The Apple ID OD plug-in in Apple OS X prior to 10.10.5 allows malicious users to change arbitrary user passwords via a crafted app.
apple mac os x