Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nessusTenable700035.PRM
HistoryApr 02, 2017 - 12:00 a.m.

Apple TV < 10.2 Multiple Vulnerabilities

2017-04-0200:00:00
Tenable
www.tenable.com
24
JSON

Versions of Apple TV earlier than 10.2 are affected by multiple vulnerabilities :

  • An unspecified flaw exists related to ‘nghttp2’ and ‘LibreSSL’ that is triggered during the handling of a malicious HTTP/2 server. This may allow an attacker to have multiple unspecified impacts. (CVE-2017-2428)
  • A type confusion flaw exists that is triggered as certain input is not properly validated when parsing specially crafted M4A audio files. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2017-2430)
  • A use-after-free flaw exists in ‘libc++’ that is triggered when demangling C++ applications. This may allow a malicious application to dereference already freed memory and potentially execute arbitrary code. (CVE-2017-2441)
  • A flaw exists as OTR packets are not properly validated. By spoofing the TLS/SSL server via a packet that appears valid, an attacker with the ability to intercept network traffic (e.g. MitM, DNS cache poisoning) can disclose and optionally manipulate transmitted data. (CVE-2017-2448)
  • An overflow condition exists that is triggered as certain input is not properly validated when parsing specially crafted M4A audio files. This may allow a context-dependent attacker to cause a heap-based buffer overflow, potentially allowing execution of arbitrary code. (CVE-2017-2462)
  • An unspecified flaw exists that is triggered as certain input is not properly validated when parsing X.509 certificates. This may allow a context dependent-attacker to corrupt memory and potentially execute arbitrary code.

Additional flaws exist in the following components :

  • Carbon (CVE-2017-2379)
  • Carbon (CVE-2017-2379)
  • CoreGraphics (CVE-2017-2417, CVE-2017-2444)
  • CoreText (CVE-2017-2435, CVE-2017-2450, CVE-2017-2461)
  • FontParser (CVE-2017-2406, CVE-2017-2407, CVE-2017-2439, CVE-2017-2487)
  • ImageIO (CVE-2017-2416, CVE-2017-2432, CVE-2017-2467)
  • Kernel (CVE-2017-2401, CVE-2017-2440, CVE-2017-2456, CVE-2017-2472, CVE-2017-2473, CVE-2017-2474, CVE-2017-2478, CVE-2017-2482, CVE-2017-2483, CVE-2017-2490)
  • Keyboards (CVE-2017-2458)
  • libarchive (CVE-2017-2390)
  • Security (CVE-2017-2451)
  • Webkit (CVE-2017-2367, CVE-2017-2378, CVE-2017-2386, CVE-2017-2394, CVE-2017-2395, CVE-2017-2396, CVE-2017-2405, CVE-2017-2415, CVE-2017-2419, CVE-2017-2424, CVE-2017-2433, CVE-2017-2442, CVE-2017-2445, CVE-2017-2446, CVE-2017-2447, CVE-2017-2454, CVE-2017-2455, CVE-2017-2459, CVE-2017-2460, CVE-2017-2464, CVE-2017-2465, CVE-2017-2466, CVE-2017-2468, CVE-2017-2469, CVE-2017-2470, CVE-2017-2471, CVE-2017-2476, CVE-2017-2481)
Binary data 700035.prm
VendorProductVersionCPE
appleapple_tvcpe:/a:apple:apple_tv

References

Related

nessus 8
apple 10
openvas 4
archlinux 1
ubuntu 1
mageia 1
ubuntucve 22
gentoo 1
prion 44
debiancve 16
cve 46
zdt 16
seebug 15
packetstorm 9
zdi 4
attackerkb 1
nessus
nessus
Apple TV < 10.2 Multiple Vulnerabilities
2017-04-10 00:00:00
Safari < 10.1 Multiple Vulnerabilities
2017-03-31 00:00:00
Ubuntu 16.04 LTS : WebKitGTK+ vulnerabilities (USN-3257-1)
2017-04-11 00:00:00
apple
apple
About the security content of tvOS 10.2 - Apple Support
2017-06-20 10:43:59
About the security content of watchOS 3.2
2017-03-27 00:00:00
About the security content of watchOS 3.2 - Apple Support
2017-04-04 03:34:42
openvas
openvas
Ubuntu: Security Advisory (USN-3257-1)
2017-04-11 00:00:00
Apple Safari Multiple Vulnerabilities (HT207600)
2017-03-31 00:00:00
Mageia: Security Advisory (MGASA-2017-0109)
2022-01-28 00:00:00
archlinux
archlinux
[ASA-201704-9] webkit2gtk: multiple issues
2017-04-28 00:00:00
ubuntu
ubuntu
WebKitGTK+ vulnerabilities
2017-04-10 00:00:00
mageia
mageia
Updated webkit2 packages fix security vulnerability
2017-04-16 09:29:12
ubuntucve
ubuntucve
CVE-2017-2396
2017-04-01 00:00:00
CVE-2017-2405
2017-04-01 00:00:00
CVE-2017-2395
2017-04-01 00:00:00
gentoo
gentoo
WebKitGTK+: Multiple vulnerabilities
2017-06-07 00:00:00
prion
prion
Memory corruption
2017-04-02 01:59:00
Out-of-bounds
2017-04-02 01:59:00
Memory corruption
2017-04-02 01:59:00
debiancve
debiancve
CVE-2017-2396
2017-04-02 01:59:00
CVE-2017-2405
2017-04-02 01:59:00
CVE-2017-2395
2017-04-02 01:59:00
cve
cve
CVE-2017-2405
2017-04-02 01:59:00
CVE-2017-2474
2017-04-02 01:59:00
CVE-2017-2441
2017-04-02 01:59:00
zdt
zdt
macOS / iOS Kernel 10.12.3 (16D32) - SIOCGIFORDER Socket ioctl Off-by-One Memory Corruption
2017-04-04 00:00:00
macOS / iOS Kernel 10.12.3 (16D32) - bpf Heap Overflow Exploit
2017-04-05 00:00:00
macOS / iOS Kernel 10.12.3 (16D32) - Double-Free Due to Bad Locking in fsevents Device Exploit
2017-04-05 00:00:00
seebug
seebug
MacOS/iOS kernel memory corruption due to off-by-one in SIOCGIFORDER socket ioctl (CVE-2017-2474)
2017-04-04 00:00:00
MacOS/iOS kernel double free due to bad locking in fsevents device（CVE-2017-2490）
2017-04-04 00:00:00
Apple Webkit: UXSS by accessing a named property from an unloaded window (CVE-2017-2367)
2017-04-04 00:00:00
packetstorm
packetstorm
WebKit WebCore::toJS Use-After-Free
2017-04-10 00:00:00
Apple Webkit Named Property UXSS
2017-04-09 00:00:00
WebKit Document::adoptNode Use-After-Free
2017-04-09 00:00:00
zdi
zdi
Apple Safari ElementData Use-After-Free Remote Code Execution Vulnerability
2017-03-28 00:00:00
Apple macOS M4A Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
2017-03-28 00:00:00
Apple macOS M4A Parsing Type Confusion Remote Code Execution Vulnerability
2017-03-28 00:00:00
attackerkb
attackerkb
Remote code execution triggered by malformed GIF in ImageIO framework, affecting most iOS/macOS apps
2017-04-02 00:00:00
JSON
Related for 700035.PRM
nessus8apple10openvas4archlinux1ubuntu1mageia1ubuntucve22gentoo1prion44debiancve16cve46zdt16seebug15packetstorm9zdi4attackerkb1