The protected range register in the EFI component in Apple OS X before 10.11 has an incorrect value, which allows attackers to cause a denial of service (boot failure) via a crafted app that writes to an unintended address.
https://support.apple.com/HT205267
http://www.securitytracker.com/id/1033703
http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html