Sign-up

ID

VAR-201107-0026


CVE

CVE-2011-0227


TITLE

Apple iOS of IOMobileFrameBuffer Vulnerability gained in

Trust: 0.8

sources: JVNDB: JVNDB-2011-001952

DESCRIPTION

The queueing primitives in IOMobileFrameBuffer in Apple iOS before 4.2.9 and 4.3.x before 4.3.4 do not properly perform type conversion, which allows local users to gain privileges via a crafted application. Apple iOS for iPhone, iPod touch, and iPad is prone to a local privilege-escalation vulnerability. Successfully exploiting this issue can allow attackers to elevate privileges, leading to a complete compromise of the device. NOTE: This issue is related to the vulnerability discussed in BID 48619 (FreeType 'src/psaux/t1decode.c' Memory Corruption Vulnerability) in that it was used to jailbreak iOS devices through 'JailbreakMe 3.0'. Apple iOS is an operating system developed by Apple (Apple) for mobile devices. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2011-07-15-1 iOS 4.3.4 Software Update iOS 4.3.4 Software Update is now available and addresses the following: CoreGraphics Available for: iOS 3.0 through 4.3.3 for iPhone 3GS and iPhone 4 (GSM), iOS 3.1 through 4.3.3 for iPod touch (3rd generation) and later, iOS 3.2 through 4.3.3 for iPad Impact: Viewing a maliciously crafted PDF file may lead to an unexpected application termination or arbitrary code execution Description: A buffer overflow exists in FreeType's handling of TrueType fonts. Viewing a maliciously crafted PDF file may lead to an unexpected application termination or arbitrary code execution. CVE-ID CVE-2010-3855 CoreGraphics Available for: iOS 3.0 through 4.3.3 for iPhone 3GS and iPhone 4 (GSM), iOS 3.1 through 4.3.3 for iPod touch (3rd generation) and later, iOS 3.2 through 4.3.3 for iPad Impact: Viewing a maliciously crafted PDF file may lead to an unexpected application termination or arbitrary code execution Description: A signedness issue exists in FreeType's handling of Type 1 fonts. Viewing a maliciously crafted PDF file may lead to an unexpected application termination or arbitrary code execution. CVE-ID CVE-2011-0227 Installation note: This update is only available through iTunes, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from www.apple.com/itunes/ iTunes will automatically check Apple's update server on its weekly schedule. When an update is detected, it will download it. We recommend applying the update immediately if possible. The automatic update process may take up to a week depending on the day that iTunes checks for updates. You may manually obtain the update via the Check for Updates button within iTunes. The version after applying this update will be "4.3.4 (8K2)". Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.9 (Darwin) iQEcBAEBAgAGBQJOHxUUAAoJEGnF2JsdZQees68IAKfVMxNu9e4y9uiqTHTJffJI iqqAi7rw8bWHHaynyn32+XrEPnhljiaghsN1jMkt8pkkwedHuyrI7tKA8g7hrpbQ rlZO+6dvwmbaKMUE8DuKxs2dJLE/9zaQw8rndJikxSfqTYpctcGPAMg+yMt5Y0eA 5ssBPYbl4xaDEWJIJi46oonxhdqvjBLkGG46FeS2TDk4jM5WQFFc2QfuC2ami4o7 EhOZuA6t4eNaa3CLevWkQjWwkWO2Mp2f90mOTlCLobxb3hfSf43eW/sjmjiSK1lR 121G/89TJW3DnkhU1APnoJ8EOk02U7QR1k4u7DblYxMI6WA+rhx5yYW4yRfaN9E= =e4ew -----END PGP SIGNATURE-----

Trust: 2.16

sources: NVD: CVE-2011-0227 // JVNDB: JVNDB-2011-001952 // BID: 48701 // VULHUB: VHN-48172 // PACKETSTORM: 103127 // PACKETSTORM: 103126

AFFECTED PRODUCTS

vendor:applemodel:iphone osscope:eqversion:3.2.1

Trust: 1.6

vendor:applemodel:iphone osscope:eqversion:4.0.2

Trust: 1.6

vendor:applemodel:iphone osscope:eqversion:4.0.1

Trust: 1.6

vendor:applemodel:iphone osscope:eqversion:4.0

Trust: 1.6

vendor:applemodel:iphone osscope:eqversion:4.1

Trust: 1.6

vendor:applemodel:iphone osscope:eqversion:3.2.2

Trust: 1.6

vendor:applemodel:iphone osscope:eqversion:3.1.3

Trust: 1.6

vendor:applemodel:iphone osscope:eqversion:3.2

Trust: 1.6

vendor:applemodel:iphone osscope:eqversion:4.2.1

Trust: 1.6

vendor:applemodel:iphone osscope:eqversion:4.2.5

Trust: 1.6

vendor:applemodel:iphone osscope:eqversion:4.3.2

Trust: 1.0

vendor:applemodel:iphone osscope:eqversion:1.0.0

Trust: 1.0

vendor:applemodel:iphone osscope:eqversion:2.2.1

Trust: 1.0

vendor:applemodel:iphone osscope:eqversion:2.2

Trust: 1.0

vendor:applemodel:iphone osscope:eqversion:2.0.1

Trust: 1.0

vendor:applemodel:iphone osscope:eqversion:1.1.3

Trust: 1.0

vendor:applemodel:iphone osscope:eqversion:4.3.3

Trust: 1.0

vendor:applemodel:iphone osscope:eqversion:2.1

Trust: 1.0

vendor:applemodel:iphone osscope:eqversion:1.0.1

Trust: 1.0

vendor:applemodel:iphone osscope:eqversion:2.0.2

Trust: 1.0

vendor:applemodel:iphone osscope:eqversion:1.1.1

Trust: 1.0

vendor:applemodel:iphone osscope:eqversion:3.0

Trust: 1.0

vendor:applemodel:iphone osscope:lteversion:4.2.8

Trust: 1.0

vendor:applemodel:iphone osscope:eqversion:1.1.4

Trust: 1.0

vendor:applemodel:iphone osscope:eqversion:3.0.1

Trust: 1.0

vendor:applemodel:iphone osscope:eqversion:1.1.5

Trust: 1.0

vendor:applemodel:iphone osscope:eqversion:2.1.1

Trust: 1.0

vendor:applemodel:iphone osscope:eqversion:4.3.0

Trust: 1.0

vendor:applemodel:iphone osscope:eqversion:4.3.1

Trust: 1.0

vendor:applemodel:iphone osscope:eqversion:2.0

Trust: 1.0

vendor:applemodel:iphone osscope:eqversion:3.1

Trust: 1.0

vendor:applemodel:iphone osscope:eqversion:1.1.0

Trust: 1.0

vendor:applemodel:iphone osscope:eqversion:1.0.2

Trust: 1.0

vendor:applemodel:iphone osscope:eqversion:1.1.2

Trust: 1.0

vendor:applemodel:iphone osscope:eqversion:2.0.0

Trust: 1.0

vendor:applemodel:iphone osscope:eqversion:3.1.2

Trust: 1.0

vendor:applemodel:iosscope:eqversion:3.0 to 4.3.3 ( iphone 3gs and iphone 4 (gsm model ))

Trust: 0.8

vendor:applemodel:iosscope:eqversion:3.1 to 4.3.3 (ipod touch (3rd generation) after )

Trust: 0.8

vendor:applemodel:iosscope:eqversion:3.2 to 4.3.3 (ipad for )

Trust: 0.8

vendor:applemodel:iosscope:eqversion:4.2.5 to 4.2.8 (iphone 4 (cdma model ))

Trust: 0.8

vendor:applemodel:ipadscope: - version: -

Trust: 0.8

vendor:applemodel:iphonescope: - version: -

Trust: 0.8

vendor:applemodel:ipod touchscope: - version: -

Trust: 0.8

vendor:applemodel:ipod touchscope:eqversion:0

Trust: 0.3

vendor:applemodel:iphonescope:eqversion:0

Trust: 0.3

vendor:applemodel:ipadscope:eqversion:0

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.2.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.2.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.8

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.7

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.6

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.5

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.0

Trust: 0.3

vendor:applemodel:iosscope:neversion:4.3.4

Trust: 0.3

vendor:applemodel:iosscope:neversion:4.2.9

Trust: 0.3

sources: BID: 48701 // JVNDB: JVNDB-2011-001952 // CNNVD: CNNVD-201107-231 // NVD: CVE-2011-0227

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2011-0227
value: HIGH

Trust: 1.0

NVD: CVE-2011-0227
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201107-231
value: HIGH

Trust: 0.6

VULHUB: VHN-48172
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2011-0227
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-48172
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-48172 // JVNDB: JVNDB-2011-001952 // CNNVD: CNNVD-201107-231 // NVD: CVE-2011-0227

PROBLEMTYPE DATA

problemtype:CWE-264

Trust: 1.9

sources: VULHUB: VHN-48172 // JVNDB: JVNDB-2011-001952 // NVD: CVE-2011-0227

THREAT TYPE

local

Trust: 0.9

sources: BID: 48701 // CNNVD: CNNVD-201107-231

TYPE

permissions and access control

Trust: 0.6

sources: CNNVD: CNNVD-201107-231

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2011-001952

PATCH
title:HT4802url:http://support.apple.com/kb/HT4802
Trust: 0.8
title:HT4803url:http://support.apple.com/kb/HT4803
Trust: 0.8
title:HT4802url:http://support.apple.com/kb/HT4802?viewlocale=ja_JP
Trust: 0.8
title:HT4803url:http://support.apple.com/kb/HT4803?viewlocale=ja_JP
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2011-001952

EXTERNAL IDS
db:NVDid:CVE-2011-0227
Trust: 3.0
db:JVNDBid:JVNDB-2011-001952
Trust: 0.8
db:CNNVDid:CNNVD-201107-231
Trust: 0.7
db:APPLEid:APPLE-SA-2011-07-15-2
Trust: 0.6
db:APPLEid:APPLE-SA-2011-07-15-1
Trust: 0.6
db:BIDid:48701
Trust: 0.4
db:VULHUBid:VHN-48172
Trust: 0.1
db:PACKETSTORMid:103127
Trust: 0.1
db:PACKETSTORMid:103126
Trust: 0.1
sources:
            
            
            VULHUB: VHN-48172 // 
            
            
            
            BID: 48701 // 
            
            
            
            JVNDB: JVNDB-2011-001952 // 
            
            
            
            PACKETSTORM: 103127 // 
            
            
            
            PACKETSTORM: 103126 // 
            
            
            
            CNNVD: CNNVD-201107-231 // 
            
            
            
            NVD: CVE-2011-0227

REFERENCES
url:http://lists.apple.com/archives/security-announce/2011//jul/msg00000.html
Trust: 1.7
url:http://lists.apple.com/archives/security-announce/2011//jul/msg00001.html
Trust: 1.7
url:http://support.apple.com/kb/ht4802
Trust: 1.7
url:http://support.apple.com/kb/ht4803
Trust: 1.7
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-0227
Trust: 0.8
url:http://jvn.jp/cert/jvnvu619694
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-0227
Trust: 0.8
url:http://lists.nongnu.org/archive/html/freetype-devel/2011-07/msg00014.html
Trust: 0.3
url:http://www.appleinsider.com/articles/11/07/06/hackers_release_new_browser_based_ios_jailbreak_based_on_pdf_exploit.html
Trust: 0.3
url:http://www.apple.com/iphone/softwareupdate/
Trust: 0.3
url:http://www.apple.com/iphone/
Trust: 0.3
url:http://www.apple.com/ipodtouch/
Trust: 0.3
url:https://www.apple.com/itunes/
Trust: 0.2
url:https://www.apple.com/support/security/pgp/
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2011-0227
Trust: 0.2
url:http://support.apple.com/kb/ht1222
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2010-3855
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2011-0226
Trust: 0.1
sources:
            
            
            VULHUB: VHN-48172 // 
            
            
            
            BID: 48701 // 
            
            
            
            JVNDB: JVNDB-2011-001952 // 
            
            
            
            PACKETSTORM: 103127 // 
            
            
            
            PACKETSTORM: 103126 // 
            
            
            
            CNNVD: CNNVD-201107-231 // 
            
            
            
            NVD: CVE-2011-0227

CREDITS
local
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-201107-231

SOURCES
db:VULHUBid:VHN-48172
db:BIDid:48701
db:JVNDBid:JVNDB-2011-001952
db:PACKETSTORMid:103127
db:PACKETSTORMid:103126
db:CNNVDid:CNNVD-201107-231
db:NVDid:CVE-2011-0227

LAST UPDATE DATE
2025-04-11T20:52:57.866000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-48172date:2011-07-26T00:00:00
db:BIDid:48701date:2015-03-19T08:52:00
db:JVNDBid:JVNDB-2011-001952date:2011-07-27T00:00:00
db:CNNVDid:CNNVD-201107-231date:2011-07-20T00:00:00
db:NVDid:CVE-2011-0227date:2025-04-11T00:51:21.963

SOURCES RELEASE DATE
db:VULHUBid:VHN-48172date:2011-07-19T00:00:00
db:BIDid:48701date:2011-07-06T00:00:00
db:JVNDBid:JVNDB-2011-001952date:2011-07-27T00:00:00
db:PACKETSTORMid:103127date:2011-07-18T14:19:23
db:PACKETSTORMid:103126date:2011-07-18T14:16:35
db:CNNVDid:CNNVD-201107-231date:2011-07-20T00:00:00
db:NVDid:CVE-2011-0227date:2011-07-19T22:55:00.883