Analysis of iOS & OS X Vulnerability: CVE-2016-1722

This advisory describes a heap-buffer overflow in syslogd (dbserver.c add_lockdown_session) caused by a mistaken size calculation in reallocf that leads to out-of-bounds writes of file-descriptor values; it affects iOS 6.0–9.2 and OS X 10.9–10.11.2, can cause crashes and under certain scenarios enable local privilege escalation or remote code execution from a trusted/paired host, and was reported to and patched by Apple in the iOS 9.2.1 update.