ld64-507.4. This issue is fixed in Xcode 11.0. Compiling code without proper input validation could lead to arbitrary code execution with user privilege.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
8.8 High
Exploitation
2% chance of attack within 30 days
Type
CWE-20Improper Input Validation
Timeline
Published18 Dec 2019
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2019-8724 · NVD
Track software like this
Free during beta