CVE-2015-1143

Vulnerability

LaunchServices in Apple OS X before 10.10.3 contains a type confusion issue that can be triggered by a crafted localized string. This affects all versions prior to the fix, including OS X Yosemite v10.10 to v10.10.2, and likely earlier versions as the security update also covers OS X Mountain Lion and Mavericks [1].

Exploitation

An attacker with local access to the system can craft a malicious localized string (e.g., a .strings file) that, when processed by LaunchServices, causes a type confusion. The exact sequence of steps is not publicly detailed, but the vulnerability is reachable without special privileges beyond local user access [1].

Impact

Successful exploitation allows a local user to gain elevated privileges. The type confusion may lead to arbitrary code execution in the context of LaunchServices, which runs with system privileges, resulting in privilege escalation [1].

Mitigation

Apple addressed this issue in OS X Yosemite v10.10.3 and Security Update 2015-004, released on April 8, 2015. Users should update to the latest version. No workarounds are documented, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog [1].