Approved changes feed: RSS · Atom
cpe:2.3:a:archify:archify:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Archify (f3e29a53-cb8e-5f29-ae03-234bdeacfd20) |
|---|---|
| Product | Archify (6b6b8c13-d6e4-5792-8aef-7ce0db3faf25) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-9062 |
vulnerable | 2026-06-08 07:00:26.581903 |
macOS Archify: Local Privilege Escalation
HIGH (7.8)
The Archify application contains a local privilege escalation vulnerability due to insufficient client validation in its privileged helper tool, com.oct4pie.archifyhelper, which is exposed via XPC. Archify follows the "factored applications" model, delegating privileged operations—such as arbitrary file deletion and file permission changes—to this helper running as root. However, the helper does not verify the code signature, entitlements, or signing flags of the connecting client. Although macOS provides secure validation mechanisms like auditToken, these are not implemented. As a result, any local process can establish a connection to the helper and invoke privileged functionality, leading to unauthorized execution of actions with root-level privileges.
Published: 2025-06-10T23:25:30.420Z
Updated: 2025-06-11T13:41:12.653Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.