VARIoT IoT vulnerabilities database
| VAR-201712-0273 | CVE-2017-13878 | Apple macOS of Intel Graphics Driver Vulnerability that bypasses memory read restrictions in components |
CVSS V2: 5.6 CVSS V3: 7.1 Severity: HIGH |
An issue was discovered in certain Apple products. macOS before 10.13.2 is affected. The issue involves the "Intel Graphics Driver" component. It allows local users to bypass intended memory-read restrictions or cause a denial of service (out-of-bounds read and system crash). Apple macOS is prone to multiple security vulnerabilities.
Attackers can exploit these issues to bypass security restrictions, execute arbitrary code and perform unauthorized action; this may aid in launching further attacks. Apple macOS High Sierra is a dedicated operating system developed by Apple for Mac computers. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
APPLE-SA-2017-12-6-1 macOS High Sierra 10.13.2, Security Update
2017-002 Sierra, and Security Update 2017-005 El Capitan
macOS High Sierra 10.13.2, Security Update 2017-002 Sierra, and
Security Update 2017-005 El Capitan are now available and address
the following:
apache
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: Processing a maliciously crafted Apache configuration
directive may result in the disclosure of process memory
Description: Multiple issues were addressed by updating to
version 2.4.28.
CVE-2017-9798
curl
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: Malicious FTP servers may be able to cause the client to read
out-of-bounds memory
Description: An out-of-bounds read issue existed in the FTP PWD
response parsing. This issue was addressed with improved bounds
checking.
CVE-2017-1000254: Max Dymond
Directory Utility
Available for: macOS High Sierra 10.13 and macOS High Sierra 10.13.1
Not impacted: macOS Sierra 10.12.6 and earlier
Impact: An attacker may be able to bypass administrator
authentication without supplying the administrator's password
Description: A logic error existed in the validation of credentials.
This was addressed with improved credential validation.
CVE-2017-13872
Intel Graphics Driver
Available for: macOS High Sierra 10.13.1
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling. This was addressed through improved
input validation.
CVE-2017-13878: Ian Beer of Google Project Zero
Intel Graphics Driver
Available for: macOS High Sierra 10.13.1
Impact: An application may be able to execute arbitrary code with
system privileges
Description: An out-of-bounds read was addressed through improved
bounds checking.
CVE-2017-13875: Ian Beer of Google Project Zero
IOAcceleratorFamily
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13844: found by IMF developed by HyungSeok Han (daramg.gift)
of SoftSec, KAIST (softsec.kaist.ac.kr)
IOKit
Available for: macOS High Sierra 10.13.1
Impact: An application may be able to execute arbitrary code with
system privileges
Description: An input validation issue existed in the kernel. This
issue was addressed through improved input validation.
CVE-2017-13848: Alex Plaskett of MWR InfoSecurity
CVE-2017-13858: an anonymous researcher
IOKit
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to execute arbitrary code with
system privileges
Description: Multiple memory corruption issues were addressed through
improved state management.
CVE-2017-13847: Ian Beer of Google Project Zero
Kernel
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13862: Apple
Kernel
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to read restricted memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2017-13833: Brandon Azad
Kernel
Available for: macOS High Sierra 10.13.1
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13876: Ian Beer of Google Project Zero
Kernel
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to read restricted memory
Description: A type confusion issue was addressed with improved
memory handling.
CVE-2017-13855: Jann Horn of Google Project Zero
Kernel
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: A malicious application may be able to execute arbitrary
code with kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13867: Ian Beer of Google Project Zero
Kernel
Available for: macOS High Sierra 10.13.1
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2017-13865: Ian Beer of Google Project Zero
Kernel
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2017-13868: Brandon Azad
CVE-2017-13869: Jann Horn of Google Project Zero
Mail
Available for: macOS High Sierra 10.13.1
Impact: A S/MIME encrypted email may be inadvertently sent
unencrypted if the receiver's S/MIME certificate is not installed
Description: An inconsistent user interface issue was addressed with
improved state management.
CVE-2017-13871: an anonymous researcher
Mail Drafts
Available for: macOS High Sierra 10.13.1
Impact: An attacker with a privileged network position may be able to
intercept mail
Description: An encryption issue existed with S/MIME credetials. The
issue was addressed with additional checks and user control.
CVE-2017-13860: Michael Weishaar of INNEO Solutions GmbH
OpenSSL
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to read restricted memory
Description: An out-of-bounds read issue existed in
X.509 IPAddressFamily parsing. This issue was addressed with improved
bounds checking.
CVE-2017-3735: found by OSS-Fuzz
Screen Sharing Server
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6
Impact: A user with screen sharing access may be able to access any
file readable by root
Description: A permissions issue existed in the handling of screen
sharing sessions. This issue was addressed with improved permissions
handling.
CVE-2017-13826: Trevor Jacques of Toronto
Installation note:
macOS High Sierra 10.13.2, Security Update 2017-002 Sierra, and
Security Update 2017-005 El Capitan may be obtained from the
Mac App Store or Apple's Software Downloads web site:
https://support.apple.com/downloads/
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
iQJdBAEBCgBHFiEEcuX4rtoRe4X62yWlg6PvjDRstEYFAlooN9kpHHByb2R1Y3Qt
c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQg6PvjDRstEbvlg/7
Bub6HL7Bv+9taMMz+3Rl2exjVIBv3fUflhpLh1524wFe6UjUyy4Z3X0t/LKogGwb
GkHmcvDTK+85yLJeF0XQLHzzeITPrAiQ06FSnpzq6GjDEgczgbyJtw6aT4iagDgK
NYfWnmU1XDjpx35kjEyyZblIxDHsvMJRelMdjx4w6In3Pgi+DG+ndYbK5hoaImOX
Ywaoc2xzGUXpnJU6Y5tkIbVBF4P4tZQcJJt6cfhTOcR9+ut87HQqc9mo1UGMUqAv
z0kYZ4MtGRM4uDiVynkKxwj+NNtSVxwvf1mN2Jb7ApFt0lAfmS8L8xzI15NlbJxJ
oSuIvVi3pAhOkO7etaC/CLOxw+wRGaRbaf1i4VmaLI6HW2H2/vWiL1KDhHFIIfVq
xBGday+yWkaS9o8B85QZy2GHxEFYxzMvArtzK3tBj2kZCuEcJis60CanwZOSbcsp
4IlEKVGabMNwGwOVX22UwrLCtMzsqSVZpYyKy/m7n6DXnpspuWTohDmc68zq/4nj
5LgGTFz8IUaT1ujQZq9g4siVeXzu0bsAgttauRlrWilUsDtpsv5s+dkGlXPFxbDf
BuvNgqGSg/xz0QRGmJ7UA3g3L7fTvWhOzXnBOh7c45OpYT54tqGIEi6Bk72NyPz+
ioQ7LBPJE6RCSy5XZJ6x8YwSYp+kO8BBPaYsxSoxXCs=
=2VBd
-----END PGP SIGNATURE-----
| VAR-201712-0274 | CVE-2017-13879 | Apple iOS of IOMobileFrameBuffer Component vulnerable to arbitrary code execution in privileged context |
CVSS V2: 9.3 CVSS V3: 7.8 Severity: HIGH |
An issue was discovered in certain Apple products. iOS before 11.2 is affected. The issue involves the "IOMobileFrameBuffer" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app. Apple iOS is prone to multiple security vulnerabilities.
Attackers can exploit these issues to bypass security restrictions, execute arbitrary code and perform unauthorized action; this may aid in launching further attacks.
Versions prior to iOS 11.2 are vulnerable. Apple iOS is an operating system developed by Apple (Apple) for mobile devices. IOMobileFrameBuffer is one of the connection frames used for screenshots. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
APPLE-SA-2017-12-13-6 Additional information for
APPLE-SA-2017-12-6-2 iOS 11.2
iOS 11.2 addresses the following:
IOKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: Multiple memory corruption issues were addressed through
improved state management.
CVE-2017-13847: Ian Beer of Google Project Zero
IOMobileFrameBuffer
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privilege
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13879: Apple
IOSurface
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13861: Ian Beer of Google Project Zero
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13862: Apple
CVE-2017-13876: Ian Beer of Google Project Zero
CVE-2017-13867: Ian Beer of Google Project Zero
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2017-13833: Brandon Azad
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A type confusion issue was addressed with improved
memory handling.
CVE-2017-13855: Jann Horn of Google Project Zero
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2017-13865: Ian Beer of Google Project Zero
CVE-2017-13868: Brandon Azad
CVE-2017-13869: Jann Horn of Google Project Zero
Mail
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Incorrect certificate is used for encryption
Description: A S/MIME issue existed in the handling of encrypted
email. This issue was addressed through improved selection of the
encryption certificate.
CVE-2017-13874: an anonymous researcher
Mail Drafts
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An attacker with a privileged network position may be able to
intercept mail
Description: An encryption issue existed with S/MIME credetials. The
issue was addressed with additional checks and user control.
CVE-2017-13860: Michael Weishaar of INNEO Solutions GmbH
Mail Message Framework
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Visiting a malicious website may lead to address bar spoofing
Description: An inconsistent user interface issue was addressed with
improved state management.
CVE-2017-2433: an anonymous researcher, an anonymous researcher, an
anonymous researcher
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: Multiple memory corruption issues were addressed with
improved memory handling.
CVE-2017-7156: an anonymous researcher
CVE-2017-7157: an anonymous researcher
CVE-2017-13856: Jeonghoon Shin
CVE-2017-13870: an anonymous researcher
CVE-2017-13866: an anonymous researcher
Entry added December 13, 2017
Wi-Fi
Available for: iPhone 6s, iPhone 6s Plus, iPhone 6, iPhone 6 Plus,
iPhone SE, iPhone 5s, 12.9-inch iPad Pro 1st generation, iPad Air 2,
iPad Air, iPad 5th generation, iPad mini 4, iPad mini 3, iPad mini 2,
and iPod touch 6th generation
Released for iPhone 7 and later and iPad Pro 9.7-inch (early 2016)
and later in iOS 11.1.
Impact: An attacker in Wi-Fi range may force nonce reuse in WPA
multicast/GTK clients (Key Reinstallation Attacks - KRACK)
Description: A logic issue existed in the handling of state
transitions. This was addressed with improved state management.
CVE-2017-13080: Mathy Vanhoef of the imec-DistriNet group at KU
Leuven
Installation note:
This update is available through iTunes and Software Update on your
iOS device, and will not appear in your computer's Software Update
application, or in the Apple Downloads site. Make sure you have an
Internet connection and have installed the latest version of iTunes
from https://www.apple.com/itunes/
iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is
presented to the user when the iOS device is docked. We recommend
applying the update immediately if possible. Selecting Don't Install
will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the
day that iTunes or the device checks for updates. You may manually
obtain the update via the Check for Updates button within iTunes, or
the Software Update on your device.
To check that the iPhone, iPod touch, or iPad has been updated:
* Navigate to Settings
* Select General
* Select About. The version after applying this update
will be "11.2".
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
iQJdBAEBCgBHFiEEcuX4rtoRe4X62yWlg6PvjDRstEYFAloxpFkpHHByb2R1Y3Qt
c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQg6PvjDRstEZl4BAA
mIM4eryXVEmYPSwJFEm6vobzCLahEng05NHE5Vm8eD94T/ZS1HCnkkWwD9KVQEMT
HvoZsEB+UZSQQ8VtR3zXDnRJTY1ajSC47CT5GPIZUFTpDb6QrprVEtsFqaqtO+G8
B2JpRL6OY4KRFiSQWPgjr0BaxC6oRc9LmgYByJLyQp5dNAlzhuUsGcK/Dd6NWQgH
0GOqHe/xLc4evNsJTfPKPzXTaH0BvBUOhtYJo9pof4xBxRQES4vNcJpR366eBP1z
zSmQwvB9+Hkcol2Cclt+p6pPHLgqFXbd+xDVOEE1aGdlC29cIF46kKu3PGwwMUTA
xSCrVGLWvwnoF5LhHKhhN3D1i35NmJcL1Fq7AF/na2POFrM3uyC8iRBKBwUeRyGG
GZwPwFvRzPVXW8iVVte0qgJ4PYEwbXvh8Ju5F1U7s0g2Fvqw9XIasQeK4Uf/lvsl
c9SsDQaePBbBDrskL77ZQviMW9H1p/o2KHbFNgnpJzqdTwj4eFMdp/3zmRPULFT4
jd8n0TRjI/oB7/5r89jQ+5rp3cX0Nupfq0Fvf5pl6A3t4YYUHHQGjJF6Rbgu2EPy
Pn+9WOt6mHhp/e5D5Z4lLCe2q+WeeWGI425UaJC60VTXy4mwKWDQpwGpSnSDkawE
Ja6XuvBRDwFQSQTbXG7vdIKPEtzHWpHY3YUHipa5XKU=
=ptgx
-----END PGP SIGNATURE-----
| VAR-201712-0271 | CVE-2017-13875 | Apple macOS of Intel Graphics Driver Component vulnerable to arbitrary code execution in privileged context |
CVSS V2: 9.3 CVSS V3: 7.8 Severity: HIGH |
An issue was discovered in certain Apple products. macOS before 10.13.2 is affected. The issue involves the "Intel Graphics Driver" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (out-of-bounds read) via a crafted app. Apple macOS is prone to multiple security vulnerabilities.
Attackers can exploit these issues to bypass security restrictions, execute arbitrary code and perform unauthorized action; this may aid in launching further attacks. Apple macOS High Sierra is a dedicated operating system developed by Apple for Mac computers. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
APPLE-SA-2017-12-6-1 macOS High Sierra 10.13.2, Security Update
2017-002 Sierra, and Security Update 2017-005 El Capitan
macOS High Sierra 10.13.2, Security Update 2017-002 Sierra, and
Security Update 2017-005 El Capitan are now available and address
the following:
apache
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: Processing a maliciously crafted Apache configuration
directive may result in the disclosure of process memory
Description: Multiple issues were addressed by updating to
version 2.4.28.
CVE-2017-9798
curl
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: Malicious FTP servers may be able to cause the client to read
out-of-bounds memory
Description: An out-of-bounds read issue existed in the FTP PWD
response parsing. This issue was addressed with improved bounds
checking.
CVE-2017-1000254: Max Dymond
Directory Utility
Available for: macOS High Sierra 10.13 and macOS High Sierra 10.13.1
Not impacted: macOS Sierra 10.12.6 and earlier
Impact: An attacker may be able to bypass administrator
authentication without supplying the administrator's password
Description: A logic error existed in the validation of credentials.
This was addressed with improved credential validation.
CVE-2017-13883: an anonymous researcher
Intel Graphics Driver
Available for: macOS High Sierra 10.13.1
Impact: A local user may be able to cause unexpected system
termination or read kernel memory
Description: An out-of-bounds read issue existed that led to the
disclosure of kernel memory. This was addressed through improved
input validation.
CVE-2017-13875: Ian Beer of Google Project Zero
IOAcceleratorFamily
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13844: found by IMF developed by HyungSeok Han (daramg.gift)
of SoftSec, KAIST (softsec.kaist.ac.kr)
IOKit
Available for: macOS High Sierra 10.13.1
Impact: An application may be able to execute arbitrary code with
system privileges
Description: An input validation issue existed in the kernel. This
issue was addressed through improved input validation.
CVE-2017-13848: Alex Plaskett of MWR InfoSecurity
CVE-2017-13858: an anonymous researcher
IOKit
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to execute arbitrary code with
system privileges
Description: Multiple memory corruption issues were addressed through
improved state management.
CVE-2017-13847: Ian Beer of Google Project Zero
Kernel
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13862: Apple
Kernel
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to read restricted memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2017-13833: Brandon Azad
Kernel
Available for: macOS High Sierra 10.13.1
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13876: Ian Beer of Google Project Zero
Kernel
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to read restricted memory
Description: A type confusion issue was addressed with improved
memory handling.
CVE-2017-13855: Jann Horn of Google Project Zero
Kernel
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: A malicious application may be able to execute arbitrary
code with kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13867: Ian Beer of Google Project Zero
Kernel
Available for: macOS High Sierra 10.13.1
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2017-13865: Ian Beer of Google Project Zero
Kernel
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2017-13868: Brandon Azad
CVE-2017-13869: Jann Horn of Google Project Zero
Mail
Available for: macOS High Sierra 10.13.1
Impact: A S/MIME encrypted email may be inadvertently sent
unencrypted if the receiver's S/MIME certificate is not installed
Description: An inconsistent user interface issue was addressed with
improved state management.
CVE-2017-13871: an anonymous researcher
Mail Drafts
Available for: macOS High Sierra 10.13.1
Impact: An attacker with a privileged network position may be able to
intercept mail
Description: An encryption issue existed with S/MIME credetials. The
issue was addressed with additional checks and user control.
CVE-2017-13860: Michael Weishaar of INNEO Solutions GmbH
OpenSSL
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to read restricted memory
Description: An out-of-bounds read issue existed in
X.509 IPAddressFamily parsing. This issue was addressed with improved
bounds checking.
CVE-2017-3735: found by OSS-Fuzz
Screen Sharing Server
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6
Impact: A user with screen sharing access may be able to access any
file readable by root
Description: A permissions issue existed in the handling of screen
sharing sessions. This issue was addressed with improved permissions
handling.
CVE-2017-13826: Trevor Jacques of Toronto
Installation note:
macOS High Sierra 10.13.2, Security Update 2017-002 Sierra, and
Security Update 2017-005 El Capitan may be obtained from the
Mac App Store or Apple's Software Downloads web site:
https://support.apple.com/downloads/
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
iQJdBAEBCgBHFiEEcuX4rtoRe4X62yWlg6PvjDRstEYFAlooN9kpHHByb2R1Y3Qt
c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQg6PvjDRstEbvlg/7
Bub6HL7Bv+9taMMz+3Rl2exjVIBv3fUflhpLh1524wFe6UjUyy4Z3X0t/LKogGwb
GkHmcvDTK+85yLJeF0XQLHzzeITPrAiQ06FSnpzq6GjDEgczgbyJtw6aT4iagDgK
NYfWnmU1XDjpx35kjEyyZblIxDHsvMJRelMdjx4w6In3Pgi+DG+ndYbK5hoaImOX
Ywaoc2xzGUXpnJU6Y5tkIbVBF4P4tZQcJJt6cfhTOcR9+ut87HQqc9mo1UGMUqAv
z0kYZ4MtGRM4uDiVynkKxwj+NNtSVxwvf1mN2Jb7ApFt0lAfmS8L8xzI15NlbJxJ
oSuIvVi3pAhOkO7etaC/CLOxw+wRGaRbaf1i4VmaLI6HW2H2/vWiL1KDhHFIIfVq
xBGday+yWkaS9o8B85QZy2GHxEFYxzMvArtzK3tBj2kZCuEcJis60CanwZOSbcsp
4IlEKVGabMNwGwOVX22UwrLCtMzsqSVZpYyKy/m7n6DXnpspuWTohDmc68zq/4nj
5LgGTFz8IUaT1ujQZq9g4siVeXzu0bsAgttauRlrWilUsDtpsv5s+dkGlXPFxbDf
BuvNgqGSg/xz0QRGmJ7UA3g3L7fTvWhOzXnBOh7c45OpYT54tqGIEi6Bk72NyPz+
ioQ7LBPJE6RCSy5XZJ6x8YwSYp+kO8BBPaYsxSoxXCs=
=2VBd
-----END PGP SIGNATURE-----
| VAR-201712-0277 | CVE-2017-13847 | Apple iOS and macOS of IOKit Component vulnerable to arbitrary code execution in privileged context |
CVSS V2: 9.3 CVSS V3: 7.8 Severity: HIGH |
An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. The issue involves the "IOKit" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app. Apple iOS is prone to multiple security vulnerabilities.
Attackers can exploit these issues to bypass security restrictions, execute arbitrary code and perform unauthorized action; this may aid in launching further attacks.
Versions prior to iOS 11.2 are vulnerable. IOTimeSyncClockManagerUserClient provides the userspace interface for the IOTimeSyncClockManager IOService. IOTimeSyncClockManagerUserClient overrides the IOUserClient::clientClose method but it treats it like a destructor. IOUserClient::clientClose is not a destructor and plays no role in the lifetime management of an IOKit object. It is perfectly possible to call ::clientClose (via io_service_close) in one thread and call an external method in another thread at the same time. IOTimeSyncClockManagerUserClient::clientClose drops references on a bunch of OSArrays causing them to be free'd, it also destroys the locks which are supposed to protect access to those arrays. This leads directly to multiple UaFs if you also call external methods which manipulate those arrays in other threads. For an exploit some care would be required to ensure correct interleaving such that the OSArray was destroyed and then used *before* the lock which is supposed to be protecting the array is also...
CVE-2017-7156: an anonymous researcher
CVE-2017-7157: an anonymous researcher
CVE-2017-13856: Jeonghoon Shin
CVE-2017-13870: an anonymous researcher
CVE-2017-13866: an anonymous researcher
Entry added December 13, 2017
Wi-Fi
Available for: iPhone 6s, iPhone 6s Plus, iPhone 6, iPhone 6 Plus,
iPhone SE, iPhone 5s, 12.9-inch iPad Pro 1st generation, iPad Air 2,
iPad Air, iPad 5th generation, iPad mini 4, iPad mini 3, iPad mini 2,
and iPod touch 6th generation
Released for iPhone 7 and later and iPad Pro 9.7-inch (early 2016)
and later in iOS 11.1.
Impact: An attacker in Wi-Fi range may force nonce reuse in WPA
multicast/GTK clients (Key Reinstallation Attacks - KRACK)
Description: A logic issue existed in the handling of state
transitions.
CVE-2017-13080: Mathy Vanhoef of the imec-DistriNet group at KU
Leuven
Installation note:
This update is available through iTunes and Software Update on your
iOS device, and will not appear in your computer's Software Update
application, or in the Apple Downloads site. Make sure you have an
Internet connection and have installed the latest version of iTunes
from https://www.apple.com/itunes/
iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is
presented to the user when the iOS device is docked. We recommend
applying the update immediately if possible. Selecting Don't Install
will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the
day that iTunes or the device checks for updates. You may manually
obtain the update via the Check for Updates button within iTunes, or
the Software Update on your device.
To check that the iPhone, iPod touch, or iPad has been updated:
* Navigate to Settings
* Select General
* Select About. The version after applying this update
will be "11.2". -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
APPLE-SA-2017-12-6-1 macOS High Sierra 10.13.2, Security Update
2017-002 Sierra, and Security Update 2017-005 El Capitan
macOS High Sierra 10.13.2, Security Update 2017-002 Sierra, and
Security Update 2017-005 El Capitan are now available and address
the following:
apache
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: Processing a maliciously crafted Apache configuration
directive may result in the disclosure of process memory
Description: Multiple issues were addressed by updating to
version 2.4.28.
CVE-2017-9798
curl
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: Malicious FTP servers may be able to cause the client to read
out-of-bounds memory
Description: An out-of-bounds read issue existed in the FTP PWD
response parsing. This issue was addressed with improved bounds
checking.
CVE-2017-1000254: Max Dymond
Directory Utility
Available for: macOS High Sierra 10.13 and macOS High Sierra 10.13.1
Not impacted: macOS Sierra 10.12.6 and earlier
Impact: An attacker may be able to bypass administrator
authentication without supplying the administrator's password
Description: A logic error existed in the validation of credentials.
This was addressed with improved credential validation.
CVE-2017-13883: an anonymous researcher
Intel Graphics Driver
Available for: macOS High Sierra 10.13.1
Impact: A local user may be able to cause unexpected system
termination or read kernel memory
Description: An out-of-bounds read issue existed that led to the
disclosure of kernel memory. This was addressed through improved
input validation.
CVE-2017-13878: Ian Beer of Google Project Zero
Intel Graphics Driver
Available for: macOS High Sierra 10.13.1
Impact: An application may be able to execute arbitrary code with
system privileges
Description: An out-of-bounds read was addressed through improved
bounds checking.
CVE-2017-13875: Ian Beer of Google Project Zero
IOAcceleratorFamily
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13844: found by IMF developed by HyungSeok Han (daramg.gift)
of SoftSec, KAIST (softsec.kaist.ac.kr)
IOKit
Available for: macOS High Sierra 10.13.1
Impact: An application may be able to execute arbitrary code with
system privileges
Description: An input validation issue existed in the kernel. This
issue was addressed through improved input validation.
CVE-2017-13848: Alex Plaskett of MWR InfoSecurity
CVE-2017-13858: an anonymous researcher
IOKit
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to execute arbitrary code with
system privileges
Description: Multiple memory corruption issues were addressed through
improved state management.
CVE-2017-13847: Ian Beer of Google Project Zero
Kernel
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13862: Apple
Kernel
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to read restricted memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2017-13876: Ian Beer of Google Project Zero
Kernel
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to read restricted memory
Description: A type confusion issue was addressed with improved
memory handling.
CVE-2017-13855: Jann Horn of Google Project Zero
Kernel
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: A malicious application may be able to execute arbitrary
code with kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13867: Ian Beer of Google Project Zero
Kernel
Available for: macOS High Sierra 10.13.1
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2017-13865: Ian Beer of Google Project Zero
Kernel
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2017-13868: Brandon Azad
CVE-2017-13869: Jann Horn of Google Project Zero
Mail
Available for: macOS High Sierra 10.13.1
Impact: A S/MIME encrypted email may be inadvertently sent
unencrypted if the receiver's S/MIME certificate is not installed
Description: An inconsistent user interface issue was addressed with
improved state management.
CVE-2017-13871: an anonymous researcher
Mail Drafts
Available for: macOS High Sierra 10.13.1
Impact: An attacker with a privileged network position may be able to
intercept mail
Description: An encryption issue existed with S/MIME credetials. The
issue was addressed with additional checks and user control.
CVE-2017-13860: Michael Weishaar of INNEO Solutions GmbH
OpenSSL
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to read restricted memory
Description: An out-of-bounds read issue existed in
X.509 IPAddressFamily parsing. This issue was addressed with improved
bounds checking.
CVE-2017-3735: found by OSS-Fuzz
Screen Sharing Server
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6
Impact: A user with screen sharing access may be able to access any
file readable by root
Description: A permissions issue existed in the handling of screen
sharing sessions. This issue was addressed with improved permissions
handling.
CVE-2017-13826: Trevor Jacques of Toronto
Installation note:
macOS High Sierra 10.13.2, Security Update 2017-002 Sierra, and
Security Update 2017-005 El Capitan may be obtained from the
Mac App Store or Apple's Software Downloads web site:
https://support.apple.com/downloads/
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
iQJdBAEBCgBHFiEEcuX4rtoRe4X62yWlg6PvjDRstEYFAlooN9kpHHByb2R1Y3Qt
c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQg6PvjDRstEbvlg/7
Bub6HL7Bv+9taMMz+3Rl2exjVIBv3fUflhpLh1524wFe6UjUyy4Z3X0t/LKogGwb
GkHmcvDTK+85yLJeF0XQLHzzeITPrAiQ06FSnpzq6GjDEgczgbyJtw6aT4iagDgK
NYfWnmU1XDjpx35kjEyyZblIxDHsvMJRelMdjx4w6In3Pgi+DG+ndYbK5hoaImOX
Ywaoc2xzGUXpnJU6Y5tkIbVBF4P4tZQcJJt6cfhTOcR9+ut87HQqc9mo1UGMUqAv
z0kYZ4MtGRM4uDiVynkKxwj+NNtSVxwvf1mN2Jb7ApFt0lAfmS8L8xzI15NlbJxJ
oSuIvVi3pAhOkO7etaC/CLOxw+wRGaRbaf1i4VmaLI6HW2H2/vWiL1KDhHFIIfVq
xBGday+yWkaS9o8B85QZy2GHxEFYxzMvArtzK3tBj2kZCuEcJis60CanwZOSbcsp
4IlEKVGabMNwGwOVX22UwrLCtMzsqSVZpYyKy/m7n6DXnpspuWTohDmc68zq/4nj
5LgGTFz8IUaT1ujQZq9g4siVeXzu0bsAgttauRlrWilUsDtpsv5s+dkGlXPFxbDf
BuvNgqGSg/xz0QRGmJ7UA3g3L7fTvWhOzXnBOh7c45OpYT54tqGIEi6Bk72NyPz+
ioQ7LBPJE6RCSy5XZJ6x8YwSYp+kO8BBPaYsxSoxXCs=
=2VBd
-----END PGP SIGNATURE-----
| VAR-201712-0269 | CVE-2017-13871 | Apple macOS of Mail Vulnerability in components to read e-mail content in plain text |
CVSS V2: 5.0 CVSS V3: 7.5 Severity: HIGH |
An issue was discovered in certain Apple products. macOS before 10.13.2 is affected. The issue involves the "Mail" component. It allows remote attackers to read cleartext e-mail content (for which S/MIME encryption was intended) by leveraging the lack of installation of an S/MIME certificate by the recipient. Apple macOS is prone to multiple security vulnerabilities.
Attackers can exploit these issues to bypass security restrictions, execute arbitrary code and perform unauthorized action; this may aid in launching further attacks. Apple macOS High Sierra is a set of dedicated operating systems developed by Apple (Apple) for Mac computers. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
APPLE-SA-2017-12-6-1 macOS High Sierra 10.13.2, Security Update
2017-002 Sierra, and Security Update 2017-005 El Capitan
macOS High Sierra 10.13.2, Security Update 2017-002 Sierra, and
Security Update 2017-005 El Capitan are now available and address
the following:
apache
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: Processing a maliciously crafted Apache configuration
directive may result in the disclosure of process memory
Description: Multiple issues were addressed by updating to
version 2.4.28.
CVE-2017-9798
curl
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: Malicious FTP servers may be able to cause the client to read
out-of-bounds memory
Description: An out-of-bounds read issue existed in the FTP PWD
response parsing. This issue was addressed with improved bounds
checking.
CVE-2017-1000254: Max Dymond
Directory Utility
Available for: macOS High Sierra 10.13 and macOS High Sierra 10.13.1
Not impacted: macOS Sierra 10.12.6 and earlier
Impact: An attacker may be able to bypass administrator
authentication without supplying the administrator's password
Description: A logic error existed in the validation of credentials.
This was addressed with improved credential validation.
CVE-2017-13872
Intel Graphics Driver
Available for: macOS High Sierra 10.13.1
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13883: an anonymous researcher
Intel Graphics Driver
Available for: macOS High Sierra 10.13.1
Impact: A local user may be able to cause unexpected system
termination or read kernel memory
Description: An out-of-bounds read issue existed that led to the
disclosure of kernel memory. This was addressed through improved
input validation.
CVE-2017-13878: Ian Beer of Google Project Zero
Intel Graphics Driver
Available for: macOS High Sierra 10.13.1
Impact: An application may be able to execute arbitrary code with
system privileges
Description: An out-of-bounds read was addressed through improved
bounds checking.
CVE-2017-13875: Ian Beer of Google Project Zero
IOAcceleratorFamily
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13844: found by IMF developed by HyungSeok Han (daramg.gift)
of SoftSec, KAIST (softsec.kaist.ac.kr)
IOKit
Available for: macOS High Sierra 10.13.1
Impact: An application may be able to execute arbitrary code with
system privileges
Description: An input validation issue existed in the kernel. This
issue was addressed through improved input validation.
CVE-2017-13848: Alex Plaskett of MWR InfoSecurity
CVE-2017-13858: an anonymous researcher
IOKit
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to execute arbitrary code with
system privileges
Description: Multiple memory corruption issues were addressed through
improved state management.
CVE-2017-13847: Ian Beer of Google Project Zero
Kernel
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13862: Apple
Kernel
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to read restricted memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2017-13833: Brandon Azad
Kernel
Available for: macOS High Sierra 10.13.1
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13876: Ian Beer of Google Project Zero
Kernel
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to read restricted memory
Description: A type confusion issue was addressed with improved
memory handling.
CVE-2017-13855: Jann Horn of Google Project Zero
Kernel
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: A malicious application may be able to execute arbitrary
code with kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13867: Ian Beer of Google Project Zero
Kernel
Available for: macOS High Sierra 10.13.1
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2017-13865: Ian Beer of Google Project Zero
Kernel
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2017-13868: Brandon Azad
CVE-2017-13869: Jann Horn of Google Project Zero
Mail
Available for: macOS High Sierra 10.13.1
Impact: A S/MIME encrypted email may be inadvertently sent
unencrypted if the receiver's S/MIME certificate is not installed
Description: An inconsistent user interface issue was addressed with
improved state management.
CVE-2017-13871: an anonymous researcher
Mail Drafts
Available for: macOS High Sierra 10.13.1
Impact: An attacker with a privileged network position may be able to
intercept mail
Description: An encryption issue existed with S/MIME credetials. The
issue was addressed with additional checks and user control.
CVE-2017-13860: Michael Weishaar of INNEO Solutions GmbH
OpenSSL
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to read restricted memory
Description: An out-of-bounds read issue existed in
X.509 IPAddressFamily parsing. This issue was addressed with improved
bounds checking.
CVE-2017-3735: found by OSS-Fuzz
Screen Sharing Server
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6
Impact: A user with screen sharing access may be able to access any
file readable by root
Description: A permissions issue existed in the handling of screen
sharing sessions. This issue was addressed with improved permissions
handling.
CVE-2017-13826: Trevor Jacques of Toronto
Installation note:
macOS High Sierra 10.13.2, Security Update 2017-002 Sierra, and
Security Update 2017-005 El Capitan may be obtained from the
Mac App Store or Apple's Software Downloads web site:
https://support.apple.com/downloads/
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
iQJdBAEBCgBHFiEEcuX4rtoRe4X62yWlg6PvjDRstEYFAlooN9kpHHByb2R1Y3Qt
c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQg6PvjDRstEbvlg/7
Bub6HL7Bv+9taMMz+3Rl2exjVIBv3fUflhpLh1524wFe6UjUyy4Z3X0t/LKogGwb
GkHmcvDTK+85yLJeF0XQLHzzeITPrAiQ06FSnpzq6GjDEgczgbyJtw6aT4iagDgK
NYfWnmU1XDjpx35kjEyyZblIxDHsvMJRelMdjx4w6In3Pgi+DG+ndYbK5hoaImOX
Ywaoc2xzGUXpnJU6Y5tkIbVBF4P4tZQcJJt6cfhTOcR9+ut87HQqc9mo1UGMUqAv
z0kYZ4MtGRM4uDiVynkKxwj+NNtSVxwvf1mN2Jb7ApFt0lAfmS8L8xzI15NlbJxJ
oSuIvVi3pAhOkO7etaC/CLOxw+wRGaRbaf1i4VmaLI6HW2H2/vWiL1KDhHFIIfVq
xBGday+yWkaS9o8B85QZy2GHxEFYxzMvArtzK3tBj2kZCuEcJis60CanwZOSbcsp
4IlEKVGabMNwGwOVX22UwrLCtMzsqSVZpYyKy/m7n6DXnpspuWTohDmc68zq/4nj
5LgGTFz8IUaT1ujQZq9g4siVeXzu0bsAgttauRlrWilUsDtpsv5s+dkGlXPFxbDf
BuvNgqGSg/xz0QRGmJ7UA3g3L7fTvWhOzXnBOh7c45OpYT54tqGIEi6Bk72NyPz+
ioQ7LBPJE6RCSy5XZJ6x8YwSYp+kO8BBPaYsxSoxXCs=
=2VBd
-----END PGP SIGNATURE-----
| VAR-201712-0270 | CVE-2017-13874 | Apple iOS of Mail Vulnerability bypassing encryption protection mechanism in component |
CVSS V2: 5.0 CVSS V3: 7.5 Severity: HIGH |
An issue was discovered in certain Apple products. iOS before 11.2 is affected. The issue involves the "Mail" component. It might allow remote attackers to bypass an intended encryption protection mechanism by leveraging incorrect S/MIME certificate selection. Apple iOS is prone to multiple security vulnerabilities.
Attackers can exploit these issues to bypass security restrictions, execute arbitrary code and perform unauthorized action; this may aid in launching further attacks.
Versions prior to iOS 11.2 are vulnerable. Apple iOS is an operating system developed by Apple (Apple) for mobile devices. The vulnerability stems from the fact that the program uses the wrong certificate when encrypting. A remote attacker could exploit this vulnerability to obtain sensitive information. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
APPLE-SA-2017-12-13-6 Additional information for
APPLE-SA-2017-12-6-2 iOS 11.2
iOS 11.2 addresses the following:
IOKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: Multiple memory corruption issues were addressed through
improved state management.
CVE-2017-13847: Ian Beer of Google Project Zero
IOMobileFrameBuffer
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privilege
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13879: Apple
IOSurface
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13861: Ian Beer of Google Project Zero
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13862: Apple
CVE-2017-13876: Ian Beer of Google Project Zero
CVE-2017-13867: Ian Beer of Google Project Zero
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2017-13833: Brandon Azad
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A type confusion issue was addressed with improved
memory handling.
CVE-2017-13855: Jann Horn of Google Project Zero
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2017-13865: Ian Beer of Google Project Zero
CVE-2017-13868: Brandon Azad
CVE-2017-13869: Jann Horn of Google Project Zero
Mail
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Incorrect certificate is used for encryption
Description: A S/MIME issue existed in the handling of encrypted
email. This issue was addressed through improved selection of the
encryption certificate.
CVE-2017-13874: an anonymous researcher
Mail Drafts
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An attacker with a privileged network position may be able to
intercept mail
Description: An encryption issue existed with S/MIME credetials. The
issue was addressed with additional checks and user control.
CVE-2017-13860: Michael Weishaar of INNEO Solutions GmbH
Mail Message Framework
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Visiting a malicious website may lead to address bar spoofing
Description: An inconsistent user interface issue was addressed with
improved state management.
CVE-2017-2433: an anonymous researcher, an anonymous researcher, an
anonymous researcher
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: Multiple memory corruption issues were addressed with
improved memory handling.
CVE-2017-7156: an anonymous researcher
CVE-2017-7157: an anonymous researcher
CVE-2017-13856: Jeonghoon Shin
CVE-2017-13870: an anonymous researcher
CVE-2017-13866: an anonymous researcher
Entry added December 13, 2017
Wi-Fi
Available for: iPhone 6s, iPhone 6s Plus, iPhone 6, iPhone 6 Plus,
iPhone SE, iPhone 5s, 12.9-inch iPad Pro 1st generation, iPad Air 2,
iPad Air, iPad 5th generation, iPad mini 4, iPad mini 3, iPad mini 2,
and iPod touch 6th generation
Released for iPhone 7 and later and iPad Pro 9.7-inch (early 2016)
and later in iOS 11.1.
Impact: An attacker in Wi-Fi range may force nonce reuse in WPA
multicast/GTK clients (Key Reinstallation Attacks - KRACK)
Description: A logic issue existed in the handling of state
transitions. This was addressed with improved state management.
CVE-2017-13080: Mathy Vanhoef of the imec-DistriNet group at KU
Leuven
Installation note:
This update is available through iTunes and Software Update on your
iOS device, and will not appear in your computer's Software Update
application, or in the Apple Downloads site. Make sure you have an
Internet connection and have installed the latest version of iTunes
from https://www.apple.com/itunes/
iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is
presented to the user when the iOS device is docked. We recommend
applying the update immediately if possible. Selecting Don't Install
will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the
day that iTunes or the device checks for updates. You may manually
obtain the update via the Check for Updates button within iTunes, or
the Software Update on your device.
To check that the iPhone, iPod touch, or iPad has been updated:
* Navigate to Settings
* Select General
* Select About. The version after applying this update
will be "11.2".
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
iQJdBAEBCgBHFiEEcuX4rtoRe4X62yWlg6PvjDRstEYFAloxpFkpHHByb2R1Y3Qt
c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQg6PvjDRstEZl4BAA
mIM4eryXVEmYPSwJFEm6vobzCLahEng05NHE5Vm8eD94T/ZS1HCnkkWwD9KVQEMT
HvoZsEB+UZSQQ8VtR3zXDnRJTY1ajSC47CT5GPIZUFTpDb6QrprVEtsFqaqtO+G8
B2JpRL6OY4KRFiSQWPgjr0BaxC6oRc9LmgYByJLyQp5dNAlzhuUsGcK/Dd6NWQgH
0GOqHe/xLc4evNsJTfPKPzXTaH0BvBUOhtYJo9pof4xBxRQES4vNcJpR366eBP1z
zSmQwvB9+Hkcol2Cclt+p6pPHLgqFXbd+xDVOEE1aGdlC29cIF46kKu3PGwwMUTA
xSCrVGLWvwnoF5LhHKhhN3D1i35NmJcL1Fq7AF/na2POFrM3uyC8iRBKBwUeRyGG
GZwPwFvRzPVXW8iVVte0qgJ4PYEwbXvh8Ju5F1U7s0g2Fvqw9XIasQeK4Uf/lvsl
c9SsDQaePBbBDrskL77ZQviMW9H1p/o2KHbFNgnpJzqdTwj4eFMdp/3zmRPULFT4
jd8n0TRjI/oB7/5r89jQ+5rp3cX0Nupfq0Fvf5pl6A3t4YYUHHQGjJF6Rbgu2EPy
Pn+9WOt6mHhp/e5D5Z4lLCe2q+WeeWGI425UaJC60VTXy4mwKWDQpwGpSnSDkawE
Ja6XuvBRDwFQSQTbXG7vdIKPEtzHWpHY3YUHipa5XKU=
=ptgx
-----END PGP SIGNATURE-----
| VAR-201803-0207 | CVE-2017-17329 | Huawei ViewPoint 8660 Resource management vulnerability |
CVSS V2: 2.1 CVSS V3: 3.3 Severity: LOW |
Huawei ViewPoint 8660 V100R008C03 have a memory leak vulnerability. The software does not release allocated memory properly when parse XML Schema data. An authenticated attacker could upload a crafted XML file, successful exploit could cause the system service abnormal since run out of memory. Huawei ViewPoint 8660 Contains a resource management vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. HuaweiViewPoint8660 is a multipoint control unit for a conference TV system from China's Huawei company. Mutiple Huawei Products are prone to local denial-of-service vulnerability.
An attacker can exploit this issue to cause a denial-of-service condition
| VAR-201712-0279 | CVE-2017-13855 | plural Apple Vulnerability in the kernel component of the product that bypasses memory read restrictions |
CVSS V2: 4.3 CVSS V3: 5.5 Severity: MEDIUM |
An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. tvOS before 11.2 is affected. watchOS before 4.2 is affected. The issue involves the "Kernel" component. It allows attackers to bypass intended memory-read restrictions via a crafted app that triggers type confusion. Apple iOS/WatchOS/tvOS/macOS are prone to multiple security vulnerabilities.
An attacker can exploit these issues to execute arbitrary code with kernel or system privileges, gain sensitive information and or cause a denial-of-service condition. Apple iOS, macOS High Sierra, tvOS, and watchOS are all products of Apple Inc. in the United States. Apple iOS is an operating system developed for mobile devices; macOS High Sierra is a dedicated operating system developed for Mac computers; tvOS is a smart TV operating system. watchOS is a smart watch operating system. The following products and versions are affected: Apple iOS prior to 11.2, macOS High Sierra prior to 10.13.2, tvOS prior to 11.2, watchOS prior to 4.2.
Alternatively, on your watch, select "My Watch > General > About".
CVE-2017-7156: an anonymous researcher
CVE-2017-7157: an anonymous researcher
CVE-2017-13856: Jeonghoon Shin
CVE-2017-13870: an anonymous researcher
CVE-2017-13866: an anonymous researcher
Entry added December 13, 2017
Wi-Fi
Available for: iPhone 6s, iPhone 6s Plus, iPhone 6, iPhone 6 Plus,
iPhone SE, iPhone 5s, 12.9-inch iPad Pro 1st generation, iPad Air 2,
iPad Air, iPad 5th generation, iPad mini 4, iPad mini 3, iPad mini 2,
and iPod touch 6th generation
Released for iPhone 7 and later and iPad Pro 9.7-inch (early 2016)
and later in iOS 11.1.
Impact: An attacker in Wi-Fi range may force nonce reuse in WPA
multicast/GTK clients (Key Reinstallation Attacks - KRACK)
Description: A logic issue existed in the handling of state
transitions.
CVE-2017-13080: Mathy Vanhoef of the imec-DistriNet group at KU
Leuven
Installation note:
This update is available through iTunes and Software Update on your
iOS device, and will not appear in your computer's Software Update
application, or in the Apple Downloads site. Make sure you have an
Internet connection and have installed the latest version of iTunes
from https://www.apple.com/itunes/
iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is
presented to the user when the iOS device is docked. We recommend
applying the update immediately if possible. Selecting Don't Install
will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the
day that iTunes or the device checks for updates. You may manually
obtain the update via the Check for Updates button within iTunes, or
the Software Update on your device.
To check that the iPhone, iPod touch, or iPad has been updated:
* Navigate to Settings
* Select General
* Select About. The version after applying this update
will be "11.2". -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
APPLE-SA-2017-12-6-1 macOS High Sierra 10.13.2, Security Update
2017-002 Sierra, and Security Update 2017-005 El Capitan
macOS High Sierra 10.13.2, Security Update 2017-002 Sierra, and
Security Update 2017-005 El Capitan are now available and address
the following:
apache
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: Processing a maliciously crafted Apache configuration
directive may result in the disclosure of process memory
Description: Multiple issues were addressed by updating to
version 2.4.28.
CVE-2017-9798
curl
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: Malicious FTP servers may be able to cause the client to read
out-of-bounds memory
Description: An out-of-bounds read issue existed in the FTP PWD
response parsing. This issue was addressed with improved bounds
checking.
CVE-2017-1000254: Max Dymond
Directory Utility
Available for: macOS High Sierra 10.13 and macOS High Sierra 10.13.1
Not impacted: macOS Sierra 10.12.6 and earlier
Impact: An attacker may be able to bypass administrator
authentication without supplying the administrator's password
Description: A logic error existed in the validation of credentials.
This was addressed with improved credential validation.
CVE-2017-13872
Intel Graphics Driver
Available for: macOS High Sierra 10.13.1
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13883: an anonymous researcher
Intel Graphics Driver
Available for: macOS High Sierra 10.13.1
Impact: A local user may be able to cause unexpected system
termination or read kernel memory
Description: An out-of-bounds read issue existed that led to the
disclosure of kernel memory. This was addressed through improved
input validation.
CVE-2017-13878: Ian Beer of Google Project Zero
Intel Graphics Driver
Available for: macOS High Sierra 10.13.1
Impact: An application may be able to execute arbitrary code with
system privileges
Description: An out-of-bounds read was addressed through improved
bounds checking.
CVE-2017-13875: Ian Beer of Google Project Zero
IOAcceleratorFamily
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13844: found by IMF developed by HyungSeok Han (daramg.gift)
of SoftSec, KAIST (softsec.kaist.ac.kr)
IOKit
Available for: macOS High Sierra 10.13.1
Impact: An application may be able to execute arbitrary code with
system privileges
Description: An input validation issue existed in the kernel. This
issue was addressed through improved input validation.
CVE-2017-13848: Alex Plaskett of MWR InfoSecurity
CVE-2017-13858: an anonymous researcher
IOKit
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to execute arbitrary code with
system privileges
Description: Multiple memory corruption issues were addressed through
improved state management.
CVE-2017-13847: Ian Beer of Google Project Zero
Kernel
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13862: Apple
Kernel
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to read restricted memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2017-13833: Brandon Azad
Kernel
Available for: macOS High Sierra 10.13.1
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13876: Ian Beer of Google Project Zero
Kernel
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to read restricted memory
Description: A type confusion issue was addressed with improved
memory handling.
CVE-2017-13855: Jann Horn of Google Project Zero
Kernel
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: A malicious application may be able to execute arbitrary
code with kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13867: Ian Beer of Google Project Zero
Kernel
Available for: macOS High Sierra 10.13.1
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2017-13865: Ian Beer of Google Project Zero
Kernel
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2017-13868: Brandon Azad
CVE-2017-13869: Jann Horn of Google Project Zero
Mail
Available for: macOS High Sierra 10.13.1
Impact: A S/MIME encrypted email may be inadvertently sent
unencrypted if the receiver's S/MIME certificate is not installed
Description: An inconsistent user interface issue was addressed with
improved state management.
CVE-2017-13871: an anonymous researcher
Mail Drafts
Available for: macOS High Sierra 10.13.1
Impact: An attacker with a privileged network position may be able to
intercept mail
Description: An encryption issue existed with S/MIME credetials. The
issue was addressed with additional checks and user control.
CVE-2017-13860: Michael Weishaar of INNEO Solutions GmbH
OpenSSL
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to read restricted memory
Description: An out-of-bounds read issue existed in
X.509 IPAddressFamily parsing. This issue was addressed with improved
bounds checking.
CVE-2017-3735: found by OSS-Fuzz
Screen Sharing Server
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6
Impact: A user with screen sharing access may be able to access any
file readable by root
Description: A permissions issue existed in the handling of screen
sharing sessions. This issue was addressed with improved permissions
handling.
CVE-2017-13826: Trevor Jacques of Toronto
Installation note:
macOS High Sierra 10.13.2, Security Update 2017-002 Sierra, and
Security Update 2017-005 El Capitan may be obtained from the
Mac App Store or Apple's Software Downloads web site:
https://support.apple.com/downloads/
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
iQJdBAEBCgBHFiEEcuX4rtoRe4X62yWlg6PvjDRstEYFAlooN9kpHHByb2R1Y3Qt
c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQg6PvjDRstEbvlg/7
Bub6HL7Bv+9taMMz+3Rl2exjVIBv3fUflhpLh1524wFe6UjUyy4Z3X0t/LKogGwb
GkHmcvDTK+85yLJeF0XQLHzzeITPrAiQ06FSnpzq6GjDEgczgbyJtw6aT4iagDgK
NYfWnmU1XDjpx35kjEyyZblIxDHsvMJRelMdjx4w6In3Pgi+DG+ndYbK5hoaImOX
Ywaoc2xzGUXpnJU6Y5tkIbVBF4P4tZQcJJt6cfhTOcR9+ut87HQqc9mo1UGMUqAv
z0kYZ4MtGRM4uDiVynkKxwj+NNtSVxwvf1mN2Jb7ApFt0lAfmS8L8xzI15NlbJxJ
oSuIvVi3pAhOkO7etaC/CLOxw+wRGaRbaf1i4VmaLI6HW2H2/vWiL1KDhHFIIfVq
xBGday+yWkaS9o8B85QZy2GHxEFYxzMvArtzK3tBj2kZCuEcJis60CanwZOSbcsp
4IlEKVGabMNwGwOVX22UwrLCtMzsqSVZpYyKy/m7n6DXnpspuWTohDmc68zq/4nj
5LgGTFz8IUaT1ujQZq9g4siVeXzu0bsAgttauRlrWilUsDtpsv5s+dkGlXPFxbDf
BuvNgqGSg/xz0QRGmJ7UA3g3L7fTvWhOzXnBOh7c45OpYT54tqGIEi6Bk72NyPz+
ioQ7LBPJE6RCSy5XZJ6x8YwSYp+kO8BBPaYsxSoxXCs=
=2VBd
-----END PGP SIGNATURE-----
| VAR-201712-0272 | CVE-2017-13876 | plural Apple Vulnerability in the kernel component of a product that allows arbitrary code execution in privileged contexts |
CVSS V2: 9.3 CVSS V3: 7.8 Severity: HIGH |
An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. tvOS before 11.2 is affected. watchOS before 4.2 is affected. The issue involves the "Kernel" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app. Apple iOS/WatchOS/tvOS/macOS are prone to multiple security vulnerabilities. Apple iOS, macOS High Sierra, tvOS, and watchOS are all products of Apple Inc. in the United States. Apple iOS is an operating system developed for mobile devices; macOS High Sierra is a dedicated operating system developed for Mac computers; tvOS is a smart TV operating system. watchOS is a smart watch operating system. The following products and versions are affected: Apple iOS prior to 11.2; macOS High Sierra prior to 10.13.2; tvOS prior to 11.2; watchOS prior to 4.2.
Alternatively, on your watch, select "My Watch > General > About".
CVE-2017-7156: an anonymous researcher
CVE-2017-7157: an anonymous researcher
CVE-2017-13856: Jeonghoon Shin
CVE-2017-13870: an anonymous researcher
CVE-2017-13866: an anonymous researcher
Entry added December 13, 2017
Wi-Fi
Available for: iPhone 6s, iPhone 6s Plus, iPhone 6, iPhone 6 Plus,
iPhone SE, iPhone 5s, 12.9-inch iPad Pro 1st generation, iPad Air 2,
iPad Air, iPad 5th generation, iPad mini 4, iPad mini 3, iPad mini 2,
and iPod touch 6th generation
Released for iPhone 7 and later and iPad Pro 9.7-inch (early 2016)
and later in iOS 11.1.
Impact: An attacker in Wi-Fi range may force nonce reuse in WPA
multicast/GTK clients (Key Reinstallation Attacks - KRACK)
Description: A logic issue existed in the handling of state
transitions.
CVE-2017-13080: Mathy Vanhoef of the imec-DistriNet group at KU
Leuven
Installation note:
This update is available through iTunes and Software Update on your
iOS device, and will not appear in your computer's Software Update
application, or in the Apple Downloads site. Make sure you have an
Internet connection and have installed the latest version of iTunes
from https://www.apple.com/itunes/
iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is
presented to the user when the iOS device is docked. We recommend
applying the update immediately if possible. Selecting Don't Install
will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the
day that iTunes or the device checks for updates. You may manually
obtain the update via the Check for Updates button within iTunes, or
the Software Update on your device.
To check that the iPhone, iPod touch, or iPad has been updated:
* Navigate to Settings
* Select General
* Select About. The version after applying this update
will be "11.2". -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
APPLE-SA-2017-12-6-1 macOS High Sierra 10.13.2, Security Update
2017-002 Sierra, and Security Update 2017-005 El Capitan
macOS High Sierra 10.13.2, Security Update 2017-002 Sierra, and
Security Update 2017-005 El Capitan are now available and address
the following:
apache
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: Processing a maliciously crafted Apache configuration
directive may result in the disclosure of process memory
Description: Multiple issues were addressed by updating to
version 2.4.28.
CVE-2017-9798
curl
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: Malicious FTP servers may be able to cause the client to read
out-of-bounds memory
Description: An out-of-bounds read issue existed in the FTP PWD
response parsing. This issue was addressed with improved bounds
checking.
CVE-2017-1000254: Max Dymond
Directory Utility
Available for: macOS High Sierra 10.13 and macOS High Sierra 10.13.1
Not impacted: macOS Sierra 10.12.6 and earlier
Impact: An attacker may be able to bypass administrator
authentication without supplying the administrator's password
Description: A logic error existed in the validation of credentials.
This was addressed with improved credential validation.
CVE-2017-13883: an anonymous researcher
Intel Graphics Driver
Available for: macOS High Sierra 10.13.1
Impact: A local user may be able to cause unexpected system
termination or read kernel memory
Description: An out-of-bounds read issue existed that led to the
disclosure of kernel memory. This was addressed through improved
input validation.
CVE-2017-13878: Ian Beer of Google Project Zero
Intel Graphics Driver
Available for: macOS High Sierra 10.13.1
Impact: An application may be able to execute arbitrary code with
system privileges
Description: An out-of-bounds read was addressed through improved
bounds checking.
CVE-2017-13875: Ian Beer of Google Project Zero
IOAcceleratorFamily
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13844: found by IMF developed by HyungSeok Han (daramg.gift)
of SoftSec, KAIST (softsec.kaist.ac.kr)
IOKit
Available for: macOS High Sierra 10.13.1
Impact: An application may be able to execute arbitrary code with
system privileges
Description: An input validation issue existed in the kernel. This
issue was addressed through improved input validation.
CVE-2017-13848: Alex Plaskett of MWR InfoSecurity
CVE-2017-13858: an anonymous researcher
IOKit
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to execute arbitrary code with
system privileges
Description: Multiple memory corruption issues were addressed through
improved state management.
CVE-2017-13847: Ian Beer of Google Project Zero
Kernel
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13862: Apple
Kernel
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to read restricted memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2017-13876: Ian Beer of Google Project Zero
Kernel
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to read restricted memory
Description: A type confusion issue was addressed with improved
memory handling.
CVE-2017-13855: Jann Horn of Google Project Zero
Kernel
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: A malicious application may be able to execute arbitrary
code with kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13867: Ian Beer of Google Project Zero
Kernel
Available for: macOS High Sierra 10.13.1
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2017-13865: Ian Beer of Google Project Zero
Kernel
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2017-13868: Brandon Azad
CVE-2017-13869: Jann Horn of Google Project Zero
Mail
Available for: macOS High Sierra 10.13.1
Impact: A S/MIME encrypted email may be inadvertently sent
unencrypted if the receiver's S/MIME certificate is not installed
Description: An inconsistent user interface issue was addressed with
improved state management.
CVE-2017-13871: an anonymous researcher
Mail Drafts
Available for: macOS High Sierra 10.13.1
Impact: An attacker with a privileged network position may be able to
intercept mail
Description: An encryption issue existed with S/MIME credetials. The
issue was addressed with additional checks and user control.
CVE-2017-13860: Michael Weishaar of INNEO Solutions GmbH
OpenSSL
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to read restricted memory
Description: An out-of-bounds read issue existed in
X.509 IPAddressFamily parsing. This issue was addressed with improved
bounds checking.
CVE-2017-3735: found by OSS-Fuzz
Screen Sharing Server
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6
Impact: A user with screen sharing access may be able to access any
file readable by root
Description: A permissions issue existed in the handling of screen
sharing sessions. This issue was addressed with improved permissions
handling.
CVE-2017-13826: Trevor Jacques of Toronto
Installation note:
macOS High Sierra 10.13.2, Security Update 2017-002 Sierra, and
Security Update 2017-005 El Capitan may be obtained from the
Mac App Store or Apple's Software Downloads web site:
https://support.apple.com/downloads/
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
iQJdBAEBCgBHFiEEcuX4rtoRe4X62yWlg6PvjDRstEYFAlooN9kpHHByb2R1Y3Qt
c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQg6PvjDRstEbvlg/7
Bub6HL7Bv+9taMMz+3Rl2exjVIBv3fUflhpLh1524wFe6UjUyy4Z3X0t/LKogGwb
GkHmcvDTK+85yLJeF0XQLHzzeITPrAiQ06FSnpzq6GjDEgczgbyJtw6aT4iagDgK
NYfWnmU1XDjpx35kjEyyZblIxDHsvMJRelMdjx4w6In3Pgi+DG+ndYbK5hoaImOX
Ywaoc2xzGUXpnJU6Y5tkIbVBF4P4tZQcJJt6cfhTOcR9+ut87HQqc9mo1UGMUqAv
z0kYZ4MtGRM4uDiVynkKxwj+NNtSVxwvf1mN2Jb7ApFt0lAfmS8L8xzI15NlbJxJ
oSuIvVi3pAhOkO7etaC/CLOxw+wRGaRbaf1i4VmaLI6HW2H2/vWiL1KDhHFIIfVq
xBGday+yWkaS9o8B85QZy2GHxEFYxzMvArtzK3tBj2kZCuEcJis60CanwZOSbcsp
4IlEKVGabMNwGwOVX22UwrLCtMzsqSVZpYyKy/m7n6DXnpspuWTohDmc68zq/4nj
5LgGTFz8IUaT1ujQZq9g4siVeXzu0bsAgttauRlrWilUsDtpsv5s+dkGlXPFxbDf
BuvNgqGSg/xz0QRGmJ7UA3g3L7fTvWhOzXnBOh7c45OpYT54tqGIEi6Bk72NyPz+
ioQ7LBPJE6RCSy5XZJ6x8YwSYp+kO8BBPaYsxSoxXCs=
=2VBd
-----END PGP SIGNATURE-----
| VAR-201712-0266 | CVE-2017-13868 | plural Apple Vulnerability in the kernel component of the product that bypasses memory read restrictions |
CVSS V2: 4.3 CVSS V3: 5.5 Severity: MEDIUM |
An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. tvOS before 11.2 is affected. watchOS before 4.2 is affected. The issue involves the "Kernel" component. It allows attackers to bypass intended memory-read restrictions via a crafted app. plural Apple A vulnerability exists in the product kernel component that bypasses memory read restrictions.An attacker could bypass the memory read limit through a crafted application. Apple iOS/WatchOS/tvOS/macOS are prone to multiple security vulnerabilities.
An attacker can exploit these issues to execute arbitrary code with kernel or system privileges, gain sensitive information and or cause a denial-of-service condition. Apple iOS, macOS High Sierra, tvOS, and watchOS are all products of Apple Inc. in the United States. Apple iOS is an operating system developed for mobile devices; macOS High Sierra is a dedicated operating system developed for Mac computers; tvOS is a smart TV operating system. watchOS is a smart watch operating system. The following products and versions are affected: Apple iOS prior to 11.2; macOS High Sierra prior to 10.13.2; tvOS prior to 11.2; watchOS prior to 4.2.
Alternatively, on your watch, select "My Watch > General > About".
CVE-2017-7156: an anonymous researcher
CVE-2017-7157: an anonymous researcher
CVE-2017-13856: Jeonghoon Shin
CVE-2017-13870: an anonymous researcher
CVE-2017-13866: an anonymous researcher
Entry added December 13, 2017
Wi-Fi
Available for: iPhone 6s, iPhone 6s Plus, iPhone 6, iPhone 6 Plus,
iPhone SE, iPhone 5s, 12.9-inch iPad Pro 1st generation, iPad Air 2,
iPad Air, iPad 5th generation, iPad mini 4, iPad mini 3, iPad mini 2,
and iPod touch 6th generation
Released for iPhone 7 and later and iPad Pro 9.7-inch (early 2016)
and later in iOS 11.1.
Impact: An attacker in Wi-Fi range may force nonce reuse in WPA
multicast/GTK clients (Key Reinstallation Attacks - KRACK)
Description: A logic issue existed in the handling of state
transitions.
CVE-2017-13080: Mathy Vanhoef of the imec-DistriNet group at KU
Leuven
Installation note:
This update is available through iTunes and Software Update on your
iOS device, and will not appear in your computer's Software Update
application, or in the Apple Downloads site. Make sure you have an
Internet connection and have installed the latest version of iTunes
from https://www.apple.com/itunes/
iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is
presented to the user when the iOS device is docked. We recommend
applying the update immediately if possible. Selecting Don't Install
will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the
day that iTunes or the device checks for updates. You may manually
obtain the update via the Check for Updates button within iTunes, or
the Software Update on your device.
To check that the iPhone, iPod touch, or iPad has been updated:
* Navigate to Settings
* Select General
* Select About. The version after applying this update
will be "11.2". -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
APPLE-SA-2017-12-6-1 macOS High Sierra 10.13.2, Security Update
2017-002 Sierra, and Security Update 2017-005 El Capitan
macOS High Sierra 10.13.2, Security Update 2017-002 Sierra, and
Security Update 2017-005 El Capitan are now available and address
the following:
apache
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: Processing a maliciously crafted Apache configuration
directive may result in the disclosure of process memory
Description: Multiple issues were addressed by updating to
version 2.4.28.
CVE-2017-9798
curl
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: Malicious FTP servers may be able to cause the client to read
out-of-bounds memory
Description: An out-of-bounds read issue existed in the FTP PWD
response parsing. This issue was addressed with improved bounds
checking.
CVE-2017-1000254: Max Dymond
Directory Utility
Available for: macOS High Sierra 10.13 and macOS High Sierra 10.13.1
Not impacted: macOS Sierra 10.12.6 and earlier
Impact: An attacker may be able to bypass administrator
authentication without supplying the administrator's password
Description: A logic error existed in the validation of credentials.
This was addressed with improved credential validation.
CVE-2017-13872
Intel Graphics Driver
Available for: macOS High Sierra 10.13.1
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13883: an anonymous researcher
Intel Graphics Driver
Available for: macOS High Sierra 10.13.1
Impact: A local user may be able to cause unexpected system
termination or read kernel memory
Description: An out-of-bounds read issue existed that led to the
disclosure of kernel memory. This was addressed through improved
input validation.
CVE-2017-13878: Ian Beer of Google Project Zero
Intel Graphics Driver
Available for: macOS High Sierra 10.13.1
Impact: An application may be able to execute arbitrary code with
system privileges
Description: An out-of-bounds read was addressed through improved
bounds checking.
CVE-2017-13875: Ian Beer of Google Project Zero
IOAcceleratorFamily
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13844: found by IMF developed by HyungSeok Han (daramg.gift)
of SoftSec, KAIST (softsec.kaist.ac.kr)
IOKit
Available for: macOS High Sierra 10.13.1
Impact: An application may be able to execute arbitrary code with
system privileges
Description: An input validation issue existed in the kernel. This
issue was addressed through improved input validation.
CVE-2017-13848: Alex Plaskett of MWR InfoSecurity
CVE-2017-13858: an anonymous researcher
IOKit
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to execute arbitrary code with
system privileges
Description: Multiple memory corruption issues were addressed through
improved state management.
CVE-2017-13847: Ian Beer of Google Project Zero
Kernel
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13862: Apple
Kernel
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to read restricted memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2017-13833: Brandon Azad
Kernel
Available for: macOS High Sierra 10.13.1
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13876: Ian Beer of Google Project Zero
Kernel
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to read restricted memory
Description: A type confusion issue was addressed with improved
memory handling.
CVE-2017-13855: Jann Horn of Google Project Zero
Kernel
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: A malicious application may be able to execute arbitrary
code with kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13867: Ian Beer of Google Project Zero
Kernel
Available for: macOS High Sierra 10.13.1
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2017-13865: Ian Beer of Google Project Zero
Kernel
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2017-13868: Brandon Azad
CVE-2017-13869: Jann Horn of Google Project Zero
Mail
Available for: macOS High Sierra 10.13.1
Impact: A S/MIME encrypted email may be inadvertently sent
unencrypted if the receiver's S/MIME certificate is not installed
Description: An inconsistent user interface issue was addressed with
improved state management.
CVE-2017-13871: an anonymous researcher
Mail Drafts
Available for: macOS High Sierra 10.13.1
Impact: An attacker with a privileged network position may be able to
intercept mail
Description: An encryption issue existed with S/MIME credetials. The
issue was addressed with additional checks and user control.
CVE-2017-13860: Michael Weishaar of INNEO Solutions GmbH
OpenSSL
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to read restricted memory
Description: An out-of-bounds read issue existed in
X.509 IPAddressFamily parsing. This issue was addressed with improved
bounds checking.
CVE-2017-3735: found by OSS-Fuzz
Screen Sharing Server
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6
Impact: A user with screen sharing access may be able to access any
file readable by root
Description: A permissions issue existed in the handling of screen
sharing sessions. This issue was addressed with improved permissions
handling.
CVE-2017-13826: Trevor Jacques of Toronto
Installation note:
macOS High Sierra 10.13.2, Security Update 2017-002 Sierra, and
Security Update 2017-005 El Capitan may be obtained from the
Mac App Store or Apple's Software Downloads web site:
https://support.apple.com/downloads/
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
iQJdBAEBCgBHFiEEcuX4rtoRe4X62yWlg6PvjDRstEYFAlooN9kpHHByb2R1Y3Qt
c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQg6PvjDRstEbvlg/7
Bub6HL7Bv+9taMMz+3Rl2exjVIBv3fUflhpLh1524wFe6UjUyy4Z3X0t/LKogGwb
GkHmcvDTK+85yLJeF0XQLHzzeITPrAiQ06FSnpzq6GjDEgczgbyJtw6aT4iagDgK
NYfWnmU1XDjpx35kjEyyZblIxDHsvMJRelMdjx4w6In3Pgi+DG+ndYbK5hoaImOX
Ywaoc2xzGUXpnJU6Y5tkIbVBF4P4tZQcJJt6cfhTOcR9+ut87HQqc9mo1UGMUqAv
z0kYZ4MtGRM4uDiVynkKxwj+NNtSVxwvf1mN2Jb7ApFt0lAfmS8L8xzI15NlbJxJ
oSuIvVi3pAhOkO7etaC/CLOxw+wRGaRbaf1i4VmaLI6HW2H2/vWiL1KDhHFIIfVq
xBGday+yWkaS9o8B85QZy2GHxEFYxzMvArtzK3tBj2kZCuEcJis60CanwZOSbcsp
4IlEKVGabMNwGwOVX22UwrLCtMzsqSVZpYyKy/m7n6DXnpspuWTohDmc68zq/4nj
5LgGTFz8IUaT1ujQZq9g4siVeXzu0bsAgttauRlrWilUsDtpsv5s+dkGlXPFxbDf
BuvNgqGSg/xz0QRGmJ7UA3g3L7fTvWhOzXnBOh7c45OpYT54tqGIEi6Bk72NyPz+
ioQ7LBPJE6RCSy5XZJ6x8YwSYp+kO8BBPaYsxSoxXCs=
=2VBd
-----END PGP SIGNATURE-----
| VAR-201712-0267 | CVE-2017-13869 | plural Apple Vulnerability in the kernel component of the product that bypasses memory read restrictions |
CVSS V2: 4.3 CVSS V3: 5.5 Severity: MEDIUM |
An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. tvOS before 11.2 is affected. watchOS before 4.2 is affected. The issue involves the "Kernel" component. It allows attackers to bypass intended memory-read restrictions via a crafted app. plural Apple A vulnerability exists in the product kernel component that bypasses memory read restrictions.An attacker could bypass the memory read limit through a crafted application. Apple iOS/WatchOS/tvOS/macOS are prone to multiple security vulnerabilities.
An attacker can exploit these issues to execute arbitrary code with kernel or system privileges, gain sensitive information and or cause a denial-of-service condition. Apple iOS, macOS High Sierra, tvOS, and watchOS are all products of Apple Inc. in the United States. Apple iOS is an operating system developed for mobile devices; macOS High Sierra is a dedicated operating system developed for Mac computers; tvOS is a smart TV operating system. watchOS is a smart watch operating system. The following products and versions are affected: Apple iOS prior to 11.2; macOS High Sierra prior to 10.13.2; tvOS prior to 11.2; watchOS prior to 4.2.
Alternatively, on your watch, select "My Watch > General > About".
CVE-2017-7156: an anonymous researcher
CVE-2017-7157: an anonymous researcher
CVE-2017-13856: Jeonghoon Shin
CVE-2017-13870: an anonymous researcher
CVE-2017-13866: an anonymous researcher
Entry added December 13, 2017
Wi-Fi
Available for: iPhone 6s, iPhone 6s Plus, iPhone 6, iPhone 6 Plus,
iPhone SE, iPhone 5s, 12.9-inch iPad Pro 1st generation, iPad Air 2,
iPad Air, iPad 5th generation, iPad mini 4, iPad mini 3, iPad mini 2,
and iPod touch 6th generation
Released for iPhone 7 and later and iPad Pro 9.7-inch (early 2016)
and later in iOS 11.1.
Impact: An attacker in Wi-Fi range may force nonce reuse in WPA
multicast/GTK clients (Key Reinstallation Attacks - KRACK)
Description: A logic issue existed in the handling of state
transitions.
CVE-2017-13080: Mathy Vanhoef of the imec-DistriNet group at KU
Leuven
Installation note:
This update is available through iTunes and Software Update on your
iOS device, and will not appear in your computer's Software Update
application, or in the Apple Downloads site. Make sure you have an
Internet connection and have installed the latest version of iTunes
from https://www.apple.com/itunes/
iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is
presented to the user when the iOS device is docked. We recommend
applying the update immediately if possible. Selecting Don't Install
will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the
day that iTunes or the device checks for updates. You may manually
obtain the update via the Check for Updates button within iTunes, or
the Software Update on your device.
To check that the iPhone, iPod touch, or iPad has been updated:
* Navigate to Settings
* Select General
* Select About. The version after applying this update
will be "11.2". -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
APPLE-SA-2017-12-6-1 macOS High Sierra 10.13.2, Security Update
2017-002 Sierra, and Security Update 2017-005 El Capitan
macOS High Sierra 10.13.2, Security Update 2017-002 Sierra, and
Security Update 2017-005 El Capitan are now available and address
the following:
apache
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: Processing a maliciously crafted Apache configuration
directive may result in the disclosure of process memory
Description: Multiple issues were addressed by updating to
version 2.4.28.
CVE-2017-9798
curl
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: Malicious FTP servers may be able to cause the client to read
out-of-bounds memory
Description: An out-of-bounds read issue existed in the FTP PWD
response parsing. This issue was addressed with improved bounds
checking.
CVE-2017-1000254: Max Dymond
Directory Utility
Available for: macOS High Sierra 10.13 and macOS High Sierra 10.13.1
Not impacted: macOS Sierra 10.12.6 and earlier
Impact: An attacker may be able to bypass administrator
authentication without supplying the administrator's password
Description: A logic error existed in the validation of credentials.
This was addressed with improved credential validation.
CVE-2017-13872
Intel Graphics Driver
Available for: macOS High Sierra 10.13.1
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13883: an anonymous researcher
Intel Graphics Driver
Available for: macOS High Sierra 10.13.1
Impact: A local user may be able to cause unexpected system
termination or read kernel memory
Description: An out-of-bounds read issue existed that led to the
disclosure of kernel memory. This was addressed through improved
input validation.
CVE-2017-13878: Ian Beer of Google Project Zero
Intel Graphics Driver
Available for: macOS High Sierra 10.13.1
Impact: An application may be able to execute arbitrary code with
system privileges
Description: An out-of-bounds read was addressed through improved
bounds checking.
CVE-2017-13875: Ian Beer of Google Project Zero
IOAcceleratorFamily
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13844: found by IMF developed by HyungSeok Han (daramg.gift)
of SoftSec, KAIST (softsec.kaist.ac.kr)
IOKit
Available for: macOS High Sierra 10.13.1
Impact: An application may be able to execute arbitrary code with
system privileges
Description: An input validation issue existed in the kernel. This
issue was addressed through improved input validation.
CVE-2017-13848: Alex Plaskett of MWR InfoSecurity
CVE-2017-13858: an anonymous researcher
IOKit
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to execute arbitrary code with
system privileges
Description: Multiple memory corruption issues were addressed through
improved state management.
CVE-2017-13847: Ian Beer of Google Project Zero
Kernel
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13862: Apple
Kernel
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to read restricted memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2017-13833: Brandon Azad
Kernel
Available for: macOS High Sierra 10.13.1
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13876: Ian Beer of Google Project Zero
Kernel
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to read restricted memory
Description: A type confusion issue was addressed with improved
memory handling.
CVE-2017-13855: Jann Horn of Google Project Zero
Kernel
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: A malicious application may be able to execute arbitrary
code with kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13867: Ian Beer of Google Project Zero
Kernel
Available for: macOS High Sierra 10.13.1
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2017-13865: Ian Beer of Google Project Zero
Kernel
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2017-13868: Brandon Azad
CVE-2017-13869: Jann Horn of Google Project Zero
Mail
Available for: macOS High Sierra 10.13.1
Impact: A S/MIME encrypted email may be inadvertently sent
unencrypted if the receiver's S/MIME certificate is not installed
Description: An inconsistent user interface issue was addressed with
improved state management.
CVE-2017-13871: an anonymous researcher
Mail Drafts
Available for: macOS High Sierra 10.13.1
Impact: An attacker with a privileged network position may be able to
intercept mail
Description: An encryption issue existed with S/MIME credetials. The
issue was addressed with additional checks and user control.
CVE-2017-13860: Michael Weishaar of INNEO Solutions GmbH
OpenSSL
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to read restricted memory
Description: An out-of-bounds read issue existed in
X.509 IPAddressFamily parsing. This issue was addressed with improved
bounds checking.
CVE-2017-3735: found by OSS-Fuzz
Screen Sharing Server
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6
Impact: A user with screen sharing access may be able to access any
file readable by root
Description: A permissions issue existed in the handling of screen
sharing sessions. This issue was addressed with improved permissions
handling.
CVE-2017-13826: Trevor Jacques of Toronto
Installation note:
macOS High Sierra 10.13.2, Security Update 2017-002 Sierra, and
Security Update 2017-005 El Capitan may be obtained from the
Mac App Store or Apple's Software Downloads web site:
https://support.apple.com/downloads/
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
iQJdBAEBCgBHFiEEcuX4rtoRe4X62yWlg6PvjDRstEYFAlooN9kpHHByb2R1Y3Qt
c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQg6PvjDRstEbvlg/7
Bub6HL7Bv+9taMMz+3Rl2exjVIBv3fUflhpLh1524wFe6UjUyy4Z3X0t/LKogGwb
GkHmcvDTK+85yLJeF0XQLHzzeITPrAiQ06FSnpzq6GjDEgczgbyJtw6aT4iagDgK
NYfWnmU1XDjpx35kjEyyZblIxDHsvMJRelMdjx4w6In3Pgi+DG+ndYbK5hoaImOX
Ywaoc2xzGUXpnJU6Y5tkIbVBF4P4tZQcJJt6cfhTOcR9+ut87HQqc9mo1UGMUqAv
z0kYZ4MtGRM4uDiVynkKxwj+NNtSVxwvf1mN2Jb7ApFt0lAfmS8L8xzI15NlbJxJ
oSuIvVi3pAhOkO7etaC/CLOxw+wRGaRbaf1i4VmaLI6HW2H2/vWiL1KDhHFIIfVq
xBGday+yWkaS9o8B85QZy2GHxEFYxzMvArtzK3tBj2kZCuEcJis60CanwZOSbcsp
4IlEKVGabMNwGwOVX22UwrLCtMzsqSVZpYyKy/m7n6DXnpspuWTohDmc68zq/4nj
5LgGTFz8IUaT1ujQZq9g4siVeXzu0bsAgttauRlrWilUsDtpsv5s+dkGlXPFxbDf
BuvNgqGSg/xz0QRGmJ7UA3g3L7fTvWhOzXnBOh7c45OpYT54tqGIEi6Bk72NyPz+
ioQ7LBPJE6RCSy5XZJ6x8YwSYp+kO8BBPaYsxSoxXCs=
=2VBd
-----END PGP SIGNATURE-----
| VAR-201712-0265 | CVE-2017-13867 | plural Apple Vulnerability in the kernel component of a product that allows arbitrary code execution in privileged contexts |
CVSS V2: 9.3 CVSS V3: 7.8 Severity: HIGH |
An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. tvOS before 11.2 is affected. watchOS before 4.2 is affected. The issue involves the "Kernel" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app. Apple iOS/WatchOS/tvOS/macOS are prone to multiple security vulnerabilities. Apple iOS, macOS High Sierra, tvOS, and watchOS are all products of Apple Inc. in the United States. Apple iOS is an operating system developed for mobile devices; macOS High Sierra is a dedicated operating system developed for Mac computers; tvOS is a smart TV operating system. watchOS is a smart watch operating system. The following products and versions are affected: Apple iOS prior to 11.2; macOS High Sierra prior to 10.13.2; tvOS prior to 11.2; watchOS prior to 4.2.
Alternatively, on your watch, select "My Watch > General > About".
CVE-2017-7156: an anonymous researcher
CVE-2017-7157: an anonymous researcher
CVE-2017-13856: Jeonghoon Shin
CVE-2017-13870: an anonymous researcher
CVE-2017-13866: an anonymous researcher
Entry added December 13, 2017
Wi-Fi
Available for: iPhone 6s, iPhone 6s Plus, iPhone 6, iPhone 6 Plus,
iPhone SE, iPhone 5s, 12.9-inch iPad Pro 1st generation, iPad Air 2,
iPad Air, iPad 5th generation, iPad mini 4, iPad mini 3, iPad mini 2,
and iPod touch 6th generation
Released for iPhone 7 and later and iPad Pro 9.7-inch (early 2016)
and later in iOS 11.1.
Impact: An attacker in Wi-Fi range may force nonce reuse in WPA
multicast/GTK clients (Key Reinstallation Attacks - KRACK)
Description: A logic issue existed in the handling of state
transitions.
CVE-2017-13080: Mathy Vanhoef of the imec-DistriNet group at KU
Leuven
Installation note:
This update is available through iTunes and Software Update on your
iOS device, and will not appear in your computer's Software Update
application, or in the Apple Downloads site. Make sure you have an
Internet connection and have installed the latest version of iTunes
from https://www.apple.com/itunes/
iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is
presented to the user when the iOS device is docked. We recommend
applying the update immediately if possible. Selecting Don't Install
will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the
day that iTunes or the device checks for updates. You may manually
obtain the update via the Check for Updates button within iTunes, or
the Software Update on your device.
To check that the iPhone, iPod touch, or iPad has been updated:
* Navigate to Settings
* Select General
* Select About. The version after applying this update
will be "11.2". -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
APPLE-SA-2017-12-6-1 macOS High Sierra 10.13.2, Security Update
2017-002 Sierra, and Security Update 2017-005 El Capitan
macOS High Sierra 10.13.2, Security Update 2017-002 Sierra, and
Security Update 2017-005 El Capitan are now available and address
the following:
apache
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: Processing a maliciously crafted Apache configuration
directive may result in the disclosure of process memory
Description: Multiple issues were addressed by updating to
version 2.4.28.
CVE-2017-9798
curl
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: Malicious FTP servers may be able to cause the client to read
out-of-bounds memory
Description: An out-of-bounds read issue existed in the FTP PWD
response parsing. This issue was addressed with improved bounds
checking.
CVE-2017-1000254: Max Dymond
Directory Utility
Available for: macOS High Sierra 10.13 and macOS High Sierra 10.13.1
Not impacted: macOS Sierra 10.12.6 and earlier
Impact: An attacker may be able to bypass administrator
authentication without supplying the administrator's password
Description: A logic error existed in the validation of credentials.
This was addressed with improved credential validation.
CVE-2017-13883: an anonymous researcher
Intel Graphics Driver
Available for: macOS High Sierra 10.13.1
Impact: A local user may be able to cause unexpected system
termination or read kernel memory
Description: An out-of-bounds read issue existed that led to the
disclosure of kernel memory. This was addressed through improved
input validation.
CVE-2017-13878: Ian Beer of Google Project Zero
Intel Graphics Driver
Available for: macOS High Sierra 10.13.1
Impact: An application may be able to execute arbitrary code with
system privileges
Description: An out-of-bounds read was addressed through improved
bounds checking.
CVE-2017-13875: Ian Beer of Google Project Zero
IOAcceleratorFamily
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13844: found by IMF developed by HyungSeok Han (daramg.gift)
of SoftSec, KAIST (softsec.kaist.ac.kr)
IOKit
Available for: macOS High Sierra 10.13.1
Impact: An application may be able to execute arbitrary code with
system privileges
Description: An input validation issue existed in the kernel. This
issue was addressed through improved input validation.
CVE-2017-13848: Alex Plaskett of MWR InfoSecurity
CVE-2017-13858: an anonymous researcher
IOKit
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to execute arbitrary code with
system privileges
Description: Multiple memory corruption issues were addressed through
improved state management.
CVE-2017-13847: Ian Beer of Google Project Zero
Kernel
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13862: Apple
Kernel
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to read restricted memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2017-13876: Ian Beer of Google Project Zero
Kernel
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to read restricted memory
Description: A type confusion issue was addressed with improved
memory handling.
CVE-2017-13855: Jann Horn of Google Project Zero
Kernel
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: A malicious application may be able to execute arbitrary
code with kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13867: Ian Beer of Google Project Zero
Kernel
Available for: macOS High Sierra 10.13.1
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2017-13865: Ian Beer of Google Project Zero
Kernel
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2017-13868: Brandon Azad
CVE-2017-13869: Jann Horn of Google Project Zero
Mail
Available for: macOS High Sierra 10.13.1
Impact: A S/MIME encrypted email may be inadvertently sent
unencrypted if the receiver's S/MIME certificate is not installed
Description: An inconsistent user interface issue was addressed with
improved state management.
CVE-2017-13871: an anonymous researcher
Mail Drafts
Available for: macOS High Sierra 10.13.1
Impact: An attacker with a privileged network position may be able to
intercept mail
Description: An encryption issue existed with S/MIME credetials. The
issue was addressed with additional checks and user control.
CVE-2017-13860: Michael Weishaar of INNEO Solutions GmbH
OpenSSL
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to read restricted memory
Description: An out-of-bounds read issue existed in
X.509 IPAddressFamily parsing. This issue was addressed with improved
bounds checking.
CVE-2017-3735: found by OSS-Fuzz
Screen Sharing Server
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6
Impact: A user with screen sharing access may be able to access any
file readable by root
Description: A permissions issue existed in the handling of screen
sharing sessions. This issue was addressed with improved permissions
handling.
CVE-2017-13826: Trevor Jacques of Toronto
Installation note:
macOS High Sierra 10.13.2, Security Update 2017-002 Sierra, and
Security Update 2017-005 El Capitan may be obtained from the
Mac App Store or Apple's Software Downloads web site:
https://support.apple.com/downloads/
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
iQJdBAEBCgBHFiEEcuX4rtoRe4X62yWlg6PvjDRstEYFAlooN9kpHHByb2R1Y3Qt
c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQg6PvjDRstEbvlg/7
Bub6HL7Bv+9taMMz+3Rl2exjVIBv3fUflhpLh1524wFe6UjUyy4Z3X0t/LKogGwb
GkHmcvDTK+85yLJeF0XQLHzzeITPrAiQ06FSnpzq6GjDEgczgbyJtw6aT4iagDgK
NYfWnmU1XDjpx35kjEyyZblIxDHsvMJRelMdjx4w6In3Pgi+DG+ndYbK5hoaImOX
Ywaoc2xzGUXpnJU6Y5tkIbVBF4P4tZQcJJt6cfhTOcR9+ut87HQqc9mo1UGMUqAv
z0kYZ4MtGRM4uDiVynkKxwj+NNtSVxwvf1mN2Jb7ApFt0lAfmS8L8xzI15NlbJxJ
oSuIvVi3pAhOkO7etaC/CLOxw+wRGaRbaf1i4VmaLI6HW2H2/vWiL1KDhHFIIfVq
xBGday+yWkaS9o8B85QZy2GHxEFYxzMvArtzK3tBj2kZCuEcJis60CanwZOSbcsp
4IlEKVGabMNwGwOVX22UwrLCtMzsqSVZpYyKy/m7n6DXnpspuWTohDmc68zq/4nj
5LgGTFz8IUaT1ujQZq9g4siVeXzu0bsAgttauRlrWilUsDtpsv5s+dkGlXPFxbDf
BuvNgqGSg/xz0QRGmJ7UA3g3L7fTvWhOzXnBOh7c45OpYT54tqGIEi6Bk72NyPz+
ioQ7LBPJE6RCSy5XZJ6x8YwSYp+kO8BBPaYsxSoxXCs=
=2VBd
-----END PGP SIGNATURE-----
| VAR-201712-0263 | CVE-2017-13865 | plural Apple Vulnerability in the kernel component of the product that bypasses memory read restrictions |
CVSS V2: 4.3 CVSS V3: 5.5 Severity: MEDIUM |
An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. tvOS before 11.2 is affected. watchOS before 4.2 is affected. The issue involves the "Kernel" component. It allows attackers to bypass intended memory-read restrictions via a crafted app. plural Apple A vulnerability exists in the product kernel component that bypasses memory read restrictions.An attacker could bypass the memory read limit through a crafted application. Apple iOS/WatchOS/tvOS/macOS are prone to multiple security vulnerabilities.
An attacker can exploit these issues to execute arbitrary code with kernel or system privileges, gain sensitive information and or cause a denial-of-service condition. Apple iOS, macOS High Sierra, tvOS, and watchOS are all products of Apple Inc. in the United States. Apple iOS is an operating system developed for mobile devices; macOS High Sierra is a dedicated operating system developed for Mac computers; tvOS is a smart TV operating system. watchOS is a smart watch operating system. The following products and versions are affected: Apple iOS prior to 11.2; macOS High Sierra prior to 10.13.2; tvOS prior to 11.2; watchOS prior to 4.2.
Alternatively, on your watch, select "My Watch > General > About".
CVE-2017-7156: an anonymous researcher
CVE-2017-7157: an anonymous researcher
CVE-2017-13856: Jeonghoon Shin
CVE-2017-13870: an anonymous researcher
CVE-2017-13866: an anonymous researcher
Entry added December 13, 2017
Wi-Fi
Available for: iPhone 6s, iPhone 6s Plus, iPhone 6, iPhone 6 Plus,
iPhone SE, iPhone 5s, 12.9-inch iPad Pro 1st generation, iPad Air 2,
iPad Air, iPad 5th generation, iPad mini 4, iPad mini 3, iPad mini 2,
and iPod touch 6th generation
Released for iPhone 7 and later and iPad Pro 9.7-inch (early 2016)
and later in iOS 11.1.
Impact: An attacker in Wi-Fi range may force nonce reuse in WPA
multicast/GTK clients (Key Reinstallation Attacks - KRACK)
Description: A logic issue existed in the handling of state
transitions.
CVE-2017-13080: Mathy Vanhoef of the imec-DistriNet group at KU
Leuven
Installation note:
This update is available through iTunes and Software Update on your
iOS device, and will not appear in your computer's Software Update
application, or in the Apple Downloads site. Make sure you have an
Internet connection and have installed the latest version of iTunes
from https://www.apple.com/itunes/
iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is
presented to the user when the iOS device is docked. We recommend
applying the update immediately if possible. Selecting Don't Install
will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the
day that iTunes or the device checks for updates. You may manually
obtain the update via the Check for Updates button within iTunes, or
the Software Update on your device.
To check that the iPhone, iPod touch, or iPad has been updated:
* Navigate to Settings
* Select General
* Select About. The version after applying this update
will be "11.2". -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
APPLE-SA-2017-12-6-1 macOS High Sierra 10.13.2, Security Update
2017-002 Sierra, and Security Update 2017-005 El Capitan
macOS High Sierra 10.13.2, Security Update 2017-002 Sierra, and
Security Update 2017-005 El Capitan are now available and address
the following:
apache
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: Processing a maliciously crafted Apache configuration
directive may result in the disclosure of process memory
Description: Multiple issues were addressed by updating to
version 2.4.28.
CVE-2017-9798
curl
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: Malicious FTP servers may be able to cause the client to read
out-of-bounds memory
Description: An out-of-bounds read issue existed in the FTP PWD
response parsing. This issue was addressed with improved bounds
checking.
CVE-2017-1000254: Max Dymond
Directory Utility
Available for: macOS High Sierra 10.13 and macOS High Sierra 10.13.1
Not impacted: macOS Sierra 10.12.6 and earlier
Impact: An attacker may be able to bypass administrator
authentication without supplying the administrator's password
Description: A logic error existed in the validation of credentials.
This was addressed with improved credential validation.
CVE-2017-13872
Intel Graphics Driver
Available for: macOS High Sierra 10.13.1
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13883: an anonymous researcher
Intel Graphics Driver
Available for: macOS High Sierra 10.13.1
Impact: A local user may be able to cause unexpected system
termination or read kernel memory
Description: An out-of-bounds read issue existed that led to the
disclosure of kernel memory. This was addressed through improved
input validation.
CVE-2017-13878: Ian Beer of Google Project Zero
Intel Graphics Driver
Available for: macOS High Sierra 10.13.1
Impact: An application may be able to execute arbitrary code with
system privileges
Description: An out-of-bounds read was addressed through improved
bounds checking.
CVE-2017-13875: Ian Beer of Google Project Zero
IOAcceleratorFamily
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13844: found by IMF developed by HyungSeok Han (daramg.gift)
of SoftSec, KAIST (softsec.kaist.ac.kr)
IOKit
Available for: macOS High Sierra 10.13.1
Impact: An application may be able to execute arbitrary code with
system privileges
Description: An input validation issue existed in the kernel. This
issue was addressed through improved input validation.
CVE-2017-13848: Alex Plaskett of MWR InfoSecurity
CVE-2017-13858: an anonymous researcher
IOKit
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to execute arbitrary code with
system privileges
Description: Multiple memory corruption issues were addressed through
improved state management.
CVE-2017-13847: Ian Beer of Google Project Zero
Kernel
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13862: Apple
Kernel
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to read restricted memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2017-13833: Brandon Azad
Kernel
Available for: macOS High Sierra 10.13.1
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13876: Ian Beer of Google Project Zero
Kernel
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to read restricted memory
Description: A type confusion issue was addressed with improved
memory handling.
CVE-2017-13855: Jann Horn of Google Project Zero
Kernel
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: A malicious application may be able to execute arbitrary
code with kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13867: Ian Beer of Google Project Zero
Kernel
Available for: macOS High Sierra 10.13.1
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2017-13865: Ian Beer of Google Project Zero
Kernel
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2017-13868: Brandon Azad
CVE-2017-13869: Jann Horn of Google Project Zero
Mail
Available for: macOS High Sierra 10.13.1
Impact: A S/MIME encrypted email may be inadvertently sent
unencrypted if the receiver's S/MIME certificate is not installed
Description: An inconsistent user interface issue was addressed with
improved state management.
CVE-2017-13871: an anonymous researcher
Mail Drafts
Available for: macOS High Sierra 10.13.1
Impact: An attacker with a privileged network position may be able to
intercept mail
Description: An encryption issue existed with S/MIME credetials. The
issue was addressed with additional checks and user control.
CVE-2017-13860: Michael Weishaar of INNEO Solutions GmbH
OpenSSL
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to read restricted memory
Description: An out-of-bounds read issue existed in
X.509 IPAddressFamily parsing. This issue was addressed with improved
bounds checking.
CVE-2017-3735: found by OSS-Fuzz
Screen Sharing Server
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6
Impact: A user with screen sharing access may be able to access any
file readable by root
Description: A permissions issue existed in the handling of screen
sharing sessions. This issue was addressed with improved permissions
handling.
CVE-2017-13826: Trevor Jacques of Toronto
Installation note:
macOS High Sierra 10.13.2, Security Update 2017-002 Sierra, and
Security Update 2017-005 El Capitan may be obtained from the
Mac App Store or Apple's Software Downloads web site:
https://support.apple.com/downloads/
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
iQJdBAEBCgBHFiEEcuX4rtoRe4X62yWlg6PvjDRstEYFAlooN9kpHHByb2R1Y3Qt
c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQg6PvjDRstEbvlg/7
Bub6HL7Bv+9taMMz+3Rl2exjVIBv3fUflhpLh1524wFe6UjUyy4Z3X0t/LKogGwb
GkHmcvDTK+85yLJeF0XQLHzzeITPrAiQ06FSnpzq6GjDEgczgbyJtw6aT4iagDgK
NYfWnmU1XDjpx35kjEyyZblIxDHsvMJRelMdjx4w6In3Pgi+DG+ndYbK5hoaImOX
Ywaoc2xzGUXpnJU6Y5tkIbVBF4P4tZQcJJt6cfhTOcR9+ut87HQqc9mo1UGMUqAv
z0kYZ4MtGRM4uDiVynkKxwj+NNtSVxwvf1mN2Jb7ApFt0lAfmS8L8xzI15NlbJxJ
oSuIvVi3pAhOkO7etaC/CLOxw+wRGaRbaf1i4VmaLI6HW2H2/vWiL1KDhHFIIfVq
xBGday+yWkaS9o8B85QZy2GHxEFYxzMvArtzK3tBj2kZCuEcJis60CanwZOSbcsp
4IlEKVGabMNwGwOVX22UwrLCtMzsqSVZpYyKy/m7n6DXnpspuWTohDmc68zq/4nj
5LgGTFz8IUaT1ujQZq9g4siVeXzu0bsAgttauRlrWilUsDtpsv5s+dkGlXPFxbDf
BuvNgqGSg/xz0QRGmJ7UA3g3L7fTvWhOzXnBOh7c45OpYT54tqGIEi6Bk72NyPz+
ioQ7LBPJE6RCSy5XZJ6x8YwSYp+kO8BBPaYsxSoxXCs=
=2VBd
-----END PGP SIGNATURE-----
| VAR-201712-0261 | CVE-2017-13862 | plural Apple Vulnerability in the kernel component of a product that allows arbitrary code execution in privileged contexts |
CVSS V2: 9.3 CVSS V3: 7.8 Severity: HIGH |
An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. tvOS before 11.2 is affected. watchOS before 4.2 is affected. The issue involves the "Kernel" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app. Apple iOS/WatchOS/tvOS/macOS are prone to multiple security vulnerabilities. Apple iOS, macOS High Sierra, tvOS, and watchOS are all products of Apple Inc. in the United States. Apple iOS is an operating system developed for mobile devices; macOS High Sierra is a dedicated operating system developed for Mac computers; tvOS is a smart TV operating system. watchOS is a smart watch operating system. The following products and versions are affected: Apple iOS prior to 11.2; macOS High Sierra prior to 10.13.2; tvOS prior to 11.2; watchOS prior to 4.2.
Alternatively, on your watch, select "My Watch > General > About".
CVE-2017-7156: an anonymous researcher
CVE-2017-7157: an anonymous researcher
CVE-2017-13856: Jeonghoon Shin
CVE-2017-13870: an anonymous researcher
CVE-2017-13866: an anonymous researcher
Entry added December 13, 2017
Wi-Fi
Available for: iPhone 6s, iPhone 6s Plus, iPhone 6, iPhone 6 Plus,
iPhone SE, iPhone 5s, 12.9-inch iPad Pro 1st generation, iPad Air 2,
iPad Air, iPad 5th generation, iPad mini 4, iPad mini 3, iPad mini 2,
and iPod touch 6th generation
Released for iPhone 7 and later and iPad Pro 9.7-inch (early 2016)
and later in iOS 11.1.
Impact: An attacker in Wi-Fi range may force nonce reuse in WPA
multicast/GTK clients (Key Reinstallation Attacks - KRACK)
Description: A logic issue existed in the handling of state
transitions.
CVE-2017-13080: Mathy Vanhoef of the imec-DistriNet group at KU
Leuven
Installation note:
This update is available through iTunes and Software Update on your
iOS device, and will not appear in your computer's Software Update
application, or in the Apple Downloads site. Make sure you have an
Internet connection and have installed the latest version of iTunes
from https://www.apple.com/itunes/
iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is
presented to the user when the iOS device is docked. We recommend
applying the update immediately if possible. Selecting Don't Install
will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the
day that iTunes or the device checks for updates. You may manually
obtain the update via the Check for Updates button within iTunes, or
the Software Update on your device.
To check that the iPhone, iPod touch, or iPad has been updated:
* Navigate to Settings
* Select General
* Select About. The version after applying this update
will be "11.2". -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
APPLE-SA-2017-12-6-1 macOS High Sierra 10.13.2, Security Update
2017-002 Sierra, and Security Update 2017-005 El Capitan
macOS High Sierra 10.13.2, Security Update 2017-002 Sierra, and
Security Update 2017-005 El Capitan are now available and address
the following:
apache
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: Processing a maliciously crafted Apache configuration
directive may result in the disclosure of process memory
Description: Multiple issues were addressed by updating to
version 2.4.28.
CVE-2017-9798
curl
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: Malicious FTP servers may be able to cause the client to read
out-of-bounds memory
Description: An out-of-bounds read issue existed in the FTP PWD
response parsing. This issue was addressed with improved bounds
checking.
CVE-2017-1000254: Max Dymond
Directory Utility
Available for: macOS High Sierra 10.13 and macOS High Sierra 10.13.1
Not impacted: macOS Sierra 10.12.6 and earlier
Impact: An attacker may be able to bypass administrator
authentication without supplying the administrator's password
Description: A logic error existed in the validation of credentials.
This was addressed with improved credential validation.
CVE-2017-13883: an anonymous researcher
Intel Graphics Driver
Available for: macOS High Sierra 10.13.1
Impact: A local user may be able to cause unexpected system
termination or read kernel memory
Description: An out-of-bounds read issue existed that led to the
disclosure of kernel memory. This was addressed through improved
input validation.
CVE-2017-13878: Ian Beer of Google Project Zero
Intel Graphics Driver
Available for: macOS High Sierra 10.13.1
Impact: An application may be able to execute arbitrary code with
system privileges
Description: An out-of-bounds read was addressed through improved
bounds checking.
CVE-2017-13875: Ian Beer of Google Project Zero
IOAcceleratorFamily
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13844: found by IMF developed by HyungSeok Han (daramg.gift)
of SoftSec, KAIST (softsec.kaist.ac.kr)
IOKit
Available for: macOS High Sierra 10.13.1
Impact: An application may be able to execute arbitrary code with
system privileges
Description: An input validation issue existed in the kernel. This
issue was addressed through improved input validation.
CVE-2017-13848: Alex Plaskett of MWR InfoSecurity
CVE-2017-13858: an anonymous researcher
IOKit
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to execute arbitrary code with
system privileges
Description: Multiple memory corruption issues were addressed through
improved state management.
CVE-2017-13847: Ian Beer of Google Project Zero
Kernel
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13862: Apple
Kernel
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to read restricted memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2017-13876: Ian Beer of Google Project Zero
Kernel
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to read restricted memory
Description: A type confusion issue was addressed with improved
memory handling.
CVE-2017-13855: Jann Horn of Google Project Zero
Kernel
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: A malicious application may be able to execute arbitrary
code with kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2017-13867: Ian Beer of Google Project Zero
Kernel
Available for: macOS High Sierra 10.13.1
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2017-13865: Ian Beer of Google Project Zero
Kernel
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2017-13868: Brandon Azad
CVE-2017-13869: Jann Horn of Google Project Zero
Mail
Available for: macOS High Sierra 10.13.1
Impact: A S/MIME encrypted email may be inadvertently sent
unencrypted if the receiver's S/MIME certificate is not installed
Description: An inconsistent user interface issue was addressed with
improved state management.
CVE-2017-13871: an anonymous researcher
Mail Drafts
Available for: macOS High Sierra 10.13.1
Impact: An attacker with a privileged network position may be able to
intercept mail
Description: An encryption issue existed with S/MIME credetials. The
issue was addressed with additional checks and user control.
CVE-2017-13860: Michael Weishaar of INNEO Solutions GmbH
OpenSSL
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X
El Capitan 10.11.6
Impact: An application may be able to read restricted memory
Description: An out-of-bounds read issue existed in
X.509 IPAddressFamily parsing. This issue was addressed with improved
bounds checking.
CVE-2017-3735: found by OSS-Fuzz
Screen Sharing Server
Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6
Impact: A user with screen sharing access may be able to access any
file readable by root
Description: A permissions issue existed in the handling of screen
sharing sessions. This issue was addressed with improved permissions
handling.
CVE-2017-13826: Trevor Jacques of Toronto
Installation note:
macOS High Sierra 10.13.2, Security Update 2017-002 Sierra, and
Security Update 2017-005 El Capitan may be obtained from the
Mac App Store or Apple's Software Downloads web site:
https://support.apple.com/downloads/
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
iQJdBAEBCgBHFiEEcuX4rtoRe4X62yWlg6PvjDRstEYFAlooN9kpHHByb2R1Y3Qt
c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQg6PvjDRstEbvlg/7
Bub6HL7Bv+9taMMz+3Rl2exjVIBv3fUflhpLh1524wFe6UjUyy4Z3X0t/LKogGwb
GkHmcvDTK+85yLJeF0XQLHzzeITPrAiQ06FSnpzq6GjDEgczgbyJtw6aT4iagDgK
NYfWnmU1XDjpx35kjEyyZblIxDHsvMJRelMdjx4w6In3Pgi+DG+ndYbK5hoaImOX
Ywaoc2xzGUXpnJU6Y5tkIbVBF4P4tZQcJJt6cfhTOcR9+ut87HQqc9mo1UGMUqAv
z0kYZ4MtGRM4uDiVynkKxwj+NNtSVxwvf1mN2Jb7ApFt0lAfmS8L8xzI15NlbJxJ
oSuIvVi3pAhOkO7etaC/CLOxw+wRGaRbaf1i4VmaLI6HW2H2/vWiL1KDhHFIIfVq
xBGday+yWkaS9o8B85QZy2GHxEFYxzMvArtzK3tBj2kZCuEcJis60CanwZOSbcsp
4IlEKVGabMNwGwOVX22UwrLCtMzsqSVZpYyKy/m7n6DXnpspuWTohDmc68zq/4nj
5LgGTFz8IUaT1ujQZq9g4siVeXzu0bsAgttauRlrWilUsDtpsv5s+dkGlXPFxbDf
BuvNgqGSg/xz0QRGmJ7UA3g3L7fTvWhOzXnBOh7c45OpYT54tqGIEi6Bk72NyPz+
ioQ7LBPJE6RCSy5XZJ6x8YwSYp+kO8BBPaYsxSoxXCs=
=2VBd
-----END PGP SIGNATURE-----
| VAR-201802-0527 | CVE-2017-15346 | plural Huawei Vulnerability related to input validation in products |
CVSS V2: 4.3 CVSS V3: 4.7 Severity: MEDIUM |
XML parser in Huawei S12700 V200R005C00,S1700 V200R009C00, V200R010C00,S3700 V100R006C03, V100R006C05,S5700 V200R001C00, V200R002C00, V200R003C00, V200R003C02, V200R005C00, V200R006C00, V200R007C00, V200R008C00, V200R009C00, V200R010C00,S6700 V200R001C00, V200R002C00, V200R003C00, V200R005C00, V200R005C02, V200R008C00, V200R009C00, V200R010C00,S7700 V200R001C00, V200R002C00, V200R003C00, V200R005C00, V200R006C00, V200R007C00, V200R008C00, V200R009C00, V200R010C00,S9700 V200R001C00, V200R002C00, V200R003C00, V200R005C00, V200R006C00, V200R007C00, V200R008C00, V200R009C00, V200R010C00,eCNS210_TD V100R004C10, V100R004C10SPC003, V100R004C10SPC100, V100R004C10SPC101, V100R004C10SPC102, V100R004C10SPC200, V100R004C10SPC221, V100R004C10SPC400 has a DOS vulnerability. An attacker may craft specific XML files to the affected products. Due to not check the specially XML file and to parse this file, successful exploit will result in DOS attacks. plural Huawei The product contains an input validation vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. HuaweiS12700 is an enterprise-class switch product from China's Huawei company. XMLparser is one of the XML parsers. The vulnerability stems from the failure of the network system or product to properly validate the input data
| VAR-201712-0829 | CVE-2017-17106 |
Zivif Web Vulnerabilities related to certificate / password management in cameras
Related entries in the VARIoT exploits database: VAR-E-201712-0044 |
CVSS V2: 10.0 CVSS V3: 9.8 Severity: CRITICAL |
Credentials for Zivif PR115-204-P-RS V2.3.4.2103 Webcams can be obtained by an unauthenticated remote attacker using a standard web /cgi-bin/hi3510/param.cgi?cmd=getuser HTTP request. This vulnerability exists because of a lack of authentication checks in requests to CGI pages. Zivif Web The camera contains a vulnerability related to certificate and password management.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. The ZivifPR115-204-P-RS is a network camera device. Attack vector: Remote
Authentication: None
Researcher: Silas Cutler `p1nk` <silas.cutler@blacklistthisdomain.com>
Release date: December 10, 2017
Full Disclosure: 90 days
CVEs: CVE-2017-17105, CVE-2017-17106, and CVE-2017-17107
Vulnerable Device: Zivif PR115-204-P-RS
Version: V2.3.4.2103
Timeline:
1 September 2017: Initial alerting to Zivif
1 September 2017: Zivif contact established.
3 September 2017: Details provided.
7 September 2017: Confirmation of vulnerabilities from Zivif
5 December 2017: Public note on Social Media CVE-2017-17105,
CVE-2017-17106, and CVE-2017-17107 would be included in HackerStrip comic.
10 December 2017: This email
-[Overview]-
Implementation of access controls is Zivif cameras is severely lacking.
This was first identified with the following request (CVE-2017-17106)
http://<Camera Address>/web/cgi-bin/hi3510/param.cgi?cmd=getuser
Cameras respond to this with:
var name0="admin"; var password0="admin"; var authLevel0="255"; var
name1="guest"; var password1="guest"; var authLevel1="3"; var
name2="admin2"; var password2="admin"; var authLevel2="3"; var name3="";
var password3=""; var authLevel3="3"; var name4=""; var password4="";
var authLevel4="3"; var name5=""; var password5=""; var authLevel5="3";
var name6=""; var password6=""; var authLevel6="3"; var name7=""; var
password7=""; var authLevel7="3"; var name8=""; var password8=""; var
authLevel8="0"; var name9=""; var password9=""; var authLevel9="0
Credentials are returned in cleartext to the requester.
In exploring, unauthenticated remote command injection is possible using
(CVE-2017-17105)
http://<Camera
IP>/cgi-bin/iptest.cgi?cmd=iptest.cgi&-time="1504225666237"&-url=$(reboot)
Command results are not returned, however are executed by the system.
One last findings was the /etc/passwd file contains the following
hard-coded entry (CVE-2017-17107):
root:$1$xFoO/s3I$zRQPwLG2yX1biU31a2wxN/:0:0::/root:/bin/sh
The encrypted password is cat1029.
(none) login: root
Password:
Login incorrect
(none) login: root
Password:
Welcome to SONIX.
\u@\h:\W$
Because of the way the file system is structured, changing this password
requires more work then running passwd.
-[Note]-
The hi3510 is shared with a couple other cameras I'm exploring. The
motd saying /Welcome to SONIX/ has lead me to speculate parts of this
firmware may be shared with other cameras.
-Silas
| VAR-201802-0553 | CVE-2017-17101 | Apexis APM-H803-MPC Vulnerability related to authorization, authority, and access control in software |
CVSS V2: 7.5 CVSS V3: 9.8 Severity: CRITICAL |
An issue was discovered in Apexis APM-H803-MPC software, as used with many different models of IP Camera. An unprotected CGI method inside the web application permits an unauthenticated user to bypass the login screen and access the webcam contents including: live video stream, configuration files with all the passwords, system information, and much more. With this vulnerability, anyone can access to a vulnerable webcam with 'super admin' privilege. Apexis APM-H803-MPC The software contains vulnerabilities related to authorization, permissions, and access control.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Apexis APM-H803-MPC is an infrared network camera product of China Fuhong (Apexis) Electronics Company. Apexis APM-H803-MPC with firmware version 1.1.2.69 has a privilege escalation vulnerability
| VAR-201803-1312 | CVE-2017-15323 | plural Huawei Product depletion vulnerability |
CVSS V2: 4.9 CVSS V3: 5.5 Severity: MEDIUM |
Huawei DP300 V500R002C00, NIP6600 V500R001C00, V500R001C20, V500R001C30, Secospace USG6500 V500R001C00, V500R001C20, V500R001C30, TE60 V100R001C01, V100R001C10, V100R003C00, V500R002C00, V600R006C00, TP3106 V100R001C06, V100R002C00, VP9660 V200R001C02, V200R001C30, V500R002C00, V500R002C10, ViewPoint 8660 V100R008C03, ViewPoint 9030 V100R011C02, V100R011C03, eCNS210_TD V100R004C10, eSpace U1981 V200R003C30 have a DoS vulnerability caused by memory exhaustion in some Huawei products. For lacking of adequate input validation, attackers can craft and send some malformed messages to the target device to exhaust the memory of the device and cause a Denial of Service (DoS). plural Huawei The product is vulnerable to resource exhaustion.Service operation interruption (DoS) There is a possibility of being put into a state. Huawei DP300 and other products are products of China Huawei (Huawei). The DP300 is a video conferencing terminal. The eSpace7950 is a smart IP video phone product from China's Huawei company. A denial of service vulnerability exists in several Huawei products due to insufficient program validation of the input. An attacker could exploit the vulnerability to cause a denial of service (out of memory). The following products and versions are affected: Huawei NIP6600 V500R001C00 Version, V500R001C20 Version, V500R001C30 Version; DP300 V500R002C00 Version; Secospace USG6500 V500R001C00 Version, V500R001C20 Version, V500R001C30 Version; TE60 V100R001C01 Version, V100R001C10 Version, V100R003C00 Version, V500R002C00 Version, V600R006C00 Version; TP3106 V100R001C06 Version, V100R002C00 Version; VP9660 V200R001C02 Version, V200R001C30 Version, V500R002C00 Version, V500R002C10 Version; ViewPoint 8660 V100R008C03 Version; ViewPoint 9030 V100R011C02 Version, V100R011C03 Version; eCNS210_TD V100R004C10 Version; eSpace U1981 V200R003C30 Version
| VAR-201802-0552 | CVE-2017-15338 | plural Huawei Product buffer error vulnerability |
CVSS V2: 4.3 CVSS V3: 3.7 Severity: LOW |
The SIP module in Huawei DP300 V500R002C00, IPS Module V100R001C10, V100R001C20, V100R001C30, V500R001C00, V500R001C20, V500R001C30, V500R001C50, NGFW Module V100R001C10, V100R001C20, V100R001C30, V500R001C00, V500R001C20, V500R002C00, V500R002C10, NIP6300 V500R001C00, V500R001C20, V500R001C30, V500R001C50, NIP6600 V500R001C00, V500R001C20, V500R001C30, V500R001C50, NIP6800 V500R001C50, RP200 V500R002C00, V600R006C00, SVN5600 V200R003C00, V200R003C10, SVN5800 V200R003C00, V200R003C10, SVN5800-C V200R003C00, V200R003C10, SeMG9811 V300R001C01, Secospace USG6300 V100R001C10, V100R001C20, V100R001C30, V500R001C00, V500R001C20, V500R001C30, V500R001C50, Secospace USG6500 V100R001C10, V100R001C20, V100R001C30, V500R001C00, V500R001C20, V500R001C30, V500R001C50, Secospace USG6600 V100R001C00, V100R001C20, V100R001C30, V500R001C00, V500R001C20, V500R001C30, V500R001C50, TE30 V100R001C02, V100R001C10, V500R002C00, V600R006C00, TE40 V500R002C00, V600R006C00, TE50 V500R002C00, V600R006C00, TE60 V100R001C01, V100R001C10, V500R002C00, V600R006C00, USG9500 V500R001C00, V500R001C20, V500R001C30, USG9520 V300R001C01, V300R001C20, USG9560 V300R001C01, V300R001C20, USG9580 V300R001C01, V300R001C20, VP9660 V200R001C02, V200R001C30, V500R002C00, V500R002C10, ViewPoint 8660 V100R008C03, ViewPoint 9030 V100R011C02, V100R011C03, eSpace U1981 V100R001C20, V200R003C00, V200R003C20, V200R003C30 has a buffer overflow vulnerability. An attacker would have to find a way to craft specific messages to the affected products. Due to the insufficient validation for SIP messages, successful exploit may cause services abnormal. plural Huawei The product contains a buffer error vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. Huawei DP300 and other products are all products of China Huawei. HuaweiDP300 is a video conferencing terminal device. IPSModule is an intrusion prevention module. SIPbackup is one of the SIP backup modules. The vulnerability is caused by the program failing to fully verify some of the values in the SIP message. An attacker could exploit the vulnerability by tampering with a message sent to the device to cause a service exception. The vulnerability is caused by the program's insufficient verification of some packets. The following products and versions are affected: Huawei DP300 Version; IPS Module V100R001C10 Version, V100R001C20 Version, V100R001C30 Version, V500R001C00 Version, V500R001C20 Version, V500R001C30 Version, V500R001C50 Version; NGFW Module V100R001C10 Version, V100R001C20 Version, V100R001C30 Version, V500R001C00 Version, V500R001C20 Version, V500R002C00 Version, V500R002C10 Version; NIP6300 V500R001C00 Version, V500R001C20 Version, V500R001C30 Version, V500R001C50 Version; NIP6600 V500R001C00 Version, V500R001C20 Version, V500R001C30 Version, V500R001C50 Version; NIP6800 V500R001C50 Version; RP200 V500R002C00 Version, V600R006C00 Version; SVN5600 wait
| VAR-201802-0551 | CVE-2017-15337 | plural Huawei Product buffer error vulnerability |
CVSS V2: 4.3 CVSS V3: 3.7 Severity: LOW |
The SIP module in Huawei DP300 V500R002C00, IPS Module V100R001C10, V100R001C20, V100R001C30, V500R001C00, V500R001C20, V500R001C30, V500R001C50, NGFW Module V100R001C10, V100R001C20, V100R001C30, V500R001C00, V500R001C20, V500R002C00, V500R002C10, NIP6300 V500R001C00, V500R001C20, V500R001C30, V500R001C50, NIP6600 V500R001C00, V500R001C20, V500R001C30, V500R001C50, NIP6800 V500R001C50, RP200 V500R002C00, V600R006C00, SVN5600 V200R003C00, V200R003C10, SVN5800 V200R003C00, V200R003C10, SVN5800-C V200R003C00, V200R003C10, SeMG9811 V300R001C01, Secospace USG6300 V100R001C10, V100R001C20, V100R001C30, V500R001C00, V500R001C20, V500R001C30, V500R001C50, Secospace USG6500 V100R001C10, V100R001C20, V100R001C30, V500R001C00, V500R001C20, V500R001C30, V500R001C50, Secospace USG6600 V100R001C00, V100R001C20, V100R001C30, V500R001C00, V500R001C20, V500R001C30, V500R001C50, TE30 V100R001C02, V100R001C10, V500R002C00, V600R006C00, TE40 V500R002C00, V600R006C00, TE50 V500R002C00, V600R006C00, TE60 V100R001C01, V100R001C10, V500R002C00, V600R006C00, USG9500 V500R001C00, V500R001C20, V500R001C30, USG9520 V300R001C01, V300R001C20, USG9560 V300R001C01, V300R001C20, USG9580 V300R001C01, V300R001C20, VP9660 V200R001C02, V200R001C30, V500R002C00, V500R002C10, ViewPoint 8660 V100R008C03, ViewPoint 9030 V100R011C02, V100R011C03, eSpace U1981 V100R001C20, V200R003C00, V200R003C20, V200R003C30 has a buffer overflow vulnerability. An attacker would have to find a way to craft specific messages to the affected products. Due to the insufficient validation for SIP messages, successful exploit may cause services abnormal. plural Huawei The product contains a buffer error vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. Huawei DP300 and other products are all products of China Huawei. HuaweiDP300 is a video conferencing terminal device. IPSModule is an intrusion prevention module. SIPbackup is one of the SIP backup modules. The vulnerability is caused by the program failing to fully verify some of the values in the SIP message. An attacker could exploit the vulnerability by tampering with a message sent to the device to cause a service exception. The vulnerability is caused by the program's insufficient verification of some packets. The following products and versions are affected: Huawei DP300 Version; IPS Module V100R001C10 Version, V100R001C20 Version, V100R001C30 Version, V500R001C00 Version, V500R001C20 Version, V500R001C30 Version, V500R001C50 Version; NGFW Module V100R001C10 Version, V100R001C20 Version, V100R001C30 Version, V500R001C00 Version, V500R001C20 Version, V500R002C00 Version, V500R002C10 Version; NIP6300 V500R001C00 Version, V500R001C20 Version, V500R001C30 Version, V500R001C50 Version; NIP6600 V500R001C00 Version, V500R001C20 Version, V500R001C30 Version, V500R001C50 Version; NIP6800 V500R001C50 Version; RP200 V500R002C00 Version, V600R006C00 Version; SVN5600 wait