Sparkle-project

Sparkle

5 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
4.2

CVE-2026-47122

  • EPSS 0.08%
  • Veröffentlicht 21.07.2026 13:57:59
  • Zuletzt bearbeitet 05.08.2026 19:34:43

Sparkle is a software update framework for macOS. In versions up to and including 2.9.1, `Autoupdate/AppInstaller.m`'s `shouldAcceptNewConnection:` only enforces `SUCodeSigningVerifier validateConnection:` before stage 1 completes. After `_performedS...

6.1

CVE-2026-47121

  • EPSS 0.23%
  • Veröffentlicht 21.07.2026 13:53:05
  • Zuletzt bearbeitet 05.08.2026 19:45:19

Sparkle is a software update framework for macOS. Prior to version 2.9.2, `Autoupdate/SUBinaryDeltaApply.m` enforces `relativePath.pathComponents containsObject:@".."` and rejects writes whose immediate parent directory IS itself a symbolic link, but...

8.8

CVE-2025-10016

  • EPSS 0.19%
  • Veröffentlicht 16.09.2025 10:03:28
  • Zuletzt bearbeitet 15.04.2026 00:35:42

The Sparkle framework includes a helper tool Autoupdate. Due to lack of authentication of connecting clients a local unprivileged attacker can request installation of crafted malicious PKG file by racing to connect to the daemon when other app spawn...

4.8

CVE-2025-10015

  • EPSS 0.17%
  • Veröffentlicht 16.09.2025 10:03:22
  • Zuletzt bearbeitet 15.04.2026 00:35:42

The Sparkle framework includes an XPC service Downloader.xpc, by default this service is private to the application its bundled with. A local unprivileged attacker can register this XPC service globally which will inherit TCC permissions of the appli...

6.8

CVE-2025-0509

  • EPSS 0.89%
  • Veröffentlicht 04.02.2025 20:15:49
  • Zuletzt bearbeitet 05.08.2025 14:35:15

A security issue was found in Sparkle before version 2.6.4. An attacker can replace an existing signed update with another payload, bypassing Sparkle’s (Ed)DSA signing checks.