7.8
HIGH
CVE-2016-1825
Apple IOHIDFamily Unprivileged Code Execution and Denial of Service Vulnerability
Description

IOHIDFamily in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

INFO

Published Date :

May 20, 2016, 10:59 a.m.

Last Modified :

Dec. 2, 2016, 10:45 p.m.

Remotely Exploitable :

No

Impact Score :

5.9

Exploitability Score :

1.8
Public PoC/Exploit Available at Github

CVE-2016-1825 has a 2 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

Affected Products

The following products are affected by CVE-2016-1825 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Apple mac_os_x
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2016-1825.

URL Resource
http://lists.apple.com/archives/security-announce/2016/May/msg00004.html Mailing List Vendor Advisory
http://www.securityfocus.com/bid/90696 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1035895 Third Party Advisory VDB Entry
https://support.apple.com/HT206567 Vendor Advisory

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Here is some resources about macOS/iOS system security.

Updated: 2 months, 2 weeks ago
496 stars 49 fork 49 watcher
Born at : Aug. 26, 2020, 8:21 a.m. This repo has been linked 166 different CVEs too.

Local privilege escalation through macOS 10.12.1 via CVE-2016-1825 or CVE-2016-7617.

Makefile C Assembly

Updated: 2 months, 4 weeks ago
63 stars 12 fork 12 watcher
Born at : Dec. 25, 2016, 5:07 a.m. This repo has been linked 2 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2016-1825 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2016-1825 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by [email protected]

    May. 14, 2024

    Action Type Old Value New Value
  • Modified Analysis by [email protected]

    Dec. 02, 2016

    Action Type Old Value New Value
    Changed Reference Type http://www.securitytracker.com/id/1035895 No Types Assigned http://www.securitytracker.com/id/1035895 Third Party Advisory, VDB Entry
    Changed Reference Type http://www.securityfocus.com/bid/90696 No Types Assigned http://www.securityfocus.com/bid/90696 Third Party Advisory, VDB Entry
    Changed Reference Type http://lists.apple.com/archives/security-announce/2016/May/msg00004.html Vendor Advisory http://lists.apple.com/archives/security-announce/2016/May/msg00004.html Mailing List, Vendor Advisory
  • CVE Modified by [email protected]

    Dec. 01, 2016

    Action Type Old Value New Value
    Added Reference http://www.securitytracker.com/id/1035895 [No Types Assigned]
  • CVE Modified by [email protected]

    Nov. 28, 2016

    Action Type Old Value New Value
    Added Reference http://www.securityfocus.com/bid/90696 [No Types Assigned]
  • Modified Analysis by [email protected]

    May. 20, 2016

    Action Type Old Value New Value
    Added CPE Configuration Configuration 1 OR *cpe:2.3:o:apple:mac_os_x:10.11.4:*:*:*:*:*:*:* (and previous)
    Added CVSS V2 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
    Added CVSS V3 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    Changed Reference Type https://support.apple.com/HT206567 No Types Assigned https://support.apple.com/HT206567 Advisory
    Changed Reference Type http://lists.apple.com/archives/security-announce/2016/May/msg00004.html No Types Assigned http://lists.apple.com/archives/security-announce/2016/May/msg00004.html Advisory
    Added CWE CWE-119
  • Initial Analysis by [email protected]

    May. 20, 2016

    Action Type Old Value New Value
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
Exploit Prediction

EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days.

0.19 }} 0.01%

score

0.56810

percentile

CVSS30 - Vulnerability Scoring System
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability