{"id": "VULNERLAB:2078", "bulletinFamily": "exploit", "title": "Apple iOS 10.3 - UI SMS Access Permission Vulnerability", "description": "", "published": "2017-08-14T00:00:00", "modified": "2017-08-14T00:00:00", "cvss": {"score": 2.1, "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"}, "href": "http://www.vulnerability-lab.com/get_content.php?id=2078", "reporter": "Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (http://www.vulnerability-lab.com/show.php?user=Benjamin%20K.M.)", "references": [], "cvelist": ["CVE-2017-7058"], "type": "vulnerlab", "lastseen": "2019-07-10T16:42:10", "edition": 6, "viewCount": 76, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2017-7058"]}], "modified": "2019-07-10T16:42:10", "rev": 2}, "score": {"value": 6.1, "vector": "NONE", "modified": "2019-07-10T16:42:10", "rev": 2}, "vulnersScore": 6.1}, "sourceData": "Document Title:\r\n===============\r\nApple iOS 10.3 - UI SMS Access Permission Vulnerability\r\n\r\n\r\nReferences (Source):\r\n====================\r\nhttps://www.vulnerability-lab.com/get_content.php?id=2078\r\n\r\nApple Security ID: 666589482\r\n\r\nVideo: https://www.vulnerability-lab.com/get_content.php?id=2079\r\n\r\nVulnerability Magazine: https://www.vulnerability-db.com/?q=articles/2017/08/14/apple-ios-v102-v103-sms-reply-access-permission-vulnerability\r\n\r\n\r\nRelease Date:\r\n=============\r\n2017-08-14\r\n\r\n\r\nVulnerability Laboratory ID (VL-ID):\r\n====================================\r\n2078\r\n\r\n\r\nCommon Vulnerability Scoring System:\r\n====================================\r\n4.5\r\n\r\n\r\nVulnerability Class:\r\n====================\r\nAccess Permission Weakness\r\n\r\n\r\nCurrent Estimated Price:\r\n========================\r\n3.000\u20ac - 4.000\u20ac\r\n\r\n\r\nProduct & Service Introduction:\r\n===============================\r\niOS (previously iPhone OS) is a mobile operating system developed and distributed by Apple Inc. Originally \r\nreleased in 2007 for the iPhone and iPod Touch, it has been extended to support other Apple devices such \r\nas the iPad and Apple TV. Unlike Microsoft`s Windows Phone (Windows CE) and Google`s Android, Apple does \r\nnot license iOS for installation on non-Apple hardware. As of September 12, 2012, Apple`s App Store contained \r\nmore than 700,000 iOS applications, which have collectively been downloaded more than 30 billion times.\r\n\r\n( Copy of the Homepage: http://en.wikipedia.org/wiki/IOS )\r\n\r\n\r\nAbstract Advisory Information:\r\n==============================\r\nThe vulnerability laboratory core research team discovered a local access permission vulnerability in the official Apple iOS v10.3 iPhone 6S.\r\n\r\n\r\nVulnerability Disclosure Timeline:\r\n==================================\r\n2017-06-05: Researcher Notification & Coordination (Benjamin Kunz Mejri - Evolution Security GmbH)\r\n2017-06-06: Vendor Notification (Apple Security Department)\r\n2017-08-14: Public Disclosure (Vulnerability Laboratory)\r\n\r\n\r\nDiscovery Status:\r\n=================\r\nPublished\r\n\r\n\r\nAffected Product(s):\r\n====================\r\nApple\r\nProduct: iOS - (Mobile Operating System) 10.2 & 10.3\r\n\r\n\r\nExploitation Technique:\r\n=======================\r\nLocal\r\n\r\n\r\nSeverity Level:\r\n===============\r\nMedium\r\n\r\n\r\nTechnical Details & Description:\r\n================================\r\nAn access permission vulnerability has been discovered in the official Apple iOS 10.2 & v10.3. The issue allows a local attacker to \r\nbypass the code lock function to \"Answer with Message / Reply with message\" and limited the idevice authentication mechanism. \r\nThe SMS response menu appears on the screen when it has been deactivated physically by the apple idevice user.\r\n\r\nNext to that, the issue leads to a glitch with an access permission issue to the sms function of the phone app in apple iOS 10. \r\nAfter exploitation, the phone stays permanently in a compromised mode were an attacker can send a sms without the activated \r\nsetting in the code lock module. Phone calls stay in the line even if the other side already canceled the call.\r\n\r\nIn a video the researcher we deactivated the settings for sms on active incoming calls. Then we glitched the service with the request. \r\nHowever the sms menu was still available on the display screen and allows the attacker to perform several interactions like using the \r\nwords to get contacts of the users like names and to unauthenticated followup with sms on active incoming calls. The events are tracked \r\nby the apple ios with several reports and unknown errors in the analysis module.\r\n\r\nThe security risk of the access permission vulnerability is estimated as medium with a common vulnerability scoring system count of 4.5. \r\nExploitation of the apple ios access permission vulnerability requires limited physical idevice access and without user interaction.\r\nSuccessful exploitation of the vulnerability results in unauthorized functional access to the sms function or keyboard settings.\r\n\r\n\r\nProof of Concept (PoC):\r\n=======================\r\nThe vulnerability can be exploited by local attackers with restricted physical device access and without user interaction.\r\nFor security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.\r\n\r\nRequirement(s):\r\n[+] Siri activated by default\r\n[+] Deactivated keyboard suggestions or tips\r\n[+] Activate/Deactivate of code lock module with \"Answer with Message / Reply with message\" function\r\n[+] Activated lock to disallow app usage from outside in locked idevice mode (Sperrbildschirm/LockScreen)\r\n\r\n\r\nManual steps to reproduce the vulnerability ...\r\n1. Reset the idevice to default settings\r\n2. Install the newest apple ios 10.2 or 10.3 version\r\n3. Deactivate in the Settings > Keyboard > Suggestions\r\n4. Check that siri is activated by default\r\n5. Activate the lock to disallow app usage from outside in locked idevice mode\r\n6. Activate the \"Answer with Message / Reply with message\" function\r\nNote: After preparing and checking that the idevice is correctly setup we move into the exploitation phase\r\n7. Call your idevice with another phone\r\n8. Click the Message button and choose to answer with a customized message\r\n9. Push the keyboard element and move up to the english or german keyboard\r\nNote: At that point the incoming call can already be canceled\r\n10. Now activate from outside without authentication the Suggestions by a push and hold ahead two seconds the home button to activate via siri api call\r\nNote: Now a glitch occurs and shows a keyboard ahead to the lock screen\r\n11. Cancel the sms and move into the idevice settings by authentication\r\n12. Deactivate the \"Answer with Message / Reply with message\" function in the code lock module\r\n13. Move back outside the idevice and call yourself again with another phone line\r\n14. The sms menu comes ahead to the active incoming call and allows to unauthenticated send sms to the receiver or another mobile\r\n15. In case of using siri again during the incoming accepted call that is accepted a sync issue occurs\r\nNote: The sync issue allows to followup with the call even if the caller has already closed the phone line (unlimited loop - side channel)\r\nNote: On each call the sms menu comes ahead and allows the attacker to directly send sms to anybody or the caller without permission\r\n16. Successful reproduce of the vulnerability!\r\n\r\n\r\nSecurity Video: PoC Demonstration\r\nThe video shows the idevice settings with the newst apple ios v10.3. The bugg is triggered first by showing the function.\r\nAfter that we show the mode of the issue with several smaller video recordings. At the end we show the settings screenshots \r\nof the setup and location glitches. At the end we was able to send sms to any sender calling our mobile phone number and we \r\nwas able to use the function even if deactivated in the code lock settings of ios 10.3.\r\n\r\nURL: https://www.vulnerability-lab.com/get_content.php?id=2079\r\n\r\n\r\nSolution - Fix & Patch:\r\n=======================\r\nThe vulnerability can be resolved by usage of the ios status administration settings to recheck the access permission after the deactivate.\r\n\r\n\r\nSecurity Risk:\r\n==============\r\nThe security risk of the access permission vulnerability in the apple ios 10.2 & 10.3 is estimated as medium (CVSS 4.5).\r\nThe impact of the security problem is similar to the following CVE-2017-7058.\r\n\r\n\r\nCredits & Authors:\r\n==================\r\nVulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (http://www.vulnerability-lab.com/show.php?user=Benjamin%20K.M.)\r\n\r\n\r\nDisclaimer & Information:\r\n=========================\r\nThe information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed or \r\nimplied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable in any \r\ncase of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability Labs or its \r\nsuppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability mainly for incidental\r\nor consequential damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any licenses, policies, deface \r\nwebsites, hack into databases or trade with stolen data. We have no need for criminal activities or membership requests. We do not publish advisories \r\nor vulnerabilities of religious-, militant- and racist- hacker/analyst/researcher groups or individuals. We do not publish trade researcher mails, \r\nphone numbers, conversations or anything else to journalists, investigative authorities or private individuals. \r\n\r\nDomains: www.vulnerability-lab.com\t\t- www.vulnerability-db.com\t\t\t\t\t- www.evolution-sec.com\r\nPrograms: vulnerability-lab.com/submit.php \t- vulnerability-lab.com/list-of-bug-bounty-programs.php \t- vulnerability-lab.com/register.php\r\nFeeds:\t vulnerability-lab.com/rss/rss.php \t- vulnerability-lab.com/rss/rss_upcoming.php \t\t\t- vulnerability-lab.com/rss/rss_news.php\r\nSocial:\t twitter.com/vuln_lab\t\t- facebook.com/VulnerabilityLab \t\t\t\t- youtube.com/user/vulnerability0lab\r\n\r\nAny modified copy or reproduction, including partially usages, of this file, resources or information requires authorization from Vulnerability Laboratory. \r\nPermission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by \r\nVulnerability Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website is trademark \r\nof vulnerability-lab team & the specific authors or managers. To record, list, modify, use or edit our material contact (admin@) to get an ask permission.\r\n\r\n\t\t\t\t Copyright \u00a9 2017 | Vulnerability Laboratory - [Evolution Security GmbH]\u2122\r\n\r\n\r\n\r\n", "scheme": null, "immutableFields": [], "cvss2": {}, "cvss3": {}}

{"cve": [{"id": "CVE-2017-7058", "bulletinFamily": "NVD", "title": "CVE-2017-7058", "description": "An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. The issue involves the \"Notifications\" component. It allows physically proximate attackers to read unintended notifications on the lock screen.", "published": "2017-07-20T16:29:00", "modified": "2017-07-24T14:32:00", "cvss": {"score": 2.1, "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-7058", "reporter": "product-security@apple.com", "references": ["https://support.apple.com/HT207923", "http://www.securityfocus.com/bid/99891", "http://www.securitytracker.com/id/1038950"], "cvelist": ["CVE-2017-7058"], "type": "cve", "lastseen": "2021-04-23T00:08:03", "history": [{"bulletin": {"affectedConfiguration": [], "affectedSoftware": [{"cpeName": "apple:iphone_os", "name": "apple iphone os", "operator": "le", "version": "10.3.2"}], "bulletinFamily": "NVD", "cpe": ["cpe:/o:apple:iphone_os:10.3.2"], "cpe23": ["cpe:2.3:o:apple:iphone_os:10.3.2:*:*:*:*:*:*:*"], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"cpe_match": [{"cpe23Uri": "cpe:2.3:o:apple:iphone_os:10.3.2:*:*:*:*:*:*:*", "versionEndIncluding": "10.3.2", "vulnerable": true}], "operator": "OR"}]}, "cvelist": ["CVE-2017-7058"], "cvss": {"score": 2.1, "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": true, "cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.1, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "LOW", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "NONE", "baseScore": 2.4, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 0.9, "impactScore": 1.4}, "cwe": ["CWE-200"], "description": "An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. The issue involves the \"Notifications\" component. It allows physically proximate attackers to read unintended notifications on the lock screen.", "edition": 6, "enchantments": {"dependencies": {"modified": "2021-02-02T06:36:49", "references": [{"idList": ["VULNERLAB:2078"], "type": "vulnerlab"}, {"idList": ["APPLE:HT207923"], "type": "apple"}], "rev": 2}, "score": {"modified": "2021-02-02T06:36:49", "rev": 2, "value": 2.7, "vector": "NONE"}}, "extraReferences": [{"name": "https://support.apple.com/HT207923", "refsource": "CONFIRM", "tags": ["Vendor Advisory"], "url": "https://support.apple.com/HT207923"}, {"name": "1038950", "refsource": "SECTRACK", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securitytracker.com/id/1038950"}, {"name": "99891", "refsource": "BID", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/99891"}], "hash": "38d6fa5d3957a58c6c0c7f63d5b048a7f2c0f308d6cc4a9142d3db77e774a612", "hashmap": [{"hash": "05f7254d908383643f2e68ed8e1a8b9d", "key": "cvss2"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "immutableFields"}, {"hash": "8b73268c37891c388619c5559e7491c3", "key": "cvelist"}, {"hash": "9845b5f721425441f2f939519f498301", "key": "references"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "b6788807ce06b9de03dd8a38746aaf2b", "key": "title"}, {"hash": "95a6abc31a457da4a776c21728c589ca", "key": "published"}, {"hash": "db946815eb35d0cd3bca0473c80f7a0e", "key": "description"}, {"hash": "15195f7bb8bb2a9ef61adda901b30fc3", "key": "cpe"}, {"hash": "8c29e327ecae9940af88849fdeee038f", "key": "cvss"}, {"hash": "550a8c7b5a2acb9b72d48937e98b7cd7", "key": "modified"}, {"hash": "e979487de1bb76cacffc9e9b46dc3e0f", "key": "href"}, {"hash": "9256dbbdea2fd981661df3d8a369c077", "key": "cvss3"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "23ee77eb05d2b8630175e2074b5e8d36", "key": "cpe23"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "8460494bc5a328b69370a9ef392449dc", "key": "extraReferences"}, {"hash": "e31057521ddab76f8e53dd16ed1d92ce", "key": "cpeConfiguration"}, {"hash": "8ef9046413011f920693be59106af97c", "key": "affectedSoftware"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "b647a850fd42b235dd11ee60cf626f2d", "key": "cwe"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-7058", "id": "CVE-2017-7058", "immutableFields": [], "lastseen": "2021-02-02T06:36:49", "modified": "2017-07-24T14:32:00", "objectVersion": "1.5", "published": "2017-07-20T16:29:00", "references": ["https://support.apple.com/HT207923", "http://www.securityfocus.com/bid/99891", "http://www.securitytracker.com/id/1038950"], "reporter": "cve@mitre.org", "title": "CVE-2017-7058", "type": "cve", "viewCount": 6}, "different_elements": ["reporter", "cpeConfiguration"], "edition": 6, "lastseen": "2021-02-02T06:36:49"}, {"bulletin": {"affectedSoftware": [{"name": "apple iphone_os", "operator": "le", "version": "10.3.2"}], "bulletinFamily": "NVD", "cpe": [], "cpe23": [], "cvelist": ["CVE-2017-7058"], "cvss": {"score": 2.1, "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": true, "cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.1, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "LOW", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "NONE", "baseScore": 2.4, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 0.9, "impactScore": 1.4}, "cwe": ["CWE-200"], "description": "An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. The issue involves the \"Notifications\" component. It allows physically proximate attackers to read unintended notifications on the lock screen.", "edition": 1, "enchantments": {"dependencies": {"modified": "2019-05-29T18:17:09", "references": [{"idList": ["VULNERLAB:2078"], "type": "vulnerlab"}, {"idList": ["APPLE:HT207923"], "type": "apple"}], "rev": 2}, "score": {"modified": "2019-05-29T18:17:09", "rev": 2, "value": 2.7, "vector": "NONE"}}, "hash": "a76e71109bb0897c099dab010bdd59bd54ef916d8ff8ed725c8c0ac439ba8c56", "hashmap": [{"hash": "05f7254d908383643f2e68ed8e1a8b9d", "key": "cvss2"}, {"hash": "8b73268c37891c388619c5559e7491c3", "key": "cvelist"}, {"hash": "9845b5f721425441f2f939519f498301", "key": "references"}, {"hash": "b6788807ce06b9de03dd8a38746aaf2b", "key": "title"}, {"hash": "95a6abc31a457da4a776c21728c589ca", "key": "published"}, {"hash": "db946815eb35d0cd3bca0473c80f7a0e", "key": "description"}, {"hash": "8c29e327ecae9940af88849fdeee038f", "key": "cvss"}, {"hash": "550a8c7b5a2acb9b72d48937e98b7cd7", "key": "modified"}, {"hash": "e979487de1bb76cacffc9e9b46dc3e0f", "key": "href"}, {"hash": "9256dbbdea2fd981661df3d8a369c077", "key": "cvss3"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe23"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "eebdeff64f330eb753c49873a7c39fa7", "key": "affectedSoftware"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "b647a850fd42b235dd11ee60cf626f2d", "key": "cwe"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-7058", "id": "CVE-2017-7058", "lastseen": "2019-05-29T18:17:09", "modified": "2017-07-24T14:32:00", "objectVersion": "1.3", "published": "2017-07-20T16:29:00", "references": ["https://support.apple.com/HT207923", "http://www.securityfocus.com/bid/99891", "http://www.securitytracker.com/id/1038950"], "reporter": "cve@mitre.org", "title": "CVE-2017-7058", "type": "cve", "viewCount": 4}, "differentElements": ["cpe23", "cpe", "affectedSoftware"], "edition": 1, "lastseen": "2019-05-29T18:17:09"}, {"bulletin": {"affectedConfiguration": [], "affectedSoftware": [{"cpeName": "apple:iphone_os", "name": "apple iphone os", "operator": "le", "version": "10.3.2"}], "bulletinFamily": "NVD", "cpe": ["cpe:/o:apple:iphone_os:10.3.2"], "cpe23": ["cpe:2.3:o:apple:iphone_os:10.3.2:*:*:*:*:*:*:*"], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"cpe_match": [{"cpe23Uri": "cpe:2.3:o:apple:iphone_os:10.3.2:*:*:*:*:*:*:*", "versionEndIncluding": "10.3.2", "vulnerable": true}], "operator": "OR"}]}, "cvelist": ["CVE-2017-7058"], "cvss": {"score": 2.1, "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": true, "cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.1, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "LOW", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "NONE", "baseScore": 2.4, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 0.9, "impactScore": 1.4}, "cwe": ["CWE-200"], "description": "An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. The issue involves the \"Notifications\" component. It allows physically proximate attackers to read unintended notifications on the lock screen.", "edition": 5, "enchantments": {"dependencies": {"modified": "2020-12-09T20:13:36", "references": [{"idList": ["VULNERLAB:2078"], "type": "vulnerlab"}, {"idList": ["APPLE:HT207923"], "type": "apple"}], "rev": 2}, "score": {"modified": "2020-12-09T20:13:36", "rev": 2, "value": 2.7, "vector": "NONE"}}, "extraReferences": [], "hash": "56be3c65ecc20bfe3f907ad9b1df31b514319188305e7055d5fcda0943880e86", "hashmap": [{"hash": "05f7254d908383643f2e68ed8e1a8b9d", "key": "cvss2"}, {"hash": "8b73268c37891c388619c5559e7491c3", "key": "cvelist"}, {"hash": "9845b5f721425441f2f939519f498301", "key": "references"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "b6788807ce06b9de03dd8a38746aaf2b", "key": "title"}, {"hash": "95a6abc31a457da4a776c21728c589ca", "key": "published"}, {"hash": "db946815eb35d0cd3bca0473c80f7a0e", "key": "description"}, {"hash": "15195f7bb8bb2a9ef61adda901b30fc3", "key": "cpe"}, {"hash": "8c29e327ecae9940af88849fdeee038f", "key": "cvss"}, {"hash": "550a8c7b5a2acb9b72d48937e98b7cd7", "key": "modified"}, {"hash": "e979487de1bb76cacffc9e9b46dc3e0f", "key": "href"}, {"hash": "9256dbbdea2fd981661df3d8a369c077", "key": "cvss3"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "23ee77eb05d2b8630175e2074b5e8d36", "key": "cpe23"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "extraReferences"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "e31057521ddab76f8e53dd16ed1d92ce", "key": "cpeConfiguration"}, {"hash": "8ef9046413011f920693be59106af97c", "key": "affectedSoftware"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "b647a850fd42b235dd11ee60cf626f2d", "key": "cwe"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-7058", "id": "CVE-2017-7058", "lastseen": "2020-12-09T20:13:36", "modified": "2017-07-24T14:32:00", "objectVersion": "1.3", "published": "2017-07-20T16:29:00", "references": ["https://support.apple.com/HT207923", "http://www.securityfocus.com/bid/99891", "http://www.securitytracker.com/id/1038950"], "reporter": "cve@mitre.org", "title": "CVE-2017-7058", "type": "cve", "viewCount": 5}, "differentElements": ["extraReferences"], "edition": 5, "lastseen": "2020-12-09T20:13:36"}, {"bulletin": {"affectedConfiguration": [], "affectedSoftware": [{"cpeName": "apple:iphone_os", "name": "apple iphone os", "operator": "le", "version": "10.3.2"}], "bulletinFamily": "NVD", "cpe": ["cpe:/o:apple:iphone_os:10.3.2"], "cpe23": ["cpe:2.3:o:apple:iphone_os:10.3.2:*:*:*:*:*:*:*"], "cpeConfiguration": {}, "cvelist": ["CVE-2017-7058"], "cvss": {"score": 2.1, "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": true, "cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.1, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "LOW", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "NONE", "baseScore": 2.4, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 0.9, "impactScore": 1.4}, "cwe": ["CWE-200"], "description": "An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. The issue involves the \"Notifications\" component. It allows physically proximate attackers to read unintended notifications on the lock screen.", "edition": 2, "enchantments": {"dependencies": {"modified": "2020-09-21T14:31:30", "references": [{"idList": ["VULNERLAB:2078"], "type": "vulnerlab"}, {"idList": ["APPLE:HT207923"], "type": "apple"}], "rev": 2}, "score": {"modified": "2020-09-21T14:31:30", "rev": 2, "value": 2.7, "vector": "NONE"}}, "hash": "cde4e80c9d5fece0d2b404e7e11307fed90a43347cbb095382b24593cdebdf8e", "hashmap": [{"hash": "05f7254d908383643f2e68ed8e1a8b9d", "key": "cvss2"}, {"hash": "8b73268c37891c388619c5559e7491c3", "key": "cvelist"}, {"hash": "9845b5f721425441f2f939519f498301", "key": "references"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "b6788807ce06b9de03dd8a38746aaf2b", "key": "title"}, {"hash": "95a6abc31a457da4a776c21728c589ca", "key": "published"}, {"hash": "db946815eb35d0cd3bca0473c80f7a0e", "key": "description"}, {"hash": "15195f7bb8bb2a9ef61adda901b30fc3", "key": "cpe"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpeConfiguration"}, {"hash": "8c29e327ecae9940af88849fdeee038f", "key": "cvss"}, {"hash": "550a8c7b5a2acb9b72d48937e98b7cd7", "key": "modified"}, {"hash": "e979487de1bb76cacffc9e9b46dc3e0f", "key": "href"}, {"hash": "9256dbbdea2fd981661df3d8a369c077", "key": "cvss3"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "23ee77eb05d2b8630175e2074b5e8d36", "key": "cpe23"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "8ef9046413011f920693be59106af97c", "key": "affectedSoftware"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "b647a850fd42b235dd11ee60cf626f2d", "key": "cwe"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-7058", "id": "CVE-2017-7058", "lastseen": "2020-09-21T14:31:30", "modified": "2017-07-24T14:32:00", "objectVersion": "1.3", "published": "2017-07-20T16:29:00", "references": ["https://support.apple.com/HT207923", "http://www.securityfocus.com/bid/99891", "http://www.securitytracker.com/id/1038950"], "reporter": "cve@mitre.org", "title": "CVE-2017-7058", "type": "cve", "viewCount": 4}, "differentElements": ["cpeConfiguration"], "edition": 2, "lastseen": "2020-09-21T14:31:30"}, {"bulletin": {"affectedConfiguration": [], "affectedSoftware": [{"cpeName": "apple:iphone_os", "name": "apple iphone os", "operator": "le", "version": "10.3.2"}], "bulletinFamily": "NVD", "cpe": ["cpe:/o:apple:iphone_os:10.3.2"], "cpe23": ["cpe:2.3:o:apple:iphone_os:10.3.2:*:*:*:*:*:*:*"], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"cpe_match": [{"cpe23Uri": "cpe:2.3:o:apple:iphone_os:10.3.2:*:*:*:*:*:*:*", "versionEndIncluding": "10.3.2", "vulnerable": true}], "operator": "OR"}]}, "cvelist": ["CVE-2017-7058"], "cvss": {"score": 2.1, "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"}, "cvss2": {"acInsufInfo": true, "cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.1, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "LOW", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "NONE", "baseScore": 2.4, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 0.9, "impactScore": 1.4}, "cwe": ["CWE-200"], "description": "An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. The issue involves the \"Notifications\" component. It allows physically proximate attackers to read unintended notifications on the lock screen.", "edition": 3, "enchantments": {"dependencies": {"modified": "2020-10-03T13:07:47", "references": [{"idList": ["VULNERLAB:2078"], "type": "vulnerlab"}, {"idList": ["APPLE:HT207923"], "type": "apple"}], "rev": 2}, "score": {"modified": "2020-10-03T13:07:47", "rev": 2, "value": 2.7, "vector": "NONE"}}, "hash": "c067e3453db1e9f6ad8d91598b07dac987a58b37c8faeb1ac2d1ee1e19f21fa6", "hashmap": [{"hash": "05f7254d908383643f2e68ed8e1a8b9d", "key": "cvss2"}, {"hash": "8b73268c37891c388619c5559e7491c3", "key": "cvelist"}, {"hash": "9845b5f721425441f2f939519f498301", "key": "references"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "b6788807ce06b9de03dd8a38746aaf2b", "key": "title"}, {"hash": "95a6abc31a457da4a776c21728c589ca", "key": "published"}, {"hash": "db946815eb35d0cd3bca0473c80f7a0e", "key": "description"}, {"hash": "15195f7bb8bb2a9ef61adda901b30fc3", "key": "cpe"}, {"hash": "8c29e327ecae9940af88849fdeee038f", "key": "cvss"}, {"hash": "550a8c7b5a2acb9b72d48937e98b7cd7", "key": "modified"}, {"hash": "e979487de1bb76cacffc9e9b46dc3e0f", "key": "href"}, {"hash": "9256dbbdea2fd981661df3d8a369c077", "key": "cvss3"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "23ee77eb05d2b8630175e2074b5e8d36", "key": "cpe23"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "e31057521ddab76f8e53dd16ed1d92ce", "key": "cpeConfiguration"}, {"hash": "8ef9046413011f920693be59106af97c", "key": "affectedSoftware"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "b647a850fd42b235dd11ee60cf626f2d", "key": "cwe"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-7058", "id": "CVE-2017-7058", "lastseen": "2020-10-03T13:07:47", "modified": "2017-07-24T14:32:00", "objectVersion": "1.3", "published": "2017-07-20T16:29:00", "references": ["https://support.apple.com/HT207923", "http://www.securityfocus.com/bid/99891", "http://www.securitytracker.com/id/1038950"], "reporter": "cve@mitre.org", "title": "CVE-2017-7058", "type": "cve", "viewCount": 5}, "differentElements": ["affectedSoftware"], "edition": 3, "lastseen": "2020-10-03T13:07:47"}], "edition": 7, "hashmap": [{"key": "affectedConfiguration", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "affectedSoftware", "hash": "8ef9046413011f920693be59106af97c"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "15195f7bb8bb2a9ef61adda901b30fc3"}, {"key": "cpe23", "hash": "23ee77eb05d2b8630175e2074b5e8d36"}, {"key": "cpeConfiguration", "hash": "13c362c701f58b619472bb2e89eb0a8a"}, {"key": "cvelist", "hash": "8b73268c37891c388619c5559e7491c3"}, {"key": "cvss", "hash": "8c29e327ecae9940af88849fdeee038f"}, {"key": "cvss2", "hash": "05f7254d908383643f2e68ed8e1a8b9d"}, {"key": "cvss3", "hash": "9256dbbdea2fd981661df3d8a369c077"}, {"key": "cwe", "hash": "b647a850fd42b235dd11ee60cf626f2d"}, {"key": "description", "hash": "db946815eb35d0cd3bca0473c80f7a0e"}, {"key": "extraReferences", "hash": "8460494bc5a328b69370a9ef392449dc"}, {"key": "href", "hash": "e979487de1bb76cacffc9e9b46dc3e0f"}, {"key": "immutableFields", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "modified", "hash": "550a8c7b5a2acb9b72d48937e98b7cd7"}, {"key": "published", "hash": "95a6abc31a457da4a776c21728c589ca"}, {"key": "references", "hash": "9845b5f721425441f2f939519f498301"}, {"key": "reporter", "hash": "2146b0fa8ae40d069c96c3ccce6daf49"}, {"key": "title", "hash": "b6788807ce06b9de03dd8a38746aaf2b"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "067b49390b9cba94e87afa5552b6574c19194f961d640acd5ab172640a818ac3", "viewCount": 20, "enchantments": {"dependencies": {"references": [{"type": "vulnerlab", "idList": ["VULNERLAB:2078"]}, {"type": "nessus", "idList": ["700167.PRM", "APPLE_IOS_1033_CHECK.NBIN"]}, {"type": "apple", "idList": ["APPLE:HT207923", "APPLE:21F236C1A9D411224D0D290A7D88873F"]}], "modified": "2021-04-23T00:08:03", "rev": 2}, "score": {"value": 2.8, "vector": "NONE", "modified": "2021-04-23T00:08:03", "rev": 2}}, "objectVersion": "1.5", "cpe": ["cpe:/o:apple:iphone_os:10.3.2"], "affectedSoftware": [{"cpeName": "apple:iphone_os", "name": "apple iphone os", "operator": "le", "version": "10.3.2"}], "cvss2": {"acInsufInfo": true, "cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.1, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "LOW", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "NONE", "baseScore": 2.4, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 0.9, "impactScore": 1.4}, "cpe23": ["cpe:2.3:o:apple:iphone_os:10.3.2:*:*:*:*:*:*:*"], "cwe": ["CWE-200"], "scheme": null, "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"children": [], "cpe_match": [{"cpe23Uri": "cpe:2.3:o:apple:iphone_os:10.3.2:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "10.3.2", "vulnerable": true}], "operator": "OR"}]}, "extraReferences": [{"name": "https://support.apple.com/HT207923", "refsource": "CONFIRM", "tags": ["Vendor Advisory"], "url": "https://support.apple.com/HT207923"}, {"name": "1038950", "refsource": "SECTRACK", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securitytracker.com/id/1038950"}, {"name": "99891", "refsource": "BID", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/99891"}], "immutableFields": []}], "nessus": [{"id": "700167.PRM", "hash": "d88a47ef187f3eb8687f774f627af6cc", "type": "nessus", "bulletinFamily": "scanner", "title": "Apple iOS < 10.3.3 Multiple Vulnerabilities", "description": "The version of iOS running on the mobile device is prior to 10.3.3, and is affected by multiple vulnerabilities :\n\n - A flaw exists in Safari due to inconsistent user interface behavior. An unauthenticated, remote attacker can exploit this, via a malicious website, to spoof the address bar. (CVE-2017-2517)\n - An information disclosure vulnerability exists in the WebKit component due to improper handling of SVG filters. An unauthenticated, remote attacker can exploit this, via a timing side-channel attack, to disclose sensitive cross-domain information. (CVE-2017-7006)\n - A denial of service vulnerability exists in the EventKitUI component that allows an unauthenticated, remote attacker to exhaust available resources, causing an application to terminate. (CVE-2017-7007)\n - A remote code execution vulnerability exists in the CoreAudio component due to improper validation of user-supplied input when handling movie files. An unauthenticated, remote attacker can exploit this, by convincing a user to play a specially crafted movie file, to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-7008)\n - A memory corruption issue exists in the IOUSBFamily component due to improper validation of user-supplied input. A local attacker can exploit this, via a specially crafted application, to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-7009)\n - Multiple out-of-bounds read errors exist in the libxml2 component due to improper handling of specially crafted XML documents. An unauthenticated, remote attacker can exploit these to disclose user information. (CVE-2017-7010, CVE-2017-7013)\n - A unspecified flaw exists in the Webkit component that allows an unauthenticated, remote attacker to spoof the address bar via a malicious website. (CVE-2017-7011)\n - Multiple memory corruption issues exist in the Webkit Web Inspector component due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit these, via a specially crafted web page, to corrupt memory, resulting in the execution of arbitrary code. (CVE-2017-7012)\n - Multiple memory corruption issues exist in the WebKit component due to improper validation of input. An unauthenticated, remote attacker can exploit these issues, via a specially crafted web page, to execute arbitrary code. (CVE-2017-7018, CVE-2017-7020, CVE-2017-7030, CVE-2017-7034, CVE-2017-7037, CVE-2017-7039, CVE-2017-7040, CVE-2017-7041, CVE-2017-7042, CVE-2017-7043, CVE-2017-7046, CVE-2017-7048, CVE-2017-7049, CVE-2017-7052, CVE-2017-7055, CVE-2017-7056, CVE-2017-7061)\n - A memory corruption issue exists in the 'WebKit Page Loading' component due to improper validation of input. An unauthenticated, remote attacker can exploit this, via a specially crafted web page, to execute arbitrary code. (CVE-2017-7019)\n - Multiple memory corruption issues exist in the kernel due to improper validation of input. A local attacker can exploit these issues to cause a denial of service condition or the execution of arbitrary code with system privileges. (CVE-2017-7022, CVE-2017-7024, CVE-2017-7026)\n - Multiple memory corruption issues exist in the kernel due to improper validation of input. A local attacker can exploit these issues to cause a denial of service condition or the execution of arbitrary code with kernel privileges. (CVE-2017-7023, CVE-2017-7025, CVE-2017-7027, CVE-2017-7069)\n - Multiple unspecified flaws exist in the kernel due to a failure to properly sanitize input. A local attacker can exploit these issues, via a specially crafted application, to disclose restricted memory. (CVE-2017-7028, CVE-2017-7029)\n - Multiple cross-site scripting (XSS) vulnerabilities exist in the WebKit component in the DOMParser due to improper validation of user-supplied input before returning it to users. An unauthenticated, remote attacker can exploit these issue, via a specially crafted URL, to execute arbitrary script code in a user's browser session. (CVE-2017-7038, CVE-2017-7059)\n - A memory corruption issue exists in the libxpc component due to improper validation of input. A local attacker can exploit this issue, via a specifically crafted application, to cause a denial of service condition or the execution of arbitrary code with system privileges. (CVE-2017-7047)\n - An information disclosure vulnerability exists due to the device displaying notifications on the lock screen even when disabled. A local attacker can exploit this to gain potentially sensitive information. (CVE-2017-7058)\n - A denial of service vulnerability exists in Safari printing when handling a specially crafted web page that results in creating an infinite number of print dialogs. An unauthenticated, remote attacker can exploit this to cause a user to believe that the browser has locked up. (CVE-2017-7060)\n - A buffer overflow condition exists in the Contacts component due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-7062)\n - A denial of service vulnerability exists in the Messages component due to improper handling of memory. An unauthenticated, remote attacker can exploit this to consume excessive resources, resulting in an unexpected application termination. (CVE-2017-7063)\n - An unspecified memory initialization issue exists in Webkit. A local attacker can exploit this, via a specially crafted application, to disclose the contents of restricted memory. (CVE-2017-7064)\n - A buffer overflow condition exists in the libarchive component due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, via a specially crafted archive file, to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-7068)\n - A memory corruption issue exists in the Telephony component due to improper validation of user-supplied input. A man-in-the-middle attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-8248)\n - A memory corruption issue exists in the Broadcom BCM43xx family Wi-Fi Chips component that allows an unauthenticated, remote attacker to execute arbitrary code. (CVE-2017-9417)", "published": "2017-07-27T00:00:00", "modified": "2019-03-06T00:00:00", "cvss": {"score": 10, "vector": "CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {}, "cvss3": {"score": 9.8, "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "href": "https://www.tenable.com/plugins/nnm/700167", "reporter": "Tenable", "references": ["http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7061", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7008", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8248", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7025", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7052", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7024", "http://www.zerodayinitiative.com/advisories/ZDI-17-489", "https://support.apple.com/en-us/HT207923", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7020", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7046", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7069", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7038", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7063", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7011", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7068", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7010", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7022", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7062", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7056", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7023", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7049", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7039", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7026", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7018", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7007", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7013", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7060", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7037", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7055", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7042", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7041", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7048", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7059", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7040", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7027", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7034", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7064", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7030", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7019", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7058", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7006", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7012", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2517", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7028", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7047", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7009", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9417", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7043", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7029"], "cvelist": ["CVE-2017-7006", "CVE-2017-7011", "CVE-2017-7012", "CVE-2017-7018", "CVE-2017-7019", "CVE-2017-7020", "CVE-2017-7030", "CVE-2017-7034", "CVE-2017-7037", "CVE-2017-7038", "CVE-2017-7039", "CVE-2017-7040", "CVE-2017-7041", "CVE-2017-7042", "CVE-2017-7043", "CVE-2017-7046", "CVE-2017-7048", "CVE-2017-7049", "CVE-2017-7052", "CVE-2017-7055", "CVE-2017-7056", "CVE-2017-7059", "CVE-2017-7061", "CVE-2017-7064", "CVE-2017-9417", "CVE-2017-7063", "CVE-2017-7062", "CVE-2017-7008", "CVE-2017-7007", "CVE-2017-7009", "CVE-2017-7022", "CVE-2017-7024", "CVE-2017-7026", "CVE-2017-7023", "CVE-2017-7025", "CVE-2017-7027", "CVE-2017-7069", "CVE-2017-7028", "CVE-2017-7029", "CVE-2017-7068", "CVE-2017-7010", "CVE-2017-7013", "CVE-2017-7047", "CVE-2017-7058", "CVE-2017-2517", "CVE-2017-7060", "CVE-2017-8248"], "immutableFields": [], "lastseen": "2021-08-19T12:35:39", "history": [{"bulletin": {"id": "700167.PRM", "hash": "2c9dddd2bce6486cec9bd579ea02af77", "type": "nessus", "bulletinFamily": "scanner", "title": "Apple iOS < 10.3.3 Multiple Vulnerabilities", "description": "The version of iOS running on the mobile device is prior to 10.3.3, and is affected by multiple vulnerabilities :\n\n - A flaw exists in Safari due to inconsistent user interface behavior. An unauthenticated, remote attacker can exploit this, via a malicious website, to spoof the address bar. (CVE-2017-2517)\n - An information disclosure vulnerability exists in the WebKit component due to improper handling of SVG filters. An unauthenticated, remote attacker can exploit this, via a timing side-channel attack, to disclose sensitive cross-domain information. (CVE-2017-7006)\n - A denial of service vulnerability exists in the EventKitUI component that allows an unauthenticated, remote attacker to exhaust available resources, causing an application to terminate. (CVE-2017-7007)\n - A remote code execution vulnerability exists in the CoreAudio component due to improper validation of user-supplied input when handling movie files. An unauthenticated, remote attacker can exploit this, by convincing a user to play a specially crafted movie file, to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-7008)\n - A memory corruption issue exists in the IOUSBFamily component due to improper validation of user-supplied input. A local attacker can exploit this, via a specially crafted application, to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-7009)\n - Multiple out-of-bounds read errors exist in the libxml2 component due to improper handling of specially crafted XML documents. An unauthenticated, remote attacker can exploit these to disclose user information. (CVE-2017-7010, CVE-2017-7013)\n - A unspecified flaw exists in the Webkit component that allows an unauthenticated, remote attacker to spoof the address bar via a malicious website. (CVE-2017-7011)\n - Multiple memory corruption issues exist in the Webkit Web Inspector component due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit these, via a specially crafted web page, to corrupt memory, resulting in the execution of arbitrary code. (CVE-2017-7012)\n - Multiple memory corruption issues exist in the WebKit component due to improper validation of input. An unauthenticated, remote attacker can exploit these issues, via a specially crafted web page, to execute arbitrary code. (CVE-2017-7018, CVE-2017-7020, CVE-2017-7030, CVE-2017-7034, CVE-2017-7037, CVE-2017-7039, CVE-2017-7040, CVE-2017-7041, CVE-2017-7042, CVE-2017-7043, CVE-2017-7046, CVE-2017-7048, CVE-2017-7049, CVE-2017-7052, CVE-2017-7055, CVE-2017-7056, CVE-2017-7061)\n - A memory corruption issue exists in the 'WebKit Page Loading' component due to improper validation of input. An unauthenticated, remote attacker can exploit this, via a specially crafted web page, to execute arbitrary code. (CVE-2017-7019)\n - Multiple memory corruption issues exist in the kernel due to improper validation of input. A local attacker can exploit these issues to cause a denial of service condition or the execution of arbitrary code with system privileges. (CVE-2017-7022, CVE-2017-7024, CVE-2017-7026)\n - Multiple memory corruption issues exist in the kernel due to improper validation of input. A local attacker can exploit these issues to cause a denial of service condition or the execution of arbitrary code with kernel privileges. (CVE-2017-7023, CVE-2017-7025, CVE-2017-7027, CVE-2017-7069)\n - Multiple unspecified flaws exist in the kernel due to a failure to properly sanitize input. A local attacker can exploit these issues, via a specially crafted application, to disclose restricted memory. (CVE-2017-7028, CVE-2017-7029)\n - Multiple cross-site scripting (XSS) vulnerabilities exist in the WebKit component in the DOMParser due to improper validation of user-supplied input before returning it to users. An unauthenticated, remote attacker can exploit these issue, via a specially crafted URL, to execute arbitrary script code in a user's browser session. (CVE-2017-7038, CVE-2017-7059)\n - A memory corruption issue exists in the libxpc component due to improper validation of input. A local attacker can exploit this issue, via a specifically crafted application, to cause a denial of service condition or the execution of arbitrary code with system privileges. (CVE-2017-7047)\n - An information disclosure vulnerability exists due to the device displaying notifications on the lock screen even when disabled. A local attacker can exploit this to gain potentially sensitive information. (CVE-2017-7058)\n - A denial of service vulnerability exists in Safari printing when handling a specially crafted web page that results in creating an infinite number of print dialogs. An unauthenticated, remote attacker can exploit this to cause a user to believe that the browser has locked up. (CVE-2017-7060)\n - A buffer overflow condition exists in the Contacts component due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-7062)\n - A denial of service vulnerability exists in the Messages component due to improper handling of memory. An unauthenticated, remote attacker can exploit this to consume excessive resources, resulting in an unexpected application termination. (CVE-2017-7063)\n - An unspecified memory initialization issue exists in Webkit. A local attacker can exploit this, via a specially crafted application, to disclose the contents of restricted memory. (CVE-2017-7064)\n - A buffer overflow condition exists in the libarchive component due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, via a specially crafted archive file, to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-7068)\n - A memory corruption issue exists in the Telephony component due to improper validation of user-supplied input. A man-in-the-middle attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-8248)\n - A memory corruption issue exists in the Broadcom BCM43xx family Wi-Fi Chips component that allows an unauthenticated, remote attacker to execute arbitrary code. (CVE-2017-9417)", "published": "2017-07-27T00:00:00", "modified": "2019-03-06T00:00:00", "cvss": {"score": 10, "vector": "CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {}, "cvss3": {"score": 9.8, "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "href": "https://www.tenable.com/plugins/nnm/700167", "reporter": "Tenable", "references": ["https://support.apple.com/en-us/HT207923", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7025", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7046", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9417", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7009", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7069", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7060", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7018", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7027", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7042", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7022", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7026", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7043", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7038", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7008", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7062", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7063", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7030", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7047", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7064", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7068", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7034", "http://www.zerodayinitiative.com/advisories/ZDI-17-489", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7041", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7056", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7058", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7010", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7013", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8248", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7039", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7048", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7024", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7028", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7055", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7011", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7023", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7020", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7052", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7006", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7040", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7007", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2517", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7049", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7029", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7061", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7019", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7059", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7012", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7037"], "cvelist": ["CVE-2017-7006", "CVE-2017-7011", "CVE-2017-7012", "CVE-2017-7018", "CVE-2017-7019", "CVE-2017-7020", "CVE-2017-7030", "CVE-2017-7034", "CVE-2017-7037", "CVE-2017-7038", "CVE-2017-7039", "CVE-2017-7040", "CVE-2017-7041", "CVE-2017-7042", "CVE-2017-7043", "CVE-2017-7046", "CVE-2017-7048", "CVE-2017-7049", "CVE-2017-7052", "CVE-2017-7055", "CVE-2017-7056", "CVE-2017-7059", "CVE-2017-7061", "CVE-2017-7064", "CVE-2017-9417", "CVE-2017-7063", "CVE-2017-7062", "CVE-2017-7008", "CVE-2017-7007", "CVE-2017-7009", "CVE-2017-7022", "CVE-2017-7024", "CVE-2017-7026", "CVE-2017-7023", "CVE-2017-7025", "CVE-2017-7027", "CVE-2017-7069", "CVE-2017-7028", "CVE-2017-7029", "CVE-2017-7068", "CVE-2017-7010", "CVE-2017-7013", "CVE-2017-7047", "CVE-2017-7058", "CVE-2017-2517", "CVE-2017-7060", "CVE-2017-8248"], "immutableFields": [], "lastseen": "2021-08-11T13:57:24", "history": [], "viewCount": 0, "enchantments": {"dependencies": {"references": [{"type": "nessus", "idList": ["MACOS_ITUNES_12_6_2.NASL", "700166.PRM", "MACOSX_SAFARI10_1_2.NASL", "ITUNES_12_6_2_BANNER.NASL", "FREEBSD_PKG_0F66B901715C11E7AD1FBCAEC565249C.NASL", "ITUNES_12_6_2.NASL", "GENTOO_GLSA-201710-14.NASL", "APPLE_IOS_1033_CHECK.NBIN", "700169.PRM", "700168.PRM"]}, {"type": "apple", "idList": ["APPLE:HT207925", "APPLE:HT207921", "APPLE:HT207924", "APPLE:HT207928", "APPLE:HT207927", "APPLE:HT207923"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310873200", "OPENVAS:1361412562310811251", "OPENVAS:1361412562310873180", "OPENVAS:1361412562310811252", "OPENVAS:1361412562310843266", "OPENVAS:1361412562310811538", "OPENVAS:1361412562310873226", "OPENVAS:1361412562310811535"]}, {"type": "freebsd", "idList": ["0F66B901-715C-11E7-AD1F-BCAEC565249C"]}, {"type": "kaspersky", "idList": ["KLA11075"]}, {"type": "gentoo", "idList": ["GLSA-201710-14"]}, {"type": "fedora", "idList": ["FEDORA:417B06017118", "FEDORA:D681D609273A", "FEDORA:33FB9639A184"]}, {"type": "archlinux", "idList": ["ASA-201707-25"]}, {"type": "ubuntu", "idList": ["USN-3376-1"]}, {"type": "threatpost", "idList": ["THREATPOST:60D5DA46BF733084F46AB656BE8CC259"]}, {"type": "cve", "idList": ["CVE-2017-8248", "CVE-2017-7058", "CVE-2017-7025", "CVE-2017-7022", "CVE-2017-7007", "CVE-2017-7008", "CVE-2017-7009", "CVE-2017-7028", "CVE-2017-7023", "CVE-2017-7029"]}, {"type": "android", "idList": ["ANDROID:CVE-2017-9417", "ANDROID:CVE-2017-8248"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2017-7049", "UB:CVE-2017-7034", "UB:CVE-2017-7037", "UB:CVE-2017-7038", "UB:CVE-2017-7013", "UB:CVE-2017-7019", "UB:CVE-2017-7010", "UB:CVE-2017-7020", "UB:CVE-2017-7011", "UB:CVE-2017-7006"]}], "modified": "2021-08-11T13:57:24", "rev": 2}, "score": {"value": 7.6, "vector": "NONE", "modified": "2021-08-11T13:57:24", "rev": 2}}, "objectVersion": "1.6", "pluginID": "700167", "sourceData": "Binary data 700167.prm", "naslFamily": "Mobile Devices", "cpe": ["cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*"], "solution": "Upgrade to Apple iOS 10.3.3 or later.", "nessusSeverity": "", "cvssScoreSource": "", "vpr": {}, "exploitAvailable": false, "exploitEase": "", "patchPublicationDate": "2017-07-19T00:00:00", "vulnerabilityPublicationDate": "2017-06-02T00:00:00", "exploitableWith": []}, "lastseen": "2021-08-11T13:57:24", "differentElements": ["nessusSeverity"], "edition": 1}], "viewCount": 0, "enchantments": {"dependencies": {"references": [{"type": "nessus", "idList": ["APPLE_IOS_1033_CHECK.NBIN", "700169.PRM", "FEDORA_2017-73D6A0DFBB.NASL", "FEDORA_2017-9D572CC64A.NASL", "ITUNES_12_6_2_BANNER.NASL", "FEDORA_2017-24BDDB96B5.NASL", "ITUNES_12_6_2.NASL", "700166.PRM", "700168.PRM", "MACOSX_SAFARI10_1_2.NASL", "UBUNTU_USN-3376-1.NASL", "FREEBSD_PKG_0F66B901715C11E7AD1FBCAEC565249C.NASL", "MACOS_ITUNES_12_6_2.NASL", "GENTOO_GLSA-201710-14.NASL"]}, {"type": "apple", "idList": ["APPLE:HT207928", "APPLE:CEC7DCE5379D5C1DBB2795CA582D13CD", "APPLE:F234B75385D1403C977E0F0F5AEA4D95", "APPLE:HT207925", "APPLE:ABA73FEAAAB2192DEAFA24CF2EB1B8F9", "APPLE:21F236C1A9D411224D0D290A7D88873F", "APPLE:5D035145E3EE53A8C36DC063A0DC8B49", "APPLE:7AFC35B4B1D8C25A050E4C951554FD97", "APPLE:HT207924", "APPLE:HT207923", "APPLE:HT207927", "APPLE:HT207921"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310873200", "OPENVAS:1361412562310811251", "OPENVAS:1361412562310873180", "OPENVAS:1361412562310811535", "OPENVAS:1361412562310873226", "OPENVAS:1361412562310843266", "OPENVAS:1361412562310811252", "OPENVAS:1361412562310811538"]}, {"type": "freebsd", "idList": ["0F66B901-715C-11E7-AD1F-BCAEC565249C"]}, {"type": "kaspersky", "idList": ["KLA11075"]}, {"type": "gentoo", "idList": ["GLSA-201710-14"]}, {"type": "archlinux", "idList": ["ASA-201707-25"]}, {"type": "fedora", "idList": ["FEDORA:417B06017118", "FEDORA:D681D609273A", "FEDORA:33FB9639A184"]}, {"type": "ubuntu", "idList": ["USN-3376-1"]}, {"type": "threatpost", "idList": ["THREATPOST:60D5DA46BF733084F46AB656BE8CC259"]}, {"type": "cve", "idList": ["CVE-2017-7028", "CVE-2017-7047", "CVE-2017-7013", "CVE-2017-7025", "CVE-2017-7006", "CVE-2017-7037", "CVE-2017-7038", "CVE-2017-9417", "CVE-2017-7030", "CVE-2017-7008", "CVE-2017-7022", "CVE-2017-7012", "CVE-2017-7043", "CVE-2017-7027", "CVE-2017-7058", "CVE-2017-7023", "CVE-2017-7024", "CVE-2017-7034", "CVE-2017-7026", "CVE-2017-7069", "CVE-2017-7010", "CVE-2017-7018", "CVE-2017-7049", "CVE-2017-7011", "CVE-2017-7029", "CVE-2017-7009", "CVE-2017-7019", "CVE-2017-7007", "CVE-2017-8248"]}, {"type": "android", "idList": ["ANDROID:CVE-2017-9417", "ANDROID:CVE-2017-8248"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2017-7011", "UB:CVE-2017-7043", "UB:CVE-2017-7018", "UB:CVE-2017-7030", "UB:CVE-2017-7013", "UB:CVE-2017-7006", "UB:CVE-2017-7034", "UB:CVE-2017-7010", "UB:CVE-2017-7049", "UB:CVE-2017-7038", "UB:CVE-2017-7012", "UB:CVE-2017-7019", "UB:CVE-2017-7037"]}, {"type": "debiancve", "idList": ["DEBIANCVE:CVE-2017-7006", "DEBIANCVE:CVE-2017-7019", "DEBIANCVE:CVE-2017-7037", "DEBIANCVE:CVE-2017-7034", "DEBIANCVE:CVE-2017-9417", "DEBIANCVE:CVE-2017-7049", "DEBIANCVE:CVE-2017-7043", "DEBIANCVE:CVE-2017-7018", "DEBIANCVE:CVE-2017-7030", "DEBIANCVE:CVE-2017-7012", "DEBIANCVE:CVE-2017-7038", "DEBIANCVE:CVE-2017-7011"]}], "modified": "2021-08-19T12:35:39", "rev": 2}, "score": {"value": 7.6, "vector": "NONE", "modified": "2021-08-19T12:35:39", "rev": 2}}, "objectVersion": "1.6", "pluginID": "700167", "sourceData": "Binary data 700167.prm", "naslFamily": "Mobile Devices", "cpe": ["cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*"], "solution": "Upgrade to Apple iOS 10.3.3 or later.", "nessusSeverity": "Critical", "cvssScoreSource": "", "vpr": {}, "exploitAvailable": false, "exploitEase": "", "patchPublicationDate": "2017-07-19T00:00:00", "vulnerabilityPublicationDate": "2017-06-02T00:00:00", "exploitableWith": [], "_object_type": "robots.models.nessus.NessusBulletin", "_object_types": ["robots.models.base.Bulletin", "robots.models.nessus.NessusBulletin"]}, {"id": "APPLE_IOS_1033_CHECK.NBIN", "hash": "748cfdcdb19f4fce41957a9865f0cec8", "type": "nessus", "bulletinFamily": "scanner", "title": "Apple iOS < 10.3.3 Multiple Vulnerabilities", "description": "The version of Apple iOS running on the mobile device is prior to 10.3.3. It is, therefore, affected by multiple vulnerabilities :\n\n - A flaw exists in Safari due to inconsistent user interface behavior. An unauthenticated, remote attacker can exploit this, via a malicious website, to spoof the address bar. (CVE-2017-2517)\n\n - An information disclosure vulnerability exists in the WebKit component due to improper handling of SVG filters. An unauthenticated, remote attacker can exploit this, via a timing side-channel attack, to disclose sensitive cross-domain information. (CVE-2017-7006)\n\n - A denial of service vulnerability exists in the EventKitUI component that allows an unauthenticated, remote attacker to exhaust available resources, causing an application to terminate. (CVE-2017-7007)\n\n - A remote code execution vulnerability exists in the CoreAudio component due to improper validation of user-supplied input when handling movie files. An unauthenticated, remote attacker can exploit this, by convincing a user to play a specially crafted movie file, to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-7008)\n\n - A memory corruption issue exists in the IOUSBFamily component due to improper validation of user-supplied input. A local attacker can exploit this, via a specially crafted application, to cause a denial of service condition or the execution of arbitrary code.\n (CVE-2017-7009)\n\n - Multiple out-of-bounds read errors exist in the libxml2 component due to improper handling of specially crafted XML documents. An unauthenticated, remote attacker can exploit these to disclose user information.\n (CVE-2017-7010, CVE-2017-7013)\n\n - A unspecified flaw exists in the Webkit component that allows an unauthenticated, remote attacker to spoof the address bar via a malicious website. (CVE-2017-7011)\n\n - Multiple memory corruption issues exist in the Webkit Web Inspector component due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit these, via a specially crafted web page, to corrupt memory, resulting in the execution of arbitrary code. (CVE-2017-7012)\n\n - Multiple memory corruption issues exist in the WebKit component due to improper validation of input. An unauthenticated, remote attacker can exploit these issues, via a specially crafted web page, to execute arbitrary code. (CVE-2017-7018, CVE-2017-7020, CVE-2017-7030, CVE-2017-7034, CVE-2017-7037, CVE-2017-7039, CVE-2017-7040, CVE-2017-7041, CVE-2017-7042, CVE-2017-7043, CVE-2017-7046, CVE-2017-7048, CVE-2017-7049, CVE-2017-7052, CVE-2017-7055, CVE-2017-7056, CVE-2017-7061)\n\n - A memory corruption issue exists in the 'WebKit Page Loading' component due to improper validation of input.\n An unauthenticated, remote attacker can exploit this, via a specially crafted web page, to execute arbitrary code. (CVE-2017-7019)\n\n - Multiple memory corruption issues exist in the kernel due to improper validation of input. A local attacker can exploit these issues to cause a denial of service condition or the execution of arbitrary code with system privileges. (CVE-2017-7022, CVE-2017-7024, CVE-2017-7026)\n\n - Multiple memory corruption issues exist in the kernel due to improper validation of input. A local attacker can exploit these issues to cause a denial of service condition or the execution of arbitrary code with kernel privileges. (CVE-2017-7023, CVE-2017-7025, CVE-2017-7027, CVE-2017-7069)\n\n - Multiple unspecified flaws exist in the kernel due to a failure to properly sanitize input. A local attacker can exploit these issues, via a specially crafted application, to disclose restricted memory.\n (CVE-2017-7028, CVE-2017-7029)\n\n - Multiple cross-site scripting (XSS) vulnerabilities exist in the WebKit component in the DOMParser due to improper validation of user-supplied input before returning it to users. An unauthenticated, remote attacker can exploit these issue, via a specially crafted URL, to execute arbitrary script code in a user's browser session. (CVE-2017-7038, CVE-2017-7059)\n\n - A memory corruption issue exists in the libxpc component due to improper validation of input. A local attacker can exploit this issue, via a specifically crafted application, to cause a denial of service condition or the execution of arbitrary code with system privileges.\n (CVE-2017-7047)\n\n - An information disclosure vulnerability exists due to the device displaying notifications on the lock screen even when disabled. A local attacker can exploit this to gain potentially sensitive information. (CVE-2017-7058)\n\n - A denial of service vulnerability exists in Safari printing when handling a specially crafted web page that results in creating an infinite number of print dialogs.\n An unauthenticated, remote attacker can exploit this to cause a user to believe that the browser has locked up. (CVE-2017-7060)\n\n - A buffer overflow condition exists in the Contacts component due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-7062)\n\n - A denial of service vulnerability exists in the Messages component due to improper handling of memory. An unauthenticated, remote attacker can exploit this to consume excessive resources, resulting in an unexpected application termination. (CVE-2017-7063)\n\n - An unspecified memory initialization issue exists in Webkit. A local attacker can exploit this, via a specially crafted application, to disclose the contents of restricted memory. (CVE-2017-7064)\n\n - A buffer overflow condition exists in the libarchive component due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, via a specially crafted archive file, to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-7068)\n\n - A memory corruption issue exists in the Telephony component due to improper validation of user-supplied input. A man-in-the-middle attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-8248)\n\n - A memory corruption issue exists in the Broadcom BCM43xx family Wi-Fi Chips component that allows an unauthenticated, remote attacker to execute arbitrary code. (CVE-2017-9417)", "published": "2017-07-25T00:00:00", "modified": "2021-07-12T00:00:00", "cvss": {"score": 10, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {}, "cvss3": {"score": 9.8, "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "href": "https://www.tenable.com/plugins/nessus/101953", "reporter": "This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7023", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7037", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7012", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7019", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7064", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7010", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7028", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7026", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7048", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7058", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7063", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8248", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7024", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7011", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7027", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7013", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7034", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7062", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7020", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9417", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7041", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7008", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7069", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2517", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7055", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7025", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7059", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7039", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7068", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7018", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7043", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7029", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7046", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7047", "https://www.zerodayinitiative.com/advisories/ZDI-17-489/", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7030", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7049", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7056", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7006", "https://support.apple.com/en-us/HT207923", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7060", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7022", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7052", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7061", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7042", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7009", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7040", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7038", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7007"], "cvelist": ["CVE-2017-2517", "CVE-2017-7006", "CVE-2017-7007", "CVE-2017-7008", "CVE-2017-7009", "CVE-2017-7010", "CVE-2017-7011", "CVE-2017-7012", "CVE-2017-7013", "CVE-2017-7018", "CVE-2017-7019", "CVE-2017-7020", "CVE-2017-7022", "CVE-2017-7023", "CVE-2017-7024", "CVE-2017-7025", "CVE-2017-7026", "CVE-2017-7027", "CVE-2017-7028", "CVE-2017-7029", "CVE-2017-7030", "CVE-2017-7034", "CVE-2017-7037", "CVE-2017-7038", "CVE-2017-7039", "CVE-2017-7040", "CVE-2017-7041", "CVE-2017-7042", "CVE-2017-7043", "CVE-2017-7046", "CVE-2017-7047", "CVE-2017-7048", "CVE-2017-7049", "CVE-2017-7052", "CVE-2017-7055", "CVE-2017-7056", "CVE-2017-7058", "CVE-2017-7059", "CVE-2017-7060", "CVE-2017-7061", "CVE-2017-7062", "CVE-2017-7063", "CVE-2017-7064", "CVE-2017-7068", "CVE-2017-7069", "CVE-2017-8248", "CVE-2017-9417"], "immutableFields": [], "lastseen": "2021-10-22T12:57:00", "history": [{"bulletin": {"id": "APPLE_IOS_1033_CHECK.NBIN", "hash": "e6d44c2b8dcf937e1272041eccee3b9b", "type": "nessus", "bulletinFamily": "scanner", "title": "Apple iOS < 10.3.3 Multiple Vulnerabilities", "description": "The version of Apple iOS running on the mobile device is prior to 10.3.3. It is, therefore, affected by multiple vulnerabilities :\n\n - A flaw exists in Safari due to inconsistent user interface behavior. An unauthenticated, remote attacker can exploit this, via a malicious website, to spoof the address bar. (CVE-2017-2517)\n\n - An information disclosure vulnerability exists in the WebKit component due to improper handling of SVG filters. An unauthenticated, remote attacker can exploit this, via a timing side-channel attack, to disclose sensitive cross-domain information. (CVE-2017-7006)\n\n - A denial of service vulnerability exists in the EventKitUI component that allows an unauthenticated, remote attacker to exhaust available resources, causing an application to terminate. (CVE-2017-7007)\n\n - A remote code execution vulnerability exists in the CoreAudio component due to improper validation of user-supplied input when handling movie files. An unauthenticated, remote attacker can exploit this, by convincing a user to play a specially crafted movie file, to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-7008)\n\n - A memory corruption issue exists in the IOUSBFamily component due to improper validation of user-supplied input. A local attacker can exploit this, via a specially crafted application, to cause a denial of service condition or the execution of arbitrary code.\n (CVE-2017-7009)\n\n - Multiple out-of-bounds read errors exist in the libxml2 component due to improper handling of specially crafted XML documents. An unauthenticated, remote attacker can exploit these to disclose user information.\n (CVE-2017-7010, CVE-2017-7013)\n\n - A unspecified flaw exists in the Webkit component that allows an unauthenticated, remote attacker to spoof the address bar via a malicious website. (CVE-2017-7011)\n\n - Multiple memory corruption issues exist in the Webkit Web Inspector component due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit these, via a specially crafted web page, to corrupt memory, resulting in the execution of arbitrary code. (CVE-2017-7012)\n\n - Multiple memory corruption issues exist in the WebKit component due to improper validation of input. An unauthenticated, remote attacker can exploit these issues, via a specially crafted web page, to execute arbitrary code. (CVE-2017-7018, CVE-2017-7020, CVE-2017-7030, CVE-2017-7034, CVE-2017-7037, CVE-2017-7039, CVE-2017-7040, CVE-2017-7041, CVE-2017-7042, CVE-2017-7043, CVE-2017-7046, CVE-2017-7048, CVE-2017-7049, CVE-2017-7052, CVE-2017-7055, CVE-2017-7056, CVE-2017-7061)\n\n - A memory corruption issue exists in the 'WebKit Page Loading' component due to improper validation of input.\n An unauthenticated, remote attacker can exploit this, via a specially crafted web page, to execute arbitrary code. (CVE-2017-7019)\n\n - Multiple memory corruption issues exist in the kernel due to improper validation of input. A local attacker can exploit these issues to cause a denial of service condition or the execution of arbitrary code with system privileges. (CVE-2017-7022, CVE-2017-7024, CVE-2017-7026)\n\n - Multiple memory corruption issues exist in the kernel due to improper validation of input. A local attacker can exploit these issues to cause a denial of service condition or the execution of arbitrary code with kernel privileges. (CVE-2017-7023, CVE-2017-7025, CVE-2017-7027, CVE-2017-7069)\n\n - Multiple unspecified flaws exist in the kernel due to a failure to properly sanitize input. A local attacker can exploit these issues, via a specially crafted application, to disclose restricted memory.\n (CVE-2017-7028, CVE-2017-7029)\n\n - Multiple cross-site scripting (XSS) vulnerabilities exist in the WebKit component in the DOMParser due to improper validation of user-supplied input before returning it to users. An unauthenticated, remote attacker can exploit these issue, via a specially crafted URL, to execute arbitrary script code in a user's browser session. (CVE-2017-7038, CVE-2017-7059)\n\n - A memory corruption issue exists in the libxpc component due to improper validation of input. A local attacker can exploit this issue, via a specifically crafted application, to cause a denial of service condition or the execution of arbitrary code with system privileges.\n (CVE-2017-7047)\n\n - An information disclosure vulnerability exists due to the device displaying notifications on the lock screen even when disabled. A local attacker can exploit this to gain potentially sensitive information. (CVE-2017-7058)\n\n - A denial of service vulnerability exists in Safari printing when handling a specially crafted web page that results in creating an infinite number of print dialogs.\n An unauthenticated, remote attacker can exploit this to cause a user to believe that the browser has locked up. (CVE-2017-7060)\n\n - A buffer overflow condition exists in the Contacts component due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-7062)\n\n - A denial of service vulnerability exists in the Messages component due to improper handling of memory. An unauthenticated, remote attacker can exploit this to consume excessive resources, resulting in an unexpected application termination. (CVE-2017-7063)\n\n - An unspecified memory initialization issue exists in Webkit. A local attacker can exploit this, via a specially crafted application, to disclose the contents of restricted memory. (CVE-2017-7064)\n\n - A buffer overflow condition exists in the libarchive component due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, via a specially crafted archive file, to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-7068)\n\n - A memory corruption issue exists in the Telephony component due to improper validation of user-supplied input. A man-in-the-middle attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-8248)\n\n - A memory corruption issue exists in the Broadcom BCM43xx family Wi-Fi Chips component that allows an unauthenticated, remote attacker to execute arbitrary code. (CVE-2017-9417)", "published": "2017-07-25T00:00:00", "modified": "2021-07-12T00:00:00", "cvss": {"score": 10, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {}, "cvss3": {"score": 9.8, "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "href": "https://www.tenable.com/plugins/nessus/101953", "reporter": "This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["https://support.apple.com/en-us/HT207923", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7025", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7046", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9417", "https://www.zerodayinitiative.com/advisories/ZDI-17-489/", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7009", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7069", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7060", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7018", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7027", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7042", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7022", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7026", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7043", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7008", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7038", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7062", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7063", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7030", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7047", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7064", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7068", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7034", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7041", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7056", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7058", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7010", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7013", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8248", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7039", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7048", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7028", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7055", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7011", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7023", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7020", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7052", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7006", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7007", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7040", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2517", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7029", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7049", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7061", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7019", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7024", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7059", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7012", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7037"], "cvelist": ["CVE-2017-2517", "CVE-2017-7006", "CVE-2017-7007", "CVE-2017-7008", "CVE-2017-7009", "CVE-2017-7010", "CVE-2017-7011", "CVE-2017-7012", "CVE-2017-7013", "CVE-2017-7018", "CVE-2017-7019", "CVE-2017-7020", "CVE-2017-7022", "CVE-2017-7023", "CVE-2017-7024", "CVE-2017-7025", "CVE-2017-7026", "CVE-2017-7027", "CVE-2017-7028", "CVE-2017-7029", "CVE-2017-7030", "CVE-2017-7034", "CVE-2017-7037", "CVE-2017-7038", "CVE-2017-7039", "CVE-2017-7040", "CVE-2017-7041", "CVE-2017-7042", "CVE-2017-7043", "CVE-2017-7046", "CVE-2017-7047", "CVE-2017-7048", "CVE-2017-7049", "CVE-2017-7052", "CVE-2017-7055", "CVE-2017-7056", "CVE-2017-7058", "CVE-2017-7059", "CVE-2017-7060", "CVE-2017-7061", "CVE-2017-7062", "CVE-2017-7063", "CVE-2017-7064", "CVE-2017-7068", "CVE-2017-7069", "CVE-2017-8248", "CVE-2017-9417"], "immutableFields": [], "lastseen": "2021-08-11T13:57:53", "history": [], "viewCount": 0, "enchantments": {"dependencies": {"references": [{"type": "nessus", "idList": ["MACOS_ITUNES_12_6_2.NASL", "700166.PRM", "ITUNES_12_6_2_BANNER.NASL", "FREEBSD_PKG_0F66B901715C11E7AD1FBCAEC565249C.NASL", "ITUNES_12_6_2.NASL", "GENTOO_GLSA-201710-14.NASL", "700167.PRM", "MACOSX_SAFARI10_1_2.NASL", "700169.PRM", "700168.PRM"]}, {"type": "apple", "idList": ["APPLE:HT207925", "APPLE:HT207921", "APPLE:HT207924", "APPLE:HT207928", "APPLE:HT207927", "APPLE:HT207923"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310873200", "OPENVAS:1361412562310811251", "OPENVAS:1361412562310873180", "OPENVAS:1361412562310811252", "OPENVAS:1361412562310843266", "OPENVAS:1361412562310811538", "OPENVAS:1361412562310873226", "OPENVAS:1361412562310811535"]}, {"type": "freebsd", "idList": ["0F66B901-715C-11E7-AD1F-BCAEC565249C"]}, {"type": "kaspersky", "idList": ["KLA11075"]}, {"type": "gentoo", "idList": ["GLSA-201710-14"]}, {"type": "fedora", "idList": ["FEDORA:417B06017118", "FEDORA:D681D609273A", "FEDORA:33FB9639A184"]}, {"type": "archlinux", "idList": ["ASA-201707-25"]}, {"type": "ubuntu", "idList": ["USN-3376-1"]}, {"type": "threatpost", "idList": ["THREATPOST:60D5DA46BF733084F46AB656BE8CC259"]}, {"type": "cve", "idList": ["CVE-2017-8248", "CVE-2017-7058", "CVE-2017-7025", "CVE-2017-7022", "CVE-2017-7007", "CVE-2017-7008", "CVE-2017-7009", "CVE-2017-7028", "CVE-2017-7023", "CVE-2017-7029"]}, {"type": "android", "idList": ["ANDROID:CVE-2017-9417", "ANDROID:CVE-2017-8248"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2017-7049", "UB:CVE-2017-7034", "UB:CVE-2017-7037", "UB:CVE-2017-7038", "UB:CVE-2017-7013", "UB:CVE-2017-7019", "UB:CVE-2017-7010", "UB:CVE-2017-7020", "UB:CVE-2017-7011", "UB:CVE-2017-7006"]}, {"type": "zdi", "idList": ["ZDI-17-489"]}], "modified": "2021-08-11T13:57:53", "rev": 2}, "score": {"value": 7.3, "vector": "NONE", "modified": "2021-08-11T13:57:53", "rev": 2}}, "objectVersion": "1.6", "pluginID": "101953", "sourceData": "Binary data apple_ios_1033_check.nbin", "naslFamily": "Mobile Devices", "cpe": ["cpe:/o:apple:iphone_os"], "solution": "Upgrade to Apple iOS version 10.3.3 or later.", "nessusSeverity": "", "cvssScoreSource": "CVE-2017-8248", "vpr": {"risk factor": "High", "score": "7.4"}, "exploitAvailable": true, "exploitEase": "Exploits are available", "patchPublicationDate": "2017-07-19T00:00:00", "vulnerabilityPublicationDate": "2017-06-02T00:00:00", "exploitableWith": []}, "lastseen": "2021-08-11T13:57:53", "differentElements": ["nessusSeverity"], "edition": 1}, {"bulletin": {"id": "APPLE_IOS_1033_CHECK.NBIN", "hash": "748cfdcdb19f4fce41957a9865f0cec8", "type": "nessus", "bulletinFamily": "scanner", "title": "Apple iOS < 10.3.3 Multiple Vulnerabilities", "description": "The version of Apple iOS running on the mobile device is prior to 10.3.3. It is, therefore, affected by multiple vulnerabilities :\n\n - A flaw exists in Safari due to inconsistent user interface behavior. An unauthenticated, remote attacker can exploit this, via a malicious website, to spoof the address bar. (CVE-2017-2517)\n\n - An information disclosure vulnerability exists in the WebKit component due to improper handling of SVG filters. An unauthenticated, remote attacker can exploit this, via a timing side-channel attack, to disclose sensitive cross-domain information. (CVE-2017-7006)\n\n - A denial of service vulnerability exists in the EventKitUI component that allows an unauthenticated, remote attacker to exhaust available resources, causing an application to terminate. (CVE-2017-7007)\n\n - A remote code execution vulnerability exists in the CoreAudio component due to improper validation of user-supplied input when handling movie files. An unauthenticated, remote attacker can exploit this, by convincing a user to play a specially crafted movie file, to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-7008)\n\n - A memory corruption issue exists in the IOUSBFamily component due to improper validation of user-supplied input. A local attacker can exploit this, via a specially crafted application, to cause a denial of service condition or the execution of arbitrary code.\n (CVE-2017-7009)\n\n - Multiple out-of-bounds read errors exist in the libxml2 component due to improper handling of specially crafted XML documents. An unauthenticated, remote attacker can exploit these to disclose user information.\n (CVE-2017-7010, CVE-2017-7013)\n\n - A unspecified flaw exists in the Webkit component that allows an unauthenticated, remote attacker to spoof the address bar via a malicious website. (CVE-2017-7011)\n\n - Multiple memory corruption issues exist in the Webkit Web Inspector component due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit these, via a specially crafted web page, to corrupt memory, resulting in the execution of arbitrary code. (CVE-2017-7012)\n\n - Multiple memory corruption issues exist in the WebKit component due to improper validation of input. An unauthenticated, remote attacker can exploit these issues, via a specially crafted web page, to execute arbitrary code. (CVE-2017-7018, CVE-2017-7020, CVE-2017-7030, CVE-2017-7034, CVE-2017-7037, CVE-2017-7039, CVE-2017-7040, CVE-2017-7041, CVE-2017-7042, CVE-2017-7043, CVE-2017-7046, CVE-2017-7048, CVE-2017-7049, CVE-2017-7052, CVE-2017-7055, CVE-2017-7056, CVE-2017-7061)\n\n - A memory corruption issue exists in the 'WebKit Page Loading' component due to improper validation of input.\n An unauthenticated, remote attacker can exploit this, via a specially crafted web page, to execute arbitrary code. (CVE-2017-7019)\n\n - Multiple memory corruption issues exist in the kernel due to improper validation of input. A local attacker can exploit these issues to cause a denial of service condition or the execution of arbitrary code with system privileges. (CVE-2017-7022, CVE-2017-7024, CVE-2017-7026)\n\n - Multiple memory corruption issues exist in the kernel due to improper validation of input. A local attacker can exploit these issues to cause a denial of service condition or the execution of arbitrary code with kernel privileges. (CVE-2017-7023, CVE-2017-7025, CVE-2017-7027, CVE-2017-7069)\n\n - Multiple unspecified flaws exist in the kernel due to a failure to properly sanitize input. A local attacker can exploit these issues, via a specially crafted application, to disclose restricted memory.\n (CVE-2017-7028, CVE-2017-7029)\n\n - Multiple cross-site scripting (XSS) vulnerabilities exist in the WebKit component in the DOMParser due to improper validation of user-supplied input before returning it to users. An unauthenticated, remote attacker can exploit these issue, via a specially crafted URL, to execute arbitrary script code in a user's browser session. (CVE-2017-7038, CVE-2017-7059)\n\n - A memory corruption issue exists in the libxpc component due to improper validation of input. A local attacker can exploit this issue, via a specifically crafted application, to cause a denial of service condition or the execution of arbitrary code with system privileges.\n (CVE-2017-7047)\n\n - An information disclosure vulnerability exists due to the device displaying notifications on the lock screen even when disabled. A local attacker can exploit this to gain potentially sensitive information. (CVE-2017-7058)\n\n - A denial of service vulnerability exists in Safari printing when handling a specially crafted web page that results in creating an infinite number of print dialogs.\n An unauthenticated, remote attacker can exploit this to cause a user to believe that the browser has locked up. (CVE-2017-7060)\n\n - A buffer overflow condition exists in the Contacts component due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-7062)\n\n - A denial of service vulnerability exists in the Messages component due to improper handling of memory. An unauthenticated, remote attacker can exploit this to consume excessive resources, resulting in an unexpected application termination. (CVE-2017-7063)\n\n - An unspecified memory initialization issue exists in Webkit. A local attacker can exploit this, via a specially crafted application, to disclose the contents of restricted memory. (CVE-2017-7064)\n\n - A buffer overflow condition exists in the libarchive component due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, via a specially crafted archive file, to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-7068)\n\n - A memory corruption issue exists in the Telephony component due to improper validation of user-supplied input. A man-in-the-middle attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-8248)\n\n - A memory corruption issue exists in the Broadcom BCM43xx family Wi-Fi Chips component that allows an unauthenticated, remote attacker to execute arbitrary code. (CVE-2017-9417)", "published": "2017-07-25T00:00:00", "modified": "2021-07-12T00:00:00", "cvss": {"score": 10, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {}, "cvss3": {"score": 9.8, "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "href": "https://www.tenable.com/plugins/nessus/101953", "reporter": "This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7061", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7008", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8248", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7025", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7052", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7024", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7020", "https://support.apple.com/en-us/HT207923", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7069", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7046", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7038", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7063", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7011", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7068", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7010", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7022", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7062", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7056", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7023", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7013", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7039", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7026", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7018", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7007", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7049", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7060", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7037", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7055", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7042", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7041", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7048", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7027", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7040", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7059", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7043", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7034", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7064", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7019", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7030", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7058", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7012", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7006", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2517", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7047", "https://www.zerodayinitiative.com/advisories/ZDI-17-489/", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7009", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9417", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7028", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7029"], "cvelist": ["CVE-2017-2517", "CVE-2017-7006", "CVE-2017-7007", "CVE-2017-7008", "CVE-2017-7009", "CVE-2017-7010", "CVE-2017-7011", "CVE-2017-7012", "CVE-2017-7013", "CVE-2017-7018", "CVE-2017-7019", "CVE-2017-7020", "CVE-2017-7022", "CVE-2017-7023", "CVE-2017-7024", "CVE-2017-7025", "CVE-2017-7026", "CVE-2017-7027", "CVE-2017-7028", "CVE-2017-7029", "CVE-2017-7030", "CVE-2017-7034", "CVE-2017-7037", "CVE-2017-7038", "CVE-2017-7039", "CVE-2017-7040", "CVE-2017-7041", "CVE-2017-7042", "CVE-2017-7043", "CVE-2017-7046", "CVE-2017-7047", "CVE-2017-7048", "CVE-2017-7049", "CVE-2017-7052", "CVE-2017-7055", "CVE-2017-7056", "CVE-2017-7058", "CVE-2017-7059", "CVE-2017-7060", "CVE-2017-7061", "CVE-2017-7062", "CVE-2017-7063", "CVE-2017-7064", "CVE-2017-7068", "CVE-2017-7069", "CVE-2017-8248", "CVE-2017-9417"], "immutableFields": [], "lastseen": "2021-08-19T12:35:46", "history": [], "viewCount": 0, "enchantments": {"dependencies": {"references": [{"type": "nessus", "idList": ["GENTOO_GLSA-201710-14.NASL", "700166.PRM", "700169.PRM", "FREEBSD_PKG_0F66B901715C11E7AD1FBCAEC565249C.NASL", "ITUNES_12_6_2_BANNER.NASL", "MACOS_ITUNES_12_6_2.NASL", "MACOSX_SAFARI10_1_2.NASL", "ITUNES_12_6_2.NASL", "700167.PRM", "700168.PRM"]}, {"type": "apple", "idList": ["APPLE:HT207923", "APPLE:HT207924", "APPLE:HT207921", "APPLE:HT207925", "APPLE:HT207927", "APPLE:HT207928"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310811252", "OPENVAS:1361412562310811535", "OPENVAS:1361412562310873180", "OPENVAS:1361412562310811538", "OPENVAS:1361412562310873226", "OPENVAS:1361412562310873200", "OPENVAS:1361412562310811251", "OPENVAS:1361412562310843266"]}, {"type": "freebsd", "idList": ["0F66B901-715C-11E7-AD1F-BCAEC565249C"]}, {"type": "kaspersky", "idList": ["KLA11075"]}, {"type": "gentoo", "idList": ["GLSA-201710-14"]}, {"type": "fedora", "idList": ["FEDORA:33FB9639A184", "FEDORA:417B06017118", "FEDORA:D681D609273A"]}, {"type": "archlinux", "idList": ["ASA-201707-25"]}, {"type": "ubuntu", "idList": ["USN-3376-1"]}, {"type": "threatpost", "idList": ["THREATPOST:60D5DA46BF733084F46AB656BE8CC259"]}, {"type": "cve", "idList": ["CVE-2017-7058", "CVE-2017-7023", "CVE-2017-7029", "CVE-2017-7008", "CVE-2017-7022", "CVE-2017-7024", "CVE-2017-7028", "CVE-2017-7007", "CVE-2017-7025", "CVE-2017-8248"]}, {"type": "android", "idList": ["ANDROID:CVE-2017-9417", "ANDROID:CVE-2017-8248"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2017-7010", "UB:CVE-2017-7037", "UB:CVE-2017-7006", "UB:CVE-2017-7049", "UB:CVE-2017-7019", "UB:CVE-2017-7034", "UB:CVE-2017-7020", "UB:CVE-2017-7038", "UB:CVE-2017-7011", "UB:CVE-2017-7013"]}, {"type": "zdi", "idList": ["ZDI-17-489"]}], "modified": "2021-08-19T12:35:46", "rev": 2}, "score": {"value": 7.3, "vector": "NONE", "modified": "2021-08-19T12:35:46", "rev": 2}}, "objectVersion": "1.6", "pluginID": "101953", "sourceData": "Binary data apple_ios_1033_check.nbin", "naslFamily": "Mobile Devices", "cpe": ["cpe:/o:apple:iphone_os"], "solution": "Upgrade to Apple iOS version 10.3.3 or later.", "nessusSeverity": "Critical", "cvssScoreSource": "CVE-2017-8248", "vpr": {"risk factor": "High", "score": "7.4"}, "exploitAvailable": true, "exploitEase": "Exploits are available", "patchPublicationDate": "2017-07-19T00:00:00", "vulnerabilityPublicationDate": "2017-06-02T00:00:00", "exploitableWith": []}, "lastseen": "2021-08-19T12:35:46", "differentElements": ["vpr"], "edition": 2}, {"bulletin": {"id": "APPLE_IOS_1033_CHECK.NBIN", "hash": "6166aa240824e97cd0896507ca154738", "type": "nessus", "bulletinFamily": "scanner", "title": "Apple iOS < 10.3.3 Multiple Vulnerabilities", "description": "The version of Apple iOS running on the mobile device is prior to 10.3.3. It is, therefore, affected by multiple vulnerabilities :\n\n - A flaw exists in Safari due to inconsistent user interface behavior. An unauthenticated, remote attacker can exploit this, via a malicious website, to spoof the address bar. (CVE-2017-2517)\n\n - An information disclosure vulnerability exists in the WebKit component due to improper handling of SVG filters. An unauthenticated, remote attacker can exploit this, via a timing side-channel attack, to disclose sensitive cross-domain information. (CVE-2017-7006)\n\n - A denial of service vulnerability exists in the EventKitUI component that allows an unauthenticated, remote attacker to exhaust available resources, causing an application to terminate. (CVE-2017-7007)\n\n - A remote code execution vulnerability exists in the CoreAudio component due to improper validation of user-supplied input when handling movie files. An unauthenticated, remote attacker can exploit this, by convincing a user to play a specially crafted movie file, to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-7008)\n\n - A memory corruption issue exists in the IOUSBFamily component due to improper validation of user-supplied input. A local attacker can exploit this, via a specially crafted application, to cause a denial of service condition or the execution of arbitrary code.\n (CVE-2017-7009)\n\n - Multiple out-of-bounds read errors exist in the libxml2 component due to improper handling of specially crafted XML documents. An unauthenticated, remote attacker can exploit these to disclose user information.\n (CVE-2017-7010, CVE-2017-7013)\n\n - A unspecified flaw exists in the Webkit component that allows an unauthenticated, remote attacker to spoof the address bar via a malicious website. (CVE-2017-7011)\n\n - Multiple memory corruption issues exist in the Webkit Web Inspector component due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit these, via a specially crafted web page, to corrupt memory, resulting in the execution of arbitrary code. (CVE-2017-7012)\n\n - Multiple memory corruption issues exist in the WebKit component due to improper validation of input. An unauthenticated, remote attacker can exploit these issues, via a specially crafted web page, to execute arbitrary code. (CVE-2017-7018, CVE-2017-7020, CVE-2017-7030, CVE-2017-7034, CVE-2017-7037, CVE-2017-7039, CVE-2017-7040, CVE-2017-7041, CVE-2017-7042, CVE-2017-7043, CVE-2017-7046, CVE-2017-7048, CVE-2017-7049, CVE-2017-7052, CVE-2017-7055, CVE-2017-7056, CVE-2017-7061)\n\n - A memory corruption issue exists in the 'WebKit Page Loading' component due to improper validation of input.\n An unauthenticated, remote attacker can exploit this, via a specially crafted web page, to execute arbitrary code. (CVE-2017-7019)\n\n - Multiple memory corruption issues exist in the kernel due to improper validation of input. A local attacker can exploit these issues to cause a denial of service condition or the execution of arbitrary code with system privileges. (CVE-2017-7022, CVE-2017-7024, CVE-2017-7026)\n\n - Multiple memory corruption issues exist in the kernel due to improper validation of input. A local attacker can exploit these issues to cause a denial of service condition or the execution of arbitrary code with kernel privileges. (CVE-2017-7023, CVE-2017-7025, CVE-2017-7027, CVE-2017-7069)\n\n - Multiple unspecified flaws exist in the kernel due to a failure to properly sanitize input. A local attacker can exploit these issues, via a specially crafted application, to disclose restricted memory.\n (CVE-2017-7028, CVE-2017-7029)\n\n - Multiple cross-site scripting (XSS) vulnerabilities exist in the WebKit component in the DOMParser due to improper validation of user-supplied input before returning it to users. An unauthenticated, remote attacker can exploit these issue, via a specially crafted URL, to execute arbitrary script code in a user's browser session. (CVE-2017-7038, CVE-2017-7059)\n\n - A memory corruption issue exists in the libxpc component due to improper validation of input. A local attacker can exploit this issue, via a specifically crafted application, to cause a denial of service condition or the execution of arbitrary code with system privileges.\n (CVE-2017-7047)\n\n - An information disclosure vulnerability exists due to the device displaying notifications on the lock screen even when disabled. A local attacker can exploit this to gain potentially sensitive information. (CVE-2017-7058)\n\n - A denial of service vulnerability exists in Safari printing when handling a specially crafted web page that results in creating an infinite number of print dialogs.\n An unauthenticated, remote attacker can exploit this to cause a user to believe that the browser has locked up. (CVE-2017-7060)\n\n - A buffer overflow condition exists in the Contacts component due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-7062)\n\n - A denial of service vulnerability exists in the Messages component due to improper handling of memory. An unauthenticated, remote attacker can exploit this to consume excessive resources, resulting in an unexpected application termination. (CVE-2017-7063)\n\n - An unspecified memory initialization issue exists in Webkit. A local attacker can exploit this, via a specially crafted application, to disclose the contents of restricted memory. (CVE-2017-7064)\n\n - A buffer overflow condition exists in the libarchive component due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, via a specially crafted archive file, to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-7068)\n\n - A memory corruption issue exists in the Telephony component due to improper validation of user-supplied input. A man-in-the-middle attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-8248)\n\n - A memory corruption issue exists in the Broadcom BCM43xx family Wi-Fi Chips component that allows an unauthenticated, remote attacker to execute arbitrary code. (CVE-2017-9417)", "published": "2017-07-25T00:00:00", "modified": "2021-07-12T00:00:00", "cvss": {"score": 10, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {}, "cvss3": {"score": 9.8, "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "href": "https://www.tenable.com/plugins/nessus/101953", "reporter": "This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7025", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7019", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7041", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7068", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7043", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7061", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7030", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7048", "https://www.zerodayinitiative.com/advisories/ZDI-17-489/", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8248", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7010", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7037", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7055", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7056", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7026", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7047", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9417", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7012", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7069", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7049", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7059", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7024", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7008", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7027", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7023", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7040", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7038", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7060", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7062", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7018", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7011", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7042", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7028", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7009", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7013", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7022", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7020", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7046", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7058", "https://support.apple.com/en-us/HT207923", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7063", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7052", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2517", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7034", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7029", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7007", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7039", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7006", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7064"], "cvelist": ["CVE-2017-2517", "CVE-2017-7006", "CVE-2017-7007", "CVE-2017-7008", "CVE-2017-7009", "CVE-2017-7010", "CVE-2017-7011", "CVE-2017-7012", "CVE-2017-7013", "CVE-2017-7018", "CVE-2017-7019", "CVE-2017-7020", "CVE-2017-7022", "CVE-2017-7023", "CVE-2017-7024", "CVE-2017-7025", "CVE-2017-7026", "CVE-2017-7027", "CVE-2017-7028", "CVE-2017-7029", "CVE-2017-7030", "CVE-2017-7034", "CVE-2017-7037", "CVE-2017-7038", "CVE-2017-7039", "CVE-2017-7040", "CVE-2017-7041", "CVE-2017-7042", "CVE-2017-7043", "CVE-2017-7046", "CVE-2017-7047", "CVE-2017-7048", "CVE-2017-7049", "CVE-2017-7052", "CVE-2017-7055", "CVE-2017-7056", "CVE-2017-7058", "CVE-2017-7059", "CVE-2017-7060", "CVE-2017-7061", "CVE-2017-7062", "CVE-2017-7063", "CVE-2017-7064", "CVE-2017-7068", "CVE-2017-7069", "CVE-2017-8248", "CVE-2017-9417"], "immutableFields": [], "lastseen": "2021-08-26T00:26:58", "history": [], "viewCount": 0, "enchantments": {"dependencies": {"references": [{"type": "nessus", "idList": ["700167.PRM", "ITUNES_12_6_2.NASL", "MACOS_ITUNES_12_6_2.NASL", "700169.PRM", "700168.PRM", "ITUNES_12_6_2_BANNER.NASL", "700166.PRM", "FREEBSD_PKG_0F66B901715C11E7AD1FBCAEC565249C.NASL", "MACOSX_SAFARI10_1_2.NASL", "GENTOO_GLSA-201710-14.NASL"]}, {"type": "apple", "idList": ["APPLE:HT207927", "APPLE:HT207923", "APPLE:HT207928", "APPLE:HT207925", "APPLE:HT207924", "APPLE:HT207921"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310873226", "OPENVAS:1361412562310843266", "OPENVAS:1361412562310811251", "OPENVAS:1361412562310811535", "OPENVAS:1361412562310873200", "OPENVAS:1361412562310873180", "OPENVAS:1361412562310811252", "OPENVAS:1361412562310811538"]}, {"type": "freebsd", "idList": ["0F66B901-715C-11E7-AD1F-BCAEC565249C"]}, {"type": "kaspersky", "idList": ["KLA11075"]}, {"type": "gentoo", "idList": ["GLSA-201710-14"]}, {"type": "fedora", "idList": ["FEDORA:D681D609273A", "FEDORA:417B06017118", "FEDORA:33FB9639A184"]}, {"type": "archlinux", "idList": ["ASA-201707-25"]}, {"type": "ubuntu", "idList": ["USN-3376-1"]}, {"type": "threatpost", "idList": ["THREATPOST:60D5DA46BF733084F46AB656BE8CC259"]}, {"type": "cve", "idList": ["CVE-2017-7025", "CVE-2017-8248", "CVE-2017-7009", "CVE-2017-7024", "CVE-2017-7058", "CVE-2017-7008", "CVE-2017-7023", "CVE-2017-7029", "CVE-2017-7028", "CVE-2017-7007"]}, {"type": "android", "idList": ["ANDROID:CVE-2017-9417", "ANDROID:CVE-2017-8248"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2017-7013", "UB:CVE-2017-7034", "UB:CVE-2017-7038", "UB:CVE-2017-7019", "UB:CVE-2017-7011", "UB:CVE-2017-7006", "UB:CVE-2017-7012", "UB:CVE-2017-7037", "UB:CVE-2017-7010", "UB:CVE-2017-7049"]}, {"type": "zdi", "idList": ["ZDI-17-489"]}], "modified": "2021-08-26T00:26:58", "rev": 2}, "score": {"value": 7.3, "vector": "NONE", "modified": "2021-08-26T00:26:58", "rev": 2}}, "objectVersion": "1.6", "pluginID": "101953", "sourceData": "Binary data apple_ios_1033_check.nbin", "naslFamily": "Mobile Devices", "cpe": ["cpe:/o:apple:iphone_os"], "solution": "Upgrade to Apple iOS version 10.3.3 or later.", "nessusSeverity": "Critical", "cvssScoreSource": "CVE-2017-8248", "vpr": {"risk factor": "Critical", "score": "9"}, "exploitAvailable": true, "exploitEase": "Exploits are available", "patchPublicationDate": "2017-07-19T00:00:00", "vulnerabilityPublicationDate": "2017-06-02T00:00:00", "exploitableWith": []}, "lastseen": "2021-08-26T00:26:58", "differentElements": ["vpr"], "edition": 3}, {"bulletin": {"id": "APPLE_IOS_1033_CHECK.NBIN", "hash": "e7f4fba3d422682bbf04e635bc78171a", "type": "nessus", "bulletinFamily": "scanner", "title": "Apple iOS < 10.3.3 Multiple Vulnerabilities", "description": "The version of Apple iOS running on the mobile device is prior to 10.3.3. It is, therefore, affected by multiple vulnerabilities :\n\n - A flaw exists in Safari due to inconsistent user interface behavior. An unauthenticated, remote attacker can exploit this, via a malicious website, to spoof the address bar. (CVE-2017-2517)\n\n - An information disclosure vulnerability exists in the WebKit component due to improper handling of SVG filters. An unauthenticated, remote attacker can exploit this, via a timing side-channel attack, to disclose sensitive cross-domain information. (CVE-2017-7006)\n\n - A denial of service vulnerability exists in the EventKitUI component that allows an unauthenticated, remote attacker to exhaust available resources, causing an application to terminate. (CVE-2017-7007)\n\n - A remote code execution vulnerability exists in the CoreAudio component due to improper validation of user-supplied input when handling movie files. An unauthenticated, remote attacker can exploit this, by convincing a user to play a specially crafted movie file, to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-7008)\n\n - A memory corruption issue exists in the IOUSBFamily component due to improper validation of user-supplied input. A local attacker can exploit this, via a specially crafted application, to cause a denial of service condition or the execution of arbitrary code.\n (CVE-2017-7009)\n\n - Multiple out-of-bounds read errors exist in the libxml2 component due to improper handling of specially crafted XML documents. An unauthenticated, remote attacker can exploit these to disclose user information.\n (CVE-2017-7010, CVE-2017-7013)\n\n - A unspecified flaw exists in the Webkit component that allows an unauthenticated, remote attacker to spoof the address bar via a malicious website. (CVE-2017-7011)\n\n - Multiple memory corruption issues exist in the Webkit Web Inspector component due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit these, via a specially crafted web page, to corrupt memory, resulting in the execution of arbitrary code. (CVE-2017-7012)\n\n - Multiple memory corruption issues exist in the WebKit component due to improper validation of input. An unauthenticated, remote attacker can exploit these issues, via a specially crafted web page, to execute arbitrary code. (CVE-2017-7018, CVE-2017-7020, CVE-2017-7030, CVE-2017-7034, CVE-2017-7037, CVE-2017-7039, CVE-2017-7040, CVE-2017-7041, CVE-2017-7042, CVE-2017-7043, CVE-2017-7046, CVE-2017-7048, CVE-2017-7049, CVE-2017-7052, CVE-2017-7055, CVE-2017-7056, CVE-2017-7061)\n\n - A memory corruption issue exists in the 'WebKit Page Loading' component due to improper validation of input.\n An unauthenticated, remote attacker can exploit this, via a specially crafted web page, to execute arbitrary code. (CVE-2017-7019)\n\n - Multiple memory corruption issues exist in the kernel due to improper validation of input. A local attacker can exploit these issues to cause a denial of service condition or the execution of arbitrary code with system privileges. (CVE-2017-7022, CVE-2017-7024, CVE-2017-7026)\n\n - Multiple memory corruption issues exist in the kernel due to improper validation of input. A local attacker can exploit these issues to cause a denial of service condition or the execution of arbitrary code with kernel privileges. (CVE-2017-7023, CVE-2017-7025, CVE-2017-7027, CVE-2017-7069)\n\n - Multiple unspecified flaws exist in the kernel due to a failure to properly sanitize input. A local attacker can exploit these issues, via a specially crafted application, to disclose restricted memory.\n (CVE-2017-7028, CVE-2017-7029)\n\n - Multiple cross-site scripting (XSS) vulnerabilities exist in the WebKit component in the DOMParser due to improper validation of user-supplied input before returning it to users. An unauthenticated, remote attacker can exploit these issue, via a specially crafted URL, to execute arbitrary script code in a user's browser session. (CVE-2017-7038, CVE-2017-7059)\n\n - A memory corruption issue exists in the libxpc component due to improper validation of input. A local attacker can exploit this issue, via a specifically crafted application, to cause a denial of service condition or the execution of arbitrary code with system privileges.\n (CVE-2017-7047)\n\n - An information disclosure vulnerability exists due to the device displaying notifications on the lock screen even when disabled. A local attacker can exploit this to gain potentially sensitive information. (CVE-2017-7058)\n\n - A denial of service vulnerability exists in Safari printing when handling a specially crafted web page that results in creating an infinite number of print dialogs.\n An unauthenticated, remote attacker can exploit this to cause a user to believe that the browser has locked up. (CVE-2017-7060)\n\n - A buffer overflow condition exists in the Contacts component due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-7062)\n\n - A denial of service vulnerability exists in the Messages component due to improper handling of memory. An unauthenticated, remote attacker can exploit this to consume excessive resources, resulting in an unexpected application termination. (CVE-2017-7063)\n\n - An unspecified memory initialization issue exists in Webkit. A local attacker can exploit this, via a specially crafted application, to disclose the contents of restricted memory. (CVE-2017-7064)\n\n - A buffer overflow condition exists in the libarchive component due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, via a specially crafted archive file, to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-7068)\n\n - A memory corruption issue exists in the Telephony component due to improper validation of user-supplied input. A man-in-the-middle attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-8248)\n\n - A memory corruption issue exists in the Broadcom BCM43xx family Wi-Fi Chips component that allows an unauthenticated, remote attacker to execute arbitrary code. (CVE-2017-9417)", "published": "2017-07-25T00:00:00", "modified": "2021-07-12T00:00:00", "cvss": {"score": 10, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {}, "cvss3": {"score": 9.8, "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "href": "https://www.tenable.com/plugins/nessus/101953", "reporter": "This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7024", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7064", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7029", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7046", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8248", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7039", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7012", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7008", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7025", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7060", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7069", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7048", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7049", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7019", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2517", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7056", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7058", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7006", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7018", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7042", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7030", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7034", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7009", "https://www.zerodayinitiative.com/advisories/ZDI-17-489/", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7020", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7043", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7028", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7026", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7041", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7010", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7022", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7068", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7055", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7047", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7038", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7037", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7023", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7007", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7059", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7063", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9417", "https://support.apple.com/en-us/HT207923", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7027", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7052", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7040", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7061", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7062", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7011", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7013"], "cvelist": ["CVE-2017-2517", "CVE-2017-7006", "CVE-2017-7007", "CVE-2017-7008", "CVE-2017-7009", "CVE-2017-7010", "CVE-2017-7011", "CVE-2017-7012", "CVE-2017-7013", "CVE-2017-7018", "CVE-2017-7019", "CVE-2017-7020", "CVE-2017-7022", "CVE-2017-7023", "CVE-2017-7024", "CVE-2017-7025", "CVE-2017-7026", "CVE-2017-7027", "CVE-2017-7028", "CVE-2017-7029", "CVE-2017-7030", "CVE-2017-7034", "CVE-2017-7037", "CVE-2017-7038", "CVE-2017-7039", "CVE-2017-7040", "CVE-2017-7041", "CVE-2017-7042", "CVE-2017-7043", "CVE-2017-7046", "CVE-2017-7047", "CVE-2017-7048", "CVE-2017-7049", "CVE-2017-7052", "CVE-2017-7055", "CVE-2017-7056", "CVE-2017-7058", "CVE-2017-7059", "CVE-2017-7060", "CVE-2017-7061", "CVE-2017-7062", "CVE-2017-7063", "CVE-2017-7064", "CVE-2017-7068", "CVE-2017-7069", "CVE-2017-8248", "CVE-2017-9417"], "immutableFields": [], "lastseen": "2021-08-29T01:08:36", "history": [], "viewCount": 0, "enchantments": {"dependencies": {"references": [{"type": "nessus", "idList": ["FREEBSD_PKG_0F66B901715C11E7AD1FBCAEC565249C.NASL", "MACOSX_SAFARI10_1_2.NASL", "700166.PRM", "ITUNES_12_6_2_BANNER.NASL", "700169.PRM", "700168.PRM", "700167.PRM", "MACOS_ITUNES_12_6_2.NASL", "GENTOO_GLSA-201710-14.NASL", "ITUNES_12_6_2.NASL"]}, {"type": "apple", "idList": ["APPLE:HT207928", "APPLE:HT207924", "APPLE:HT207923", "APPLE:HT207925", "APPLE:HT207921", "APPLE:HT207927"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310873226", "OPENVAS:1361412562310811251", "OPENVAS:1361412562310811538", "OPENVAS:1361412562310811252", "OPENVAS:1361412562310873200", "OPENVAS:1361412562310873180", "OPENVAS:1361412562310811535", "OPENVAS:1361412562310843266"]}, {"type": "freebsd", "idList": ["0F66B901-715C-11E7-AD1F-BCAEC565249C"]}, {"type": "kaspersky", "idList": ["KLA11075"]}, {"type": "gentoo", "idList": ["GLSA-201710-14"]}, {"type": "fedora", "idList": ["FEDORA:33FB9639A184", "FEDORA:417B06017118", "FEDORA:D681D609273A"]}, {"type": "archlinux", "idList": ["ASA-201707-25"]}, {"type": "ubuntu", "idList": ["USN-3376-1"]}, {"type": "threatpost", "idList": ["THREATPOST:60D5DA46BF733084F46AB656BE8CC259"]}, {"type": "cve", "idList": ["CVE-2017-7024", "CVE-2017-7007", "CVE-2017-8248", "CVE-2017-7058", "CVE-2017-7029", "CVE-2017-7009", "CVE-2017-7008", "CVE-2017-7025", "CVE-2017-7026", "CVE-2017-7028"]}, {"type": "android", "idList": ["ANDROID:CVE-2017-8248", "ANDROID:CVE-2017-9417"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2017-7006", "UB:CVE-2017-7037", "UB:CVE-2017-7034", "UB:CVE-2017-7019", "UB:CVE-2017-7013", "UB:CVE-2017-7011", "UB:CVE-2017-7049", "UB:CVE-2017-7038", "UB:CVE-2017-7010", "UB:CVE-2017-7012"]}, {"type": "zdi", "idList": ["ZDI-17-489"]}], "modified": "2021-08-29T01:08:36", "rev": 2}, "score": {"value": 7.3, "vector": "NONE", "modified": "2021-08-29T01:08:36", "rev": 2}}, "objectVersion": "1.6", "pluginID": "101953", "sourceData": "Binary data apple_ios_1033_check.nbin", "naslFamily": "Mobile Devices", "cpe": ["cpe:/o:apple:iphone_os"], "solution": "Upgrade to Apple iOS version 10.3.3 or later.", "nessusSeverity": "Critical", "cvssScoreSource": "CVE-2017-8248", "vpr": {"risk factor": "High", "score": "8.4"}, "exploitAvailable": true, "exploitEase": "Exploits are available", "patchPublicationDate": "2017-07-19T00:00:00", "vulnerabilityPublicationDate": "2017-06-02T00:00:00", "exploitableWith": []}, "lastseen": "2021-08-29T01:08:36", "differentElements": ["vpr"], "edition": 4}, {"bulletin": {"id": "APPLE_IOS_1033_CHECK.NBIN", "hash": "6166aa240824e97cd0896507ca154738", "type": "nessus", "bulletinFamily": "scanner", "title": "Apple iOS < 10.3.3 Multiple Vulnerabilities", "description": "The version of Apple iOS running on the mobile device is prior to 10.3.3. It is, therefore, affected by multiple vulnerabilities :\n\n - A flaw exists in Safari due to inconsistent user interface behavior. An unauthenticated, remote attacker can exploit this, via a malicious website, to spoof the address bar. (CVE-2017-2517)\n\n - An information disclosure vulnerability exists in the WebKit component due to improper handling of SVG filters. An unauthenticated, remote attacker can exploit this, via a timing side-channel attack, to disclose sensitive cross-domain information. (CVE-2017-7006)\n\n - A denial of service vulnerability exists in the EventKitUI component that allows an unauthenticated, remote attacker to exhaust available resources, causing an application to terminate. (CVE-2017-7007)\n\n - A remote code execution vulnerability exists in the CoreAudio component due to improper validation of user-supplied input when handling movie files. An unauthenticated, remote attacker can exploit this, by convincing a user to play a specially crafted movie file, to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-7008)\n\n - A memory corruption issue exists in the IOUSBFamily component due to improper validation of user-supplied input. A local attacker can exploit this, via a specially crafted application, to cause a denial of service condition or the execution of arbitrary code.\n (CVE-2017-7009)\n\n - Multiple out-of-bounds read errors exist in the libxml2 component due to improper handling of specially crafted XML documents. An unauthenticated, remote attacker can exploit these to disclose user information.\n (CVE-2017-7010, CVE-2017-7013)\n\n - A unspecified flaw exists in the Webkit component that allows an unauthenticated, remote attacker to spoof the address bar via a malicious website. (CVE-2017-7011)\n\n - Multiple memory corruption issues exist in the Webkit Web Inspector component due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit these, via a specially crafted web page, to corrupt memory, resulting in the execution of arbitrary code. (CVE-2017-7012)\n\n - Multiple memory corruption issues exist in the WebKit component due to improper validation of input. An unauthenticated, remote attacker can exploit these issues, via a specially crafted web page, to execute arbitrary code. (CVE-2017-7018, CVE-2017-7020, CVE-2017-7030, CVE-2017-7034, CVE-2017-7037, CVE-2017-7039, CVE-2017-7040, CVE-2017-7041, CVE-2017-7042, CVE-2017-7043, CVE-2017-7046, CVE-2017-7048, CVE-2017-7049, CVE-2017-7052, CVE-2017-7055, CVE-2017-7056, CVE-2017-7061)\n\n - A memory corruption issue exists in the 'WebKit Page Loading' component due to improper validation of input.\n An unauthenticated, remote attacker can exploit this, via a specially crafted web page, to execute arbitrary code. (CVE-2017-7019)\n\n - Multiple memory corruption issues exist in the kernel due to improper validation of input. A local attacker can exploit these issues to cause a denial of service condition or the execution of arbitrary code with system privileges. (CVE-2017-7022, CVE-2017-7024, CVE-2017-7026)\n\n - Multiple memory corruption issues exist in the kernel due to improper validation of input. A local attacker can exploit these issues to cause a denial of service condition or the execution of arbitrary code with kernel privileges. (CVE-2017-7023, CVE-2017-7025, CVE-2017-7027, CVE-2017-7069)\n\n - Multiple unspecified flaws exist in the kernel due to a failure to properly sanitize input. A local attacker can exploit these issues, via a specially crafted application, to disclose restricted memory.\n (CVE-2017-7028, CVE-2017-7029)\n\n - Multiple cross-site scripting (XSS) vulnerabilities exist in the WebKit component in the DOMParser due to improper validation of user-supplied input before returning it to users. An unauthenticated, remote attacker can exploit these issue, via a specially crafted URL, to execute arbitrary script code in a user's browser session. (CVE-2017-7038, CVE-2017-7059)\n\n - A memory corruption issue exists in the libxpc component due to improper validation of input. A local attacker can exploit this issue, via a specifically crafted application, to cause a denial of service condition or the execution of arbitrary code with system privileges.\n (CVE-2017-7047)\n\n - An information disclosure vulnerability exists due to the device displaying notifications on the lock screen even when disabled. A local attacker can exploit this to gain potentially sensitive information. (CVE-2017-7058)\n\n - A denial of service vulnerability exists in Safari printing when handling a specially crafted web page that results in creating an infinite number of print dialogs.\n An unauthenticated, remote attacker can exploit this to cause a user to believe that the browser has locked up. (CVE-2017-7060)\n\n - A buffer overflow condition exists in the Contacts component due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-7062)\n\n - A denial of service vulnerability exists in the Messages component due to improper handling of memory. An unauthenticated, remote attacker can exploit this to consume excessive resources, resulting in an unexpected application termination. (CVE-2017-7063)\n\n - An unspecified memory initialization issue exists in Webkit. A local attacker can exploit this, via a specially crafted application, to disclose the contents of restricted memory. (CVE-2017-7064)\n\n - A buffer overflow condition exists in the libarchive component due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, via a specially crafted archive file, to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-7068)\n\n - A memory corruption issue exists in the Telephony component due to improper validation of user-supplied input. A man-in-the-middle attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-8248)\n\n - A memory corruption issue exists in the Broadcom BCM43xx family Wi-Fi Chips component that allows an unauthenticated, remote attacker to execute arbitrary code. (CVE-2017-9417)", "published": "2017-07-25T00:00:00", "modified": "2021-07-12T00:00:00", "cvss": {"score": 10, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {}, "cvss3": {"score": 9.8, "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "href": "https://www.tenable.com/plugins/nessus/101953", "reporter": "This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7049", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7040", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7059", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2517", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7023", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8248", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7060", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7025", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7026", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7055", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7022", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7013", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7061", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7068", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7048", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7024", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7020", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7008", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7047", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7034", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7019", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7028", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7030", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7062", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7009", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7018", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7006", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7046", "https://support.apple.com/en-us/HT207923", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7037", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7052", "https://www.zerodayinitiative.com/advisories/ZDI-17-489/", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7063", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7056", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7027", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7041", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7011", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7038", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7058", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7064", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9417", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7043", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7069", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7010", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7042", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7007", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7012", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7029", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7039"], "cvelist": ["CVE-2017-2517", "CVE-2017-7006", "CVE-2017-7007", "CVE-2017-7008", "CVE-2017-7009", "CVE-2017-7010", "CVE-2017-7011", "CVE-2017-7012", "CVE-2017-7013", "CVE-2017-7018", "CVE-2017-7019", "CVE-2017-7020", "CVE-2017-7022", "CVE-2017-7023", "CVE-2017-7024", "CVE-2017-7025", "CVE-2017-7026", "CVE-2017-7027", "CVE-2017-7028", "CVE-2017-7029", "CVE-2017-7030", "CVE-2017-7034", "CVE-2017-7037", "CVE-2017-7038", "CVE-2017-7039", "CVE-2017-7040", "CVE-2017-7041", "CVE-2017-7042", "CVE-2017-7043", "CVE-2017-7046", "CVE-2017-7047", "CVE-2017-7048", "CVE-2017-7049", "CVE-2017-7052", "CVE-2017-7055", "CVE-2017-7056", "CVE-2017-7058", "CVE-2017-7059", "CVE-2017-7060", "CVE-2017-7061", "CVE-2017-7062", "CVE-2017-7063", "CVE-2017-7064", "CVE-2017-7068", "CVE-2017-7069", "CVE-2017-8248", "CVE-2017-9417"], "immutableFields": [], "lastseen": "2021-09-13T02:10:06", "history": [], "viewCount": 0, "enchantments": {"dependencies": {"references": [{"type": "nessus", "idList": ["ITUNES_12_6_2_BANNER.NASL", "700166.PRM", "ITUNES_12_6_2.NASL", "MACOS_ITUNES_12_6_2.NASL", "GENTOO_GLSA-201710-14.NASL", "700168.PRM", "700169.PRM", "MACOSX_SAFARI10_1_2.NASL", "FREEBSD_PKG_0F66B901715C11E7AD1FBCAEC565249C.NASL", "700167.PRM"]}, {"type": "apple", "idList": ["APPLE:HT207921", "APPLE:HT207925", "APPLE:HT207927", "APPLE:HT207923", "APPLE:HT207928", "APPLE:HT207924"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310873200", "OPENVAS:1361412562310811535", "OPENVAS:1361412562310811251", "OPENVAS:1361412562310873226", "OPENVAS:1361412562310843266", "OPENVAS:1361412562310811538", "OPENVAS:1361412562310811252", "OPENVAS:1361412562310873180"]}, {"type": "freebsd", "idList": ["0F66B901-715C-11E7-AD1F-BCAEC565249C"]}, {"type": "kaspersky", "idList": ["KLA11075"]}, {"type": "gentoo", "idList": ["GLSA-201710-14"]}, {"type": "fedora", "idList": ["FEDORA:D681D609273A", "FEDORA:417B06017118", "FEDORA:33FB9639A184"]}, {"type": "archlinux", "idList": ["ASA-201707-25"]}, {"type": "ubuntu", "idList": ["USN-3376-1"]}, {"type": "threatpost", "idList": ["THREATPOST:60D5DA46BF733084F46AB656BE8CC259"]}, {"type": "cve", "idList": ["CVE-2017-7008", "CVE-2017-8248", "CVE-2017-7025", "CVE-2017-7029", "CVE-2017-7028", "CVE-2017-7023", "CVE-2017-7024", "CVE-2017-7006", "CVE-2017-7007", "CVE-2017-7058"]}, {"type": "android", "idList": ["ANDROID:CVE-2017-8248", "ANDROID:CVE-2017-9417"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2017-7043", "UB:CVE-2017-7038", "UB:CVE-2017-7013", "UB:CVE-2017-7049", "UB:CVE-2017-7010", "UB:CVE-2017-7011", "UB:CVE-2017-7034", "UB:CVE-2017-7019", "UB:CVE-2017-7006", "UB:CVE-2017-7037"]}, {"type": "zdi", "idList": ["ZDI-17-489"]}], "modified": "2021-09-13T02:10:06", "rev": 2}, "score": {"value": 7.3, "vector": "NONE", "modified": "2021-09-13T02:10:06", "rev": 2}}, "objectVersion": "1.6", "pluginID": "101953", "sourceData": "Binary data apple_ios_1033_check.nbin", "naslFamily": "Mobile Devices", "cpe": ["cpe:/o:apple:iphone_os"], "solution": "Upgrade to Apple iOS version 10.3.3 or later.", "nessusSeverity": "Critical", "cvssScoreSource": "CVE-2017-8248", "vpr": {"risk factor": "Critical", "score": "9"}, "exploitAvailable": true, "exploitEase": "Exploits are available", "patchPublicationDate": "2017-07-19T00:00:00", "vulnerabilityPublicationDate": "2017-06-02T00:00:00", "exploitableWith": []}, "lastseen": "2021-09-13T02:10:06", "differentElements": ["vpr"], "edition": 5}, {"bulletin": {"id": "APPLE_IOS_1033_CHECK.NBIN", "hash": "e7f4fba3d422682bbf04e635bc78171a", "type": "nessus", "bulletinFamily": "scanner", "title": "Apple iOS < 10.3.3 Multiple Vulnerabilities", "description": "The version of Apple iOS running on the mobile device is prior to 10.3.3. It is, therefore, affected by multiple vulnerabilities :\n\n - A flaw exists in Safari due to inconsistent user interface behavior. An unauthenticated, remote attacker can exploit this, via a malicious website, to spoof the address bar. (CVE-2017-2517)\n\n - An information disclosure vulnerability exists in the WebKit component due to improper handling of SVG filters. An unauthenticated, remote attacker can exploit this, via a timing side-channel attack, to disclose sensitive cross-domain information. (CVE-2017-7006)\n\n - A denial of service vulnerability exists in the EventKitUI component that allows an unauthenticated, remote attacker to exhaust available resources, causing an application to terminate. (CVE-2017-7007)\n\n - A remote code execution vulnerability exists in the CoreAudio component due to improper validation of user-supplied input when handling movie files. An unauthenticated, remote attacker can exploit this, by convincing a user to play a specially crafted movie file, to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-7008)\n\n - A memory corruption issue exists in the IOUSBFamily component due to improper validation of user-supplied input. A local attacker can exploit this, via a specially crafted application, to cause a denial of service condition or the execution of arbitrary code.\n (CVE-2017-7009)\n\n - Multiple out-of-bounds read errors exist in the libxml2 component due to improper handling of specially crafted XML documents. An unauthenticated, remote attacker can exploit these to disclose user information.\n (CVE-2017-7010, CVE-2017-7013)\n\n - A unspecified flaw exists in the Webkit component that allows an unauthenticated, remote attacker to spoof the address bar via a malicious website. (CVE-2017-7011)\n\n - Multiple memory corruption issues exist in the Webkit Web Inspector component due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit these, via a specially crafted web page, to corrupt memory, resulting in the execution of arbitrary code. (CVE-2017-7012)\n\n - Multiple memory corruption issues exist in the WebKit component due to improper validation of input. An unauthenticated, remote attacker can exploit these issues, via a specially crafted web page, to execute arbitrary code. (CVE-2017-7018, CVE-2017-7020, CVE-2017-7030, CVE-2017-7034, CVE-2017-7037, CVE-2017-7039, CVE-2017-7040, CVE-2017-7041, CVE-2017-7042, CVE-2017-7043, CVE-2017-7046, CVE-2017-7048, CVE-2017-7049, CVE-2017-7052, CVE-2017-7055, CVE-2017-7056, CVE-2017-7061)\n\n - A memory corruption issue exists in the 'WebKit Page Loading' component due to improper validation of input.\n An unauthenticated, remote attacker can exploit this, via a specially crafted web page, to execute arbitrary code. (CVE-2017-7019)\n\n - Multiple memory corruption issues exist in the kernel due to improper validation of input. A local attacker can exploit these issues to cause a denial of service condition or the execution of arbitrary code with system privileges. (CVE-2017-7022, CVE-2017-7024, CVE-2017-7026)\n\n - Multiple memory corruption issues exist in the kernel due to improper validation of input. A local attacker can exploit these issues to cause a denial of service condition or the execution of arbitrary code with kernel privileges. (CVE-2017-7023, CVE-2017-7025, CVE-2017-7027, CVE-2017-7069)\n\n - Multiple unspecified flaws exist in the kernel due to a failure to properly sanitize input. A local attacker can exploit these issues, via a specially crafted application, to disclose restricted memory.\n (CVE-2017-7028, CVE-2017-7029)\n\n - Multiple cross-site scripting (XSS) vulnerabilities exist in the WebKit component in the DOMParser due to improper validation of user-supplied input before returning it to users. An unauthenticated, remote attacker can exploit these issue, via a specially crafted URL, to execute arbitrary script code in a user's browser session. (CVE-2017-7038, CVE-2017-7059)\n\n - A memory corruption issue exists in the libxpc component due to improper validation of input. A local attacker can exploit this issue, via a specifically crafted application, to cause a denial of service condition or the execution of arbitrary code with system privileges.\n (CVE-2017-7047)\n\n - An information disclosure vulnerability exists due to the device displaying notifications on the lock screen even when disabled. A local attacker can exploit this to gain potentially sensitive information. (CVE-2017-7058)\n\n - A denial of service vulnerability exists in Safari printing when handling a specially crafted web page that results in creating an infinite number of print dialogs.\n An unauthenticated, remote attacker can exploit this to cause a user to believe that the browser has locked up. (CVE-2017-7060)\n\n - A buffer overflow condition exists in the Contacts component due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-7062)\n\n - A denial of service vulnerability exists in the Messages component due to improper handling of memory. An unauthenticated, remote attacker can exploit this to consume excessive resources, resulting in an unexpected application termination. (CVE-2017-7063)\n\n - An unspecified memory initialization issue exists in Webkit. A local attacker can exploit this, via a specially crafted application, to disclose the contents of restricted memory. (CVE-2017-7064)\n\n - A buffer overflow condition exists in the libarchive component due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, via a specially crafted archive file, to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-7068)\n\n - A memory corruption issue exists in the Telephony component due to improper validation of user-supplied input. A man-in-the-middle attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-8248)\n\n - A memory corruption issue exists in the Broadcom BCM43xx family Wi-Fi Chips component that allows an unauthenticated, remote attacker to execute arbitrary code. (CVE-2017-9417)", "published": "2017-07-25T00:00:00", "modified": "2021-07-12T00:00:00", "cvss": {"score": 10, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {}, "cvss3": {"score": 9.8, "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "href": "https://www.tenable.com/plugins/nessus/101953", "reporter": "This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7006", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7028", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7063", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7042", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7022", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7047", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7043", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7019", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2517", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7058", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7027", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7069", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7024", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7029", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7008", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7059", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7020", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7038", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7023", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8248", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7026", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7009", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7010", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7013", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7041", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7049", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7062", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7011", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7025", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7018", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7068", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7060", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7055", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7046", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7056", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7012", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7039", "https://www.zerodayinitiative.com/advisories/ZDI-17-489/", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7037", "https://support.apple.com/en-us/HT207923", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7030", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7007", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7040", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7064", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7034", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7052", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9417", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7061", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7048"], "cvelist": ["CVE-2017-2517", "CVE-2017-7006", "CVE-2017-7007", "CVE-2017-7008", "CVE-2017-7009", "CVE-2017-7010", "CVE-2017-7011", "CVE-2017-7012", "CVE-2017-7013", "CVE-2017-7018", "CVE-2017-7019", "CVE-2017-7020", "CVE-2017-7022", "CVE-2017-7023", "CVE-2017-7024", "CVE-2017-7025", "CVE-2017-7026", "CVE-2017-7027", "CVE-2017-7028", "CVE-2017-7029", "CVE-2017-7030", "CVE-2017-7034", "CVE-2017-7037", "CVE-2017-7038", "CVE-2017-7039", "CVE-2017-7040", "CVE-2017-7041", "CVE-2017-7042", "CVE-2017-7043", "CVE-2017-7046", "CVE-2017-7047", "CVE-2017-7048", "CVE-2017-7049", "CVE-2017-7052", "CVE-2017-7055", "CVE-2017-7056", "CVE-2017-7058", "CVE-2017-7059", "CVE-2017-7060", "CVE-2017-7061", "CVE-2017-7062", "CVE-2017-7063", "CVE-2017-7064", "CVE-2017-7068", "CVE-2017-7069", "CVE-2017-8248", "CVE-2017-9417"], "immutableFields": [], "lastseen": "2021-10-12T13:56:21", "history": [], "viewCount": 0, "enchantments": {"dependencies": {"references": [{"type": "nessus", "idList": ["MACOSX_SECUPD2017-003.NASL", "FEDORA_2017-73D6A0DFBB.NASL", "700168.PRM", "700167.PRM", "UBUNTU_USN-3376-1.NASL", "MACOS_ITUNES_12_6_2.NASL", "700169.PRM", "GENTOO_GLSA-201710-14.NASL", "FEDORA_2017-24BDDB96B5.NASL", "FEDORA_2017-9D572CC64A.NASL", "700166.PRM", "MACOSX_SAFARI10_1_2.NASL", "700170.PRM", "ITUNES_12_6_2.NASL", "ITUNES_12_6_2_BANNER.NASL", "FREEBSD_PKG_0F66B901715C11E7AD1FBCAEC565249C.NASL"]}, {"type": "apple", "idList": ["APPLE:HT207923", "APPLE:HT207925", "APPLE:HT207928", "APPLE:HT207924", "APPLE:HT207921", "APPLE:HT207927"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310843266", "OPENVAS:1361412562310811252", "OPENVAS:1361412562310811251", "OPENVAS:1361412562310873200", "OPENVAS:1361412562310873180", "OPENVAS:1361412562310811538", "OPENVAS:1361412562310811535", "OPENVAS:1361412562310873226"]}, {"type": "freebsd", "idList": ["0F66B901-715C-11E7-AD1F-BCAEC565249C"]}, {"type": "kaspersky", "idList": ["KLA11075"]}, {"type": "gentoo", "idList": ["GLSA-201710-14"]}, {"type": "fedora", "idList": ["FEDORA:D681D609273A", "FEDORA:33FB9639A184", "FEDORA:417B06017118"]}, {"type": "archlinux", "idList": ["ASA-201707-25"]}, {"type": "ubuntu", "idList": ["USN-3376-1"]}, {"type": "threatpost", "idList": ["THREATPOST:60D5DA46BF733084F46AB656BE8CC259"]}, {"type": "cve", "idList": ["CVE-2017-7047", "CVE-2017-7006", "CVE-2017-7029", "CVE-2017-7026", "CVE-2017-7037", "CVE-2017-7028", "CVE-2017-7011", "CVE-2017-7007", "CVE-2017-7022", "CVE-2017-8248", "CVE-2017-7061", "CVE-2017-7012", "CVE-2017-7018", "CVE-2017-7013", "CVE-2017-7060", "CVE-2017-7040", "CVE-2017-7030", "CVE-2017-7027", "CVE-2017-7048", "CVE-2017-7025", "CVE-2017-7024", "CVE-2017-7009", "CVE-2017-7034", "CVE-2017-7020", "CVE-2017-7043", "CVE-2017-7046", "CVE-2017-7049", "CVE-2017-7041", "CVE-2017-7062", "CVE-2017-7056", "CVE-2017-7058", "CVE-2017-7063", "CVE-2017-7023", "CVE-2017-7008", "CVE-2017-9417", "CVE-2017-7069", "CVE-2017-7038", "CVE-2017-7010", "CVE-2017-7019"]}, {"type": "android", "idList": ["ANDROID:CVE-2017-8248", "ANDROID:CVE-2017-9417"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2017-7018", "UB:CVE-2017-7006", "UB:CVE-2017-7046", "UB:CVE-2017-7019", "UB:CVE-2017-7049", "UB:CVE-2017-7030", "UB:CVE-2017-7020", "UB:CVE-2017-7034", "UB:CVE-2017-7048", "UB:CVE-2017-7041", "UB:CVE-2017-7037", "UB:CVE-2017-7061", "UB:CVE-2017-7010", "UB:CVE-2017-7043", "UB:CVE-2017-7038", "UB:CVE-2017-7012", "UB:CVE-2017-7040", "UB:CVE-2017-7013", "UB:CVE-2017-7011"]}, {"type": "zdi", "idList": ["ZDI-17-489"]}], "modified": "2021-10-12T13:56:21", "rev": 2}, "score": {"value": 7.3, "vector": "NONE", "modified": "2021-10-12T13:56:21", "rev": 2}}, "objectVersion": "1.6", "pluginID": "101953", "sourceData": "Binary data apple_ios_1033_check.nbin", "naslFamily": "Mobile Devices", "cpe": ["cpe:/o:apple:iphone_os"], "solution": "Upgrade to Apple iOS version 10.3.3 or later.", "nessusSeverity": "Critical", "cvssScoreSource": "CVE-2017-8248", "vpr": {"risk factor": "High", "score": "8.4"}, "exploitAvailable": true, "exploitEase": "Exploits are available", "patchPublicationDate": "2017-07-19T00:00:00", "vulnerabilityPublicationDate": "2017-06-02T00:00:00", "exploitableWith": []}, "lastseen": "2021-10-12T13:56:21", "differentElements": ["vpr"], "edition": 6}], "viewCount": 0, "enchantments": {"dependencies": {"references": [{"type": "nessus", "idList": ["FEDORA_2017-24BDDB96B5.NASL", "700168.PRM", "GENTOO_GLSA-201710-14.NASL", "MACOSX_SAFARI10_1_2.NASL", "700169.PRM", "FEDORA_2017-9D572CC64A.NASL", "MACOS_ITUNES_12_6_2.NASL", "700166.PRM", "FEDORA_2017-73D6A0DFBB.NASL", "700167.PRM", "UBUNTU_USN-3376-1.NASL", "FREEBSD_PKG_0F66B901715C11E7AD1FBCAEC565249C.NASL", "ITUNES_12_6_2.NASL", "ITUNES_12_6_2_BANNER.NASL"]}, {"type": "apple", "idList": ["APPLE:21F236C1A9D411224D0D290A7D88873F", "APPLE:HT207923", "APPLE:7AFC35B4B1D8C25A050E4C951554FD97", "APPLE:HT207924", "APPLE:HT207921", "APPLE:HT207927", "APPLE:ABA73FEAAAB2192DEAFA24CF2EB1B8F9", "APPLE:HT207925", "APPLE:HT207928", "APPLE:F234B75385D1403C977E0F0F5AEA4D95", "APPLE:5D035145E3EE53A8C36DC063A0DC8B49", "APPLE:CEC7DCE5379D5C1DBB2795CA582D13CD"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310843266", "OPENVAS:1361412562310873180", "OPENVAS:1361412562310873200", "OPENVAS:1361412562310873226", "OPENVAS:1361412562310811535", "OPENVAS:1361412562310811252", "OPENVAS:1361412562310811251", "OPENVAS:1361412562310811538"]}, {"type": "freebsd", "idList": ["0F66B901-715C-11E7-AD1F-BCAEC565249C"]}, {"type": "kaspersky", "idList": ["KLA11075"]}, {"type": "gentoo", "idList": ["GLSA-201710-14"]}, {"type": "fedora", "idList": ["FEDORA:417B06017118", "FEDORA:D681D609273A", "FEDORA:33FB9639A184"]}, {"type": "archlinux", "idList": ["ASA-201707-25"]}, {"type": "ubuntu", "idList": ["USN-3376-1"]}, {"type": "threatpost", "idList": ["THREATPOST:60D5DA46BF733084F46AB656BE8CC259"]}, {"type": "cve", "idList": ["CVE-2017-7024", "CVE-2017-7022", "CVE-2017-7034", "CVE-2017-8248", "CVE-2017-7019", "CVE-2017-7018", "CVE-2017-7025", "CVE-2017-7038", "CVE-2017-7008", "CVE-2017-7029", "CVE-2017-7028", "CVE-2017-7007", "CVE-2017-7010", "CVE-2017-7012", "CVE-2017-7049", "CVE-2017-7011", "CVE-2017-7047", "CVE-2017-7027", "CVE-2017-7009", "CVE-2017-7006", "CVE-2017-9417", "CVE-2017-7043", "CVE-2017-7030", "CVE-2017-7037", "CVE-2017-7026", "CVE-2017-7058", "CVE-2017-7069", "CVE-2017-7013", "CVE-2017-7023"]}, {"type": "android", "idList": ["ANDROID:CVE-2017-9417", "ANDROID:CVE-2017-8248"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2017-7013", "UB:CVE-2017-7018", "UB:CVE-2017-7006", "UB:CVE-2017-7043", "UB:CVE-2017-7019", "UB:CVE-2017-7034", "UB:CVE-2017-7037", "UB:CVE-2017-7010", "UB:CVE-2017-7030", "UB:CVE-2017-7012", "UB:CVE-2017-7011", "UB:CVE-2017-7038", "UB:CVE-2017-7049"]}, {"type": "debiancve", "idList": ["DEBIANCVE:CVE-2017-7006", "DEBIANCVE:CVE-2017-7049", "DEBIANCVE:CVE-2017-7018", "DEBIANCVE:CVE-2017-7038", "DEBIANCVE:CVE-2017-7034", "DEBIANCVE:CVE-2017-7043", "DEBIANCVE:CVE-2017-7012", "DEBIANCVE:CVE-2017-7011", "DEBIANCVE:CVE-2017-7030", "DEBIANCVE:CVE-2017-9417", "DEBIANCVE:CVE-2017-7037", "DEBIANCVE:CVE-2017-7019"]}, {"type": "zdi", "idList": ["ZDI-17-489"]}], "modified": "2021-10-22T12:57:00", "rev": 2}, "score": {"value": 7.3, "vector": "NONE", "modified": "2021-10-22T12:57:00", "rev": 2}}, "objectVersion": "1.6", "pluginID": "101953", "sourceData": "Binary data apple_ios_1033_check.nbin", "naslFamily": "Mobile Devices", "cpe": ["cpe:/o:apple:iphone_os"], "solution": "Upgrade to Apple iOS version 10.3.3 or later.", "nessusSeverity": "Critical", "cvssScoreSource": "CVE-2017-8248", "vpr": {"risk factor": "High", "score": "7.4"}, "exploitAvailable": true, "exploitEase": "Exploits are available", "patchPublicationDate": "2017-07-19T00:00:00", "vulnerabilityPublicationDate": "2017-06-02T00:00:00", "exploitableWith": [], "_object_type": "robots.models.nessus.NessusBulletin", "_object_types": ["robots.models.base.Bulletin", "robots.models.nessus.NessusBulletin"]}], "apple": [{"id": "APPLE:21F236C1A9D411224D0D290A7D88873F", "vendorId": null, "hash": "53f6c089ce85f23b05a5d3e9114dacf2", "type": "apple", "bulletinFamily": "software", "title": "About the security content of iOS 10.3.3", "description": "# About the security content of iOS 10.3.3\n\nThis document describes the security content of iOS 10.3.3.\n\n## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the [Apple security updates](<https://support.apple.com/kb/HT201222>) page.\n\nFor more information about security, see the [Apple Product Security](<https://support.apple.com/kb/HT201220>) page. You can encrypt communications with Apple using the [Apple Product Security PGP Key](<https://support.apple.com/kb/HT201601>).\n\nApple security documents reference vulnerabilities by [CVE-ID](<http://cve.mitre.org/about/>) when possible.\n\n\n\n## iOS 10.3.3\n\nReleased July 19, 2017\n\n**Contacts**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution\n\nDescription: A buffer overflow issue was addressed through improved memory handling.\n\nCVE-2017-7062: Shashank (@cyberboyIndia)\n\n**CoreAudio**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Processing a maliciously crafted movie file may lead to arbitrary code execution\n\nDescription: A memory corruption issue was addressed with improved bounds checking.\n\nCVE-2017-7008: Yangkang (@dnpushme) of Qihoo 360 Qex Team\n\n**EventKitUI**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: A remote attacker may cause an unexpected application termination\n\nDescription: A resource exhaustion issue was addressed through improved input validation.\n\nCVE-2017-7007: Jos\u00e9 Antonio Esteban (@Erratum_) of Sapsi Consultores\n\n**IOUSBFamily**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-7009: shrek_wzw of Qihoo 360 Nirvan Team\n\n**Kernel**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-7022: an anonymous researcher\n\nCVE-2017-7024: an anonymous researcher\n\nCVE-2017-7026: an anonymous researcher\n\n**Kernel**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-7023: an anonymous researcher\n\nCVE-2017-7025: an anonymous researcher\n\nCVE-2017-7027: an anonymous researcher\n\nCVE-2017-7069: Proteas of Qihoo 360 Nirvan Team\n\n**Kernel**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An application may be able to read restricted memory\n\nDescription: A validation issue was addressed with improved input sanitization.\n\nCVE-2017-7028: an anonymous researcher\n\nCVE-2017-7029: an anonymous researcher\n\n**libarchive**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Unpacking a maliciously crafted archive may lead to arbitrary code execution\n\nDescription: A buffer overflow was addressed through improved bounds checking.\n\nCVE-2017-7068: found by OSS-Fuzz\n\n**libxml2**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: Parsing a maliciously crafted XML document may lead to disclosure of user information\n\nDescription: An out-of-bounds read was addressed through improved bounds checking.\n\nCVE-2017-7010: Apple\n\nCVE-2017-7013: found by OSS-Fuzz\n\n**libxpc**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-7047: Ian Beer of Google Project Zero\n\n**Messages**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: A remote attacker may cause an unexpected application termination\n\nDescription: A memory consumption issue was addressed through improved memory handling.\n\nCVE-2017-7063: Shashank (@cyberboyIndia)\n\n**Notifications**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Notifications may appear on the lock screen when disabled\n\nDescription: A lock screen issue was addressed with improved state management.\n\nCVE-2017-7058: Beyza Sevin\u00e7 of S\u00fcleyman Demirel \u00dcniversitesi\n\nEntry updated July 28, 2017\n\n**Safari**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Visiting a malicious website may lead to address bar spoofing\n\nDescription: An inconsistent user interface issue was addressed with improved state management.\n\nCVE-2017-2517: xisigr of Tencent's Xuanwu Lab (tencent.com)\n\n**Safari Printing**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: Processing maliciously crafted web content may lead to an infinite number of print dialogs\n\nDescription: An issue existed where a malicious or compromised website could show infinite print dialogs and make users believe their browser was locked. The issue was addressed through throttling of print dialogs.\n\nCVE-2017-7060: Travis Kelley of City of Mishawaka, Indiana\n\n**Telephony**\n\nAvailable for: iPhone 5 and later, and Wi-Fi + Cellular models of iPad 4th generation and later\n\nImpact: An attacker in a privileged network position may be able to execute arbitrary code\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-8248\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: A malicious website may exfiltrate data cross-origin\n\nDescription: Processing maliciously crafted web content may allow cross-origin data to be exfiltrated by using SVG filters to conduct a timing side-channel attack. This issue was addressed by not painting the cross-origin buffer into the frame that gets filtered.\n\nCVE-2017-7006: an anonymous researcher, David Kohlbrenner of UC San Diego\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Visiting a malicious website may lead to address bar spoofing\n\nDescription: A state management issue was addressed with improved frame handling.\n\nCVE-2017-7011: xisigr of Tencent's Xuanwu Lab (tencent.com)\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved memory handling.\n\nCVE-2017-7018: lokihardt of Google Project Zero\n\nCVE-2017-7020: likemeng of Baidu Security Lab\n\nCVE-2017-7030: chenqin of Ant-financial Light-Year Security Lab (\u8682\u8681\u91d1\u670d\u5df4\u65af\u5149\u5e74\u5b89\u5168\u5b9e\u9a8c\u5ba4)\n\nCVE-2017-7034: chenqin of Ant-financial Light-Year Security Lab (\u8682\u8681\u91d1\u670d\u5df4\u65af\u5149\u5e74\u5b89\u5168\u5b9e\u9a8c\u5ba4)\n\nCVE-2017-7037: lokihardt of Google Project Zero\n\nCVE-2017-7039: Ivan Fratric of Google Project Zero\n\nCVE-2017-7040: Ivan Fratric of Google Project Zero\n\nCVE-2017-7041: Ivan Fratric of Google Project Zero\n\nCVE-2017-7042: Ivan Fratric of Google Project Zero\n\nCVE-2017-7043: Ivan Fratric of Google Project Zero\n\nCVE-2017-7046: Ivan Fratric of Google Project Zero\n\nCVE-2017-7048: Ivan Fratric of Google Project Zero\n\nCVE-2017-7052: cc working with Trend Micro's Zero Day Initiative\n\nCVE-2017-7055: The UK's National Cyber Security Centre (NCSC)\n\nCVE-2017-7056: lokihardt of Google Project Zero\n\nCVE-2017-7061: lokihardt of Google Project Zero\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Processing maliciously crafted web content with DOMParser may lead to cross site scripting\n\nDescription: A logic issue existed in the handling of DOMParser. This issue was addressed with improved state management.\n\nCVE-2017-7038: Egor Karbutov (@ShikariSenpai) of Digital Security and Egor Saltykov (@ansjdnakjdnajkd) of Digital Security, Neil Jenkins of FastMail Pty Ltd\n\nCVE-2017-7059: Masato Kinugawa and Mario Heiderich of Cure53\n\nEntry updated July 28, 2017\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed through improved memory handling.\n\nCVE-2017-7049: Ivan Fratric of Google Project Zero\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An application may be able to read restricted memory\n\nDescription: A memory initialization issue was addressed through improved memory handling.\n\nCVE-2017-7064: lokihardt of Google Project Zero\n\n**WebKit Page Loading**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved memory handling.\n\nCVE-2017-7019: Zhiyang Zeng of Tencent Security Platform Department\n\n**WebKit Web Inspector**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved memory handling.\n\nCVE-2017-7012: Apple\n\n**Wi-Fi**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An attacker within range may be able to execute arbitrary code on the Wi-Fi chip\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-7065: Gal Beniamini of Google Project Zero\n\nEntry added September 25, 2017\n\n**Wi-Fi**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An attacker in Wi-Fi range may be able to cause a denial of service on the Wi-Fi chip\n\nDescription: A memory corruption issue was addressed with improved validation.\n\nCVE-2017-7066: Gal Beniamini of Google Project Zero\n\nEntry added September 26, 2017\n\n**Wi-Fi**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An attacker within range may be able to execute arbitrary code on the Wi-Fi chip\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-9417: Nitay Artenstein of Exodus Intelligence\n\nInformation about products not manufactured by Apple, or independent websites not controlled or tested by Apple, is provided without recommendation or endorsement. Apple assumes no responsibility with regard to the selection, performance, or use of third-party websites or products. Apple makes no representations regarding third-party website accuracy or reliability. [Contact the vendor](<http://support.apple.com/kb/HT2693>) for additional information.\n\nPublished Date: July 27, 2020\n", "published": "2017-07-19T00:00:00", "modified": "2017-07-19T00:00:00", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {"acInsufInfo": true, "cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 10.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 5.9}, "href": "https://support.apple.com/kb/HT207923", "reporter": "Apple", "references": ["https://support.apple.com/en-us/HT201222"], "cvelist": ["CVE-2017-2517", "CVE-2017-7006", "CVE-2017-7007", "CVE-2017-7008", "CVE-2017-7009", "CVE-2017-7010", "CVE-2017-7011", "CVE-2017-7012", "CVE-2017-7013", "CVE-2017-7018", "CVE-2017-7019", "CVE-2017-7020", "CVE-2017-7022", "CVE-2017-7023", "CVE-2017-7024", "CVE-2017-7025", "CVE-2017-7026", "CVE-2017-7027", "CVE-2017-7028", "CVE-2017-7029", "CVE-2017-7030", "CVE-2017-7034", "CVE-2017-7037", "CVE-2017-7038", "CVE-2017-7039", "CVE-2017-7040", "CVE-2017-7041", "CVE-2017-7042", "CVE-2017-7043", "CVE-2017-7046", "CVE-2017-7047", "CVE-2017-7048", "CVE-2017-7049", "CVE-2017-7052", "CVE-2017-7055", "CVE-2017-7056", "CVE-2017-7058", "CVE-2017-7059", "CVE-2017-7060", "CVE-2017-7061", "CVE-2017-7062", "CVE-2017-7063", "CVE-2017-7064", "CVE-2017-7065", "CVE-2017-7066", "CVE-2017-7068", "CVE-2017-7069", "CVE-2017-8248", "CVE-2017-9417"], "immutableFields": [], "lastseen": "2021-11-16T01:01:59", "history": [{"bulletin": {"id": "APPLE:21F236C1A9D411224D0D290A7D88873F", "vendorId": null, "hash": "62f162d6104d2416ed5197264c50853bf6181b0c0bb8d6a67b617ab67902ddb0", "type": "apple", "bulletinFamily": "software", "title": "Apple Security Update: iOS 10.3.3\n", "description": "Apple recommends to install security update iOS 10.3.3\n on devices iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n", "published": "2017-07-19T00:00:00", "modified": "2017-07-19T00:00:00", "cvss": {}, "cvss2": {}, "cvss3": {}, "href": "https://support.apple.com/kb/HT207923", "reporter": "Apple", "references": ["https://support.apple.com/en-us/HT201222", "https://support.apple.com/kb/HT207923"], "cvelist": [], "immutableFields": [], "lastseen": "2020-05-07T18:03:49", "history": [], "viewCount": 0, "enchantments": {"dependencies": {"modified": "2020-05-07T18:03:49", "references": [{"idList": ["APPLE:12887AB5BB71C26CA347DA603F2A38E5", "APPLE:D842C156864A70351F1DAF73F853B39E", "APPLE:B48082D98B6BA029A905A36AB5B5E3F5", "APPLE:21F236C1A9D411224D0D290A7D88873F", "APPLE:DC836966564410BD83E958AC96F8DB12", "APPLE:HT207923", "APPLE:C576D3548381302A5BCBE22EF67C0131", "APPLE:4DBBB66883DC836291AECACDF707050A", "APPLE:083455936A7BFF0A7723E989B92D241D", "APPLE:FA56DF7B2D68C4F8B67EE47903C325FC", "APPLE:99264BBD02673CF1A5BD1F2971DF24AC", "APPLE:6719BBA2C54C882380F2507C6DB8B594", "APPLE:9A1CF1662DFE33B08BD0240BEB4B2AC9", "APPLE:1C16D7507A975B0063CF2C60AFABD796", "APPLE:737483D7FFBE6C182CBD53B150D149C1", "APPLE:BEF29044688160BB997E6A04A1810D9C", "APPLE:25A40F47C0600E8BF083E9F8CF4D02B3", "APPLE:93C3C089A84DF055788C6DF8D286780E", "APPLE:D6FFE312C543C07E83B2A006624D4484", "APPLE:80AF69490F769A089C16F62E11014AFD", "APPLE:FD264D87BAFB1F61EA0F916A10C184DF", "APPLE:1BAEE8F17DD7D2B63370193032CB0611", "APPLE:A0D2512CFF25D0D5D3BCE389FDB19F72", "APPLE:3B51A3793E650DEB4D5A524AEB10939D", "APPLE:C50B697E972C6E21765EAA60E58C7164", "APPLE:DD06626CF4C4BC3354ACDF2F54357778", "APPLE:43A82761AF2332E4585261BA13AEFC4C", "APPLE:913B7B79E4560DB158829B9D29B2539D", "APPLE:60BFB2B2ABBB461BE6997F0ACF5B6660", "APPLE:83954851679CA201EF1EDF83CE5D2FB9", "APPLE:7EC62CB7770B86C6FBAD6DBD45DFEBDB", "APPLE:89861DA71DDD36B8AE0F5BFD245CA715", "APPLE:9A1C80AF038E85E8590D4B815BA273FD", "APPLE:7D85C3857A518CC0896E1AC4FC721A5F", "APPLE:BF63E0940D677DE6F4EA077CCBC8E3D4"], "type": "apple"}], "rev": 2}, "score": {"modified": "2020-05-07T18:03:49", "rev": 2, "value": 1.8, "vector": "NONE"}}, "objectVersion": "1.3", "affectedSoftware": []}, "lastseen": "2020-05-07T18:03:49", "differentElements": ["cvss"], "edition": 1}, {"bulletin": {"id": "APPLE:21F236C1A9D411224D0D290A7D88873F", "vendorId": null, "hash": "35d5b47988e94daa88f519f10ef61380", "type": "apple", "bulletinFamily": "software", "title": "Apple Security Update: iOS 10.3.3\n", "description": "Apple recommends to install security update iOS 10.3.3\n on devices iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n", "published": "2017-07-19T00:00:00", "modified": "2017-07-19T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://support.apple.com/kb/HT207923", "reporter": "Apple", "references": ["https://support.apple.com/kb/HT207923", "https://support.apple.com/en-us/HT201222"], "cvelist": [], "immutableFields": [], "lastseen": "2021-05-31T16:59:38", "history": [], "viewCount": 0, "enchantments": {"dependencies": {"references": [{"type": "apple", "idList": ["APPLE:B9B20A47252B46B5523401A12BFE03B3", "APPLE:C50B697E972C6E21765EAA60E58C7164", "APPLE:FE3D63232171294398F45858A10B5295", "APPLE:01F01DC42D3C846351C9391E48A3A016", "APPLE:913B7B79E4560DB158829B9D29B2539D", "APPLE:649EC14F69D11DE4A4E4CC7FDD2AE31D", "APPLE:62DFB1CE05BA14AE0AFC0750696284DD", "APPLE:4DBBB66883DC836291AECACDF707050A", "APPLE:BD4A974F6804F04E071FA17C0189F1EB", "APPLE:60BFB2B2ABBB461BE6997F0ACF5B6660", "APPLE:HT207923", "APPLE:DC836966564410BD83E958AC96F8DB12", "APPLE:21F236C1A9D411224D0D290A7D88873F", "APPLE:DE4DB38835B966AACCBFDA230F2290D0", "APPLE:815274577073D1B995BDF8EABBECA8B3", "APPLE:8B4FE732ABB73A15CDDCD6E8294E3EF8", "APPLE:B71AB19607886631A8390750EA7CCE3F", "APPLE:BEF29044688160BB997E6A04A1810D9C", "APPLE:C576D3548381302A5BCBE22EF67C0131", "APPLE:4DC59130923980C324535772E9C08242", "APPLE:A0D2512CFF25D0D5D3BCE389FDB19F72", "APPLE:DA6A0A4635C393E244ADA3BDE050BFE1", "APPLE:B024BD5A4A1BC1AB787EB653885921E7", "APPLE:00136C664E46E49235D7BEB52F02D4CB", "APPLE:DAC745B8C02D20D12F100A493F79A2C5", "APPLE:0474FDB2C3BAED2BEB8F3F589A9A751B", "APPLE:D842C156864A70351F1DAF73F853B39E", "APPLE:93C3C089A84DF055788C6DF8D286780E", "APPLE:A0476A092DA4082BF1935886E3AAC659", "APPLE:83954851679CA201EF1EDF83CE5D2FB9", "APPLE:12887AB5BB71C26CA347DA603F2A38E5", "APPLE:0536CA1502248219C54E9CDB47CB476A", "APPLE:D6FFE312C543C07E83B2A006624D4484", "APPLE:083455936A7BFF0A7723E989B92D241D", "APPLE:7D85C3857A518CC0896E1AC4FC721A5F", "APPLE:1C16D7507A975B0063CF2C60AFABD796", "APPLE:37F5E5B333A3674CD65B7E1287333A9E", "APPLE:7440F921D6E435C184D04D7BBB1C792F", "APPLE:6719BBA2C54C882380F2507C6DB8B594", "APPLE:8AE775955605BF8E8F9449AD0B7FAD96", "APPLE:DD06626CF4C4BC3354ACDF2F54357778", "APPLE:ACE092CEDA446FEA9C5C469D75279A62", "APPLE:80AF69490F769A089C16F62E11014AFD", "APPLE:9A1CF1662DFE33B08BD0240BEB4B2AC9", "APPLE:CD72329F98AF4F612400C211AE4DE5CC", "APPLE:D1CDEB8752AB6C8F5120085F64A20A9D", "APPLE:3B51A3793E650DEB4D5A524AEB10939D", "APPLE:3B8870F50950E87AEF0659EF5C65CFB2", "APPLE:1BAEE8F17DD7D2B63370193032CB0611", "APPLE:99264BBD02673CF1A5BD1F2971DF24AC", "APPLE:FA56DF7B2D68C4F8B67EE47903C325FC", "APPLE:FC8342DFA1FB389BFF63707187601E04", "APPLE:9A1C80AF038E85E8590D4B815BA273FD", "APPLE:89861DA71DDD36B8AE0F5BFD245CA715", "APPLE:FD264D87BAFB1F61EA0F916A10C184DF", "APPLE:8FD7AEB23933D85EE69AC12E78C61047", "APPLE:B3381378B2D293A36BD1738ADC2FF0EA", "APPLE:7EC62CB7770B86C6FBAD6DBD45DFEBDB", "APPLE:737483D7FFBE6C182CBD53B150D149C1", "APPLE:25A40F47C0600E8BF083E9F8CF4D02B3", "APPLE:26C36A106263A094CCD2C0719C890E96", "APPLE:B6B88DE7A691BF48D70E3F17C90B66DC", "APPLE:BF63E0940D677DE6F4EA077CCBC8E3D4", "APPLE:43A82761AF2332E4585261BA13AEFC4C", "APPLE:F0FD4AF9E934E41AE6B540A3D8BD18F2", "APPLE:BCCCAE11F083D3D4908149AD32040F19", "APPLE:C6B3A88CDD73B885B12A7090E29D430A", "APPLE:A81762EC72891DE2E2EC4EDE80EB0AEC", "APPLE:B930D70697973AFE8560BB5CB5C8FF7E", "APPLE:B48082D98B6BA029A905A36AB5B5E3F5", "APPLE:0FDABBE26206F0203F18954597CC1A5D", "APPLE:083507BEBDEC8A0954D205E0ADD992DE"]}], "modified": "2021-05-31T16:59:38", "rev": 2}, "score": {"value": 1.8, "vector": "NONE", "modified": "2021-05-31T16:59:38", "rev": 2}}, "objectVersion": "1.5", "affectedSoftware": []}, "lastseen": "2021-05-31T16:59:38", "differentElements": ["affectedSoftware", "cvelist", "cvss", "cvss2", "cvss3", "description", "references", "title"], "edition": 2}, {"bulletin": {"id": "APPLE:21F236C1A9D411224D0D290A7D88873F", "vendorId": null, "hash": "53f6c089ce85f23b05a5d3e9114dacf2", "type": "apple", "bulletinFamily": "software", "title": "About the security content of iOS 10.3.3", "description": "# About the security content of iOS 10.3.3\n\nThis document describes the security content of iOS 10.3.3.\n\n## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the [Apple security updates](<https://support.apple.com/kb/HT201222>) page.\n\nFor more information about security, see the [Apple Product Security](<https://support.apple.com/kb/HT201220>) page. You can encrypt communications with Apple using the [Apple Product Security PGP Key](<https://support.apple.com/kb/HT201601>).\n\nApple security documents reference vulnerabilities by [CVE-ID](<http://cve.mitre.org/about/>) when possible.\n\n\n\n## iOS 10.3.3\n\nReleased July 19, 2017\n\n**Contacts**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution\n\nDescription: A buffer overflow issue was addressed through improved memory handling.\n\nCVE-2017-7062: Shashank (@cyberboyIndia)\n\n**CoreAudio**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Processing a maliciously crafted movie file may lead to arbitrary code execution\n\nDescription: A memory corruption issue was addressed with improved bounds checking.\n\nCVE-2017-7008: Yangkang (@dnpushme) of Qihoo 360 Qex Team\n\n**EventKitUI**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: A remote attacker may cause an unexpected application termination\n\nDescription: A resource exhaustion issue was addressed through improved input validation.\n\nCVE-2017-7007: Jos\u00e9 Antonio Esteban (@Erratum_) of Sapsi Consultores\n\n**IOUSBFamily**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-7009: shrek_wzw of Qihoo 360 Nirvan Team\n\n**Kernel**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-7022: an anonymous researcher\n\nCVE-2017-7024: an anonymous researcher\n\nCVE-2017-7026: an anonymous researcher\n\n**Kernel**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-7023: an anonymous researcher\n\nCVE-2017-7025: an anonymous researcher\n\nCVE-2017-7027: an anonymous researcher\n\nCVE-2017-7069: Proteas of Qihoo 360 Nirvan Team\n\n**Kernel**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An application may be able to read restricted memory\n\nDescription: A validation issue was addressed with improved input sanitization.\n\nCVE-2017-7028: an anonymous researcher\n\nCVE-2017-7029: an anonymous researcher\n\n**libarchive**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Unpacking a maliciously crafted archive may lead to arbitrary code execution\n\nDescription: A buffer overflow was addressed through improved bounds checking.\n\nCVE-2017-7068: found by OSS-Fuzz\n\n**libxml2**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: Parsing a maliciously crafted XML document may lead to disclosure of user information\n\nDescription: An out-of-bounds read was addressed through improved bounds checking.\n\nCVE-2017-7010: Apple\n\nCVE-2017-7013: found by OSS-Fuzz\n\n**libxpc**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-7047: Ian Beer of Google Project Zero\n\n**Messages**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: A remote attacker may cause an unexpected application termination\n\nDescription: A memory consumption issue was addressed through improved memory handling.\n\nCVE-2017-7063: Shashank (@cyberboyIndia)\n\n**Notifications**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Notifications may appear on the lock screen when disabled\n\nDescription: A lock screen issue was addressed with improved state management.\n\nCVE-2017-7058: Beyza Sevin\u00e7 of S\u00fcleyman Demirel \u00dcniversitesi\n\nEntry updated July 28, 2017\n\n**Safari**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Visiting a malicious website may lead to address bar spoofing\n\nDescription: An inconsistent user interface issue was addressed with improved state management.\n\nCVE-2017-2517: xisigr of Tencent's Xuanwu Lab (tencent.com)\n\n**Safari Printing**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: Processing maliciously crafted web content may lead to an infinite number of print dialogs\n\nDescription: An issue existed where a malicious or compromised website could show infinite print dialogs and make users believe their browser was locked. The issue was addressed through throttling of print dialogs.\n\nCVE-2017-7060: Travis Kelley of City of Mishawaka, Indiana\n\n**Telephony**\n\nAvailable for: iPhone 5 and later, and Wi-Fi + Cellular models of iPad 4th generation and later\n\nImpact: An attacker in a privileged network position may be able to execute arbitrary code\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-8248\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: A malicious website may exfiltrate data cross-origin\n\nDescription: Processing maliciously crafted web content may allow cross-origin data to be exfiltrated by using SVG filters to conduct a timing side-channel attack. This issue was addressed by not painting the cross-origin buffer into the frame that gets filtered.\n\nCVE-2017-7006: an anonymous researcher, David Kohlbrenner of UC San Diego\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Visiting a malicious website may lead to address bar spoofing\n\nDescription: A state management issue was addressed with improved frame handling.\n\nCVE-2017-7011: xisigr of Tencent's Xuanwu Lab (tencent.com)\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved memory handling.\n\nCVE-2017-7018: lokihardt of Google Project Zero\n\nCVE-2017-7020: likemeng of Baidu Security Lab\n\nCVE-2017-7030: chenqin of Ant-financial Light-Year Security Lab (\u8682\u8681\u91d1\u670d\u5df4\u65af\u5149\u5e74\u5b89\u5168\u5b9e\u9a8c\u5ba4)\n\nCVE-2017-7034: chenqin of Ant-financial Light-Year Security Lab (\u8682\u8681\u91d1\u670d\u5df4\u65af\u5149\u5e74\u5b89\u5168\u5b9e\u9a8c\u5ba4)\n\nCVE-2017-7037: lokihardt of Google Project Zero\n\nCVE-2017-7039: Ivan Fratric of Google Project Zero\n\nCVE-2017-7040: Ivan Fratric of Google Project Zero\n\nCVE-2017-7041: Ivan Fratric of Google Project Zero\n\nCVE-2017-7042: Ivan Fratric of Google Project Zero\n\nCVE-2017-7043: Ivan Fratric of Google Project Zero\n\nCVE-2017-7046: Ivan Fratric of Google Project Zero\n\nCVE-2017-7048: Ivan Fratric of Google Project Zero\n\nCVE-2017-7052: cc working with Trend Micro's Zero Day Initiative\n\nCVE-2017-7055: The UK's National Cyber Security Centre (NCSC)\n\nCVE-2017-7056: lokihardt of Google Project Zero\n\nCVE-2017-7061: lokihardt of Google Project Zero\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Processing maliciously crafted web content with DOMParser may lead to cross site scripting\n\nDescription: A logic issue existed in the handling of DOMParser. This issue was addressed with improved state management.\n\nCVE-2017-7038: Egor Karbutov (@ShikariSenpai) of Digital Security and Egor Saltykov (@ansjdnakjdnajkd) of Digital Security, Neil Jenkins of FastMail Pty Ltd\n\nCVE-2017-7059: Masato Kinugawa and Mario Heiderich of Cure53\n\nEntry updated July 28, 2017\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed through improved memory handling.\n\nCVE-2017-7049: Ivan Fratric of Google Project Zero\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An application may be able to read restricted memory\n\nDescription: A memory initialization issue was addressed through improved memory handling.\n\nCVE-2017-7064: lokihardt of Google Project Zero\n\n**WebKit Page Loading**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved memory handling.\n\nCVE-2017-7019: Zhiyang Zeng of Tencent Security Platform Department\n\n**WebKit Web Inspector**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved memory handling.\n\nCVE-2017-7012: Apple\n\n**Wi-Fi**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An attacker within range may be able to execute arbitrary code on the Wi-Fi chip\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-7065: Gal Beniamini of Google Project Zero\n\nEntry added September 25, 2017\n\n**Wi-Fi**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An attacker in Wi-Fi range may be able to cause a denial of service on the Wi-Fi chip\n\nDescription: A memory corruption issue was addressed with improved validation.\n\nCVE-2017-7066: Gal Beniamini of Google Project Zero\n\nEntry added September 26, 2017\n\n**Wi-Fi**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An attacker within range may be able to execute arbitrary code on the Wi-Fi chip\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-9417: Nitay Artenstein of Exodus Intelligence\n\nInformation about products not manufactured by Apple, or independent websites not controlled or tested by Apple, is provided without recommendation or endorsement. Apple assumes no responsibility with regard to the selection, performance, or use of third-party websites or products. Apple makes no representations regarding third-party website accuracy or reliability. [Contact the vendor](<http://support.apple.com/kb/HT2693>) for additional information.\n\nPublished Date: July 27, 2020\n", "published": "2017-07-19T00:00:00", "modified": "2017-07-19T00:00:00", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {"acInsufInfo": true, "cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 10.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 5.9}, "href": "https://support.apple.com/kb/HT207923", "reporter": "Apple", "references": ["https://support.apple.com/en-us/HT201222"], "cvelist": ["CVE-2017-2517", "CVE-2017-7006", "CVE-2017-7007", "CVE-2017-7008", "CVE-2017-7009", "CVE-2017-7010", "CVE-2017-7011", "CVE-2017-7012", "CVE-2017-7013", "CVE-2017-7018", "CVE-2017-7019", "CVE-2017-7020", "CVE-2017-7022", "CVE-2017-7023", "CVE-2017-7024", "CVE-2017-7025", "CVE-2017-7026", "CVE-2017-7027", "CVE-2017-7028", "CVE-2017-7029", "CVE-2017-7030", "CVE-2017-7034", "CVE-2017-7037", "CVE-2017-7038", "CVE-2017-7039", "CVE-2017-7040", "CVE-2017-7041", "CVE-2017-7042", "CVE-2017-7043", "CVE-2017-7046", "CVE-2017-7047", "CVE-2017-7048", "CVE-2017-7049", "CVE-2017-7052", "CVE-2017-7055", "CVE-2017-7056", "CVE-2017-7058", "CVE-2017-7059", "CVE-2017-7060", "CVE-2017-7061", "CVE-2017-7062", "CVE-2017-7063", "CVE-2017-7064", "CVE-2017-7065", "CVE-2017-7066", "CVE-2017-7068", "CVE-2017-7069", "CVE-2017-8248", "CVE-2017-9417"], "immutableFields": [], "lastseen": "2021-11-10T17:00:46", "history": [], "viewCount": 0, "enchantments": {"dependencies": {"references": [{"type": "nessus", "idList": ["700167.PRM", "FEDORA_2017-73D6A0DFBB.NASL", "ITUNES_12_6_2_BANNER.NASL", "700166.PRM", "FREEBSD_PKG_0F66B901715C11E7AD1FBCAEC565249C.NASL", "MACOS_ITUNES_12_6_2.NASL", "MACOSX_SAFARI10_1_2.NASL", "700168.PRM", "GENTOO_GLSA-201710-14.NASL", "FEDORA_2017-9D572CC64A.NASL", "FEDORA_2017-24BDDB96B5.NASL", "UBUNTU_USN-3376-1.NASL", "MACOSX_SECUPD2017-003.NASL", "APPLE_IOS_1033_CHECK.NBIN", "700169.PRM", "700170.PRM", "ITUNES_12_6_2.NASL"]}, {"type": "apple", "idList": ["APPLE:93C3C089A84DF055788C6DF8D286780E", "APPLE:89861DA71DDD36B8AE0F5BFD245CA715", "APPLE:C576D3548381302A5BCBE22EF67C0131", "APPLE:C50B697E972C6E21765EAA60E58C7164", "APPLE:BF63E0940D677DE6F4EA077CCBC8E3D4", "APPLE:DE4DB38835B966AACCBFDA230F2290D0", "APPLE:8FD7AEB23933D85EE69AC12E78C61047", "APPLE:B3381378B2D293A36BD1738ADC2FF0EA", "APPLE:D3F21FB4BBD17C5C85FBDC0D8CF2647B", "APPLE:HT207925", "APPLE:9A1C80AF038E85E8590D4B815BA273FD", "APPLE:D6FFE312C543C07E83B2A006624D4484", "APPLE:C3934642F271B78BEB3119DF3A66FB91", "APPLE:00227F7C8FECB8511DEA87CEE1A35651", "APPLE:1C16D7507A975B0063CF2C60AFABD796", "APPLE:80AF69490F769A089C16F62E11014AFD", "APPLE:5D035145E3EE53A8C36DC063A0DC8B49", "APPLE:43A82761AF2332E4585261BA13AEFC4C", "APPLE:C6B3A88CDD73B885B12A7090E29D430A", "APPLE:7EC62CB7770B86C6FBAD6DBD45DFEBDB", "APPLE:EAA7B151972D42F49D932465866AD0F7", "APPLE:HT207927", "APPLE:FE3D63232171294398F45858A10B5295", "APPLE:DA6A0A4635C393E244ADA3BDE050BFE1", "APPLE:HT207923", "APPLE:0783FAB2C58195BC3E602300DC944B07", "APPLE:7D85C3857A518CC0896E1AC4FC721A5F", "APPLE:F234B75385D1403C977E0F0F5AEA4D95", "APPLE:83954851679CA201EF1EDF83CE5D2FB9", "APPLE:A81762EC72891DE2E2EC4EDE80EB0AEC", "APPLE:0474FDB2C3BAED2BEB8F3F589A9A751B", "APPLE:9A1CF1662DFE33B08BD0240BEB4B2AC9", "APPLE:8AE775955605BF8E8F9449AD0B7FAD96", "APPLE:1BAEE8F17DD7D2B63370193032CB0611", "APPLE:HT207924", "APPLE:8B4FE732ABB73A15CDDCD6E8294E3EF8", "APPLE:8B25F57269F562980EF0ED157CF784AD", "APPLE:759F88BAB5737822FFB312B9AE028B11", "APPLE:FA56DF7B2D68C4F8B67EE47903C325FC", "APPLE:8E2DBBB775EAF9EB0E77728F1F327519", "APPLE:4DC59130923980C324535772E9C08242", "APPLE:6719BBA2C54C882380F2507C6DB8B594", "APPLE:25A40F47C0600E8BF083E9F8CF4D02B3", "APPLE:CDCA78BF77C684BAA926DF5FFE0759B1", "APPLE:649EC14F69D11DE4A4E4CC7FDD2AE31D", "APPLE:BEF29044688160BB997E6A04A1810D9C", "APPLE:60BFB2B2ABBB461BE6997F0ACF5B6660", "APPLE:3B8870F50950E87AEF0659EF5C65CFB2", "APPLE:DD06626CF4C4BC3354ACDF2F54357778", "APPLE:A0476A092DA4082BF1935886E3AAC659", "APPLE:D842C156864A70351F1DAF73F853B39E", "APPLE:B9B20A47252B46B5523401A12BFE03B3", "APPLE:0536CA1502248219C54E9CDB47CB476A", "APPLE:EA3F435869D64A0598E3657B87468918", "APPLE:B930D70697973AFE8560BB5CB5C8FF7E", "APPLE:913B7B79E4560DB158829B9D29B2539D", "APPLE:CB426D947C3D021DA94A94D51AB31FDD", "APPLE:ACE092CEDA446FEA9C5C469D75279A62", "APPLE:665D8628576372427A4867A3D76727EE", "APPLE:CD72329F98AF4F612400C211AE4DE5CC", "APPLE:46B417AA5A0A127D706DC5B844F0D8D2", "APPLE:62DFB1CE05BA14AE0AFC0750696284DD", "APPLE:FB3A3605DE2C511E500E4556C137E0AF", "APPLE:4DBBB66883DC836291AECACDF707050A", "APPLE:DA07741FDE768B9B04857BE30D2B7CE9", "APPLE:A0D2512CFF25D0D5D3BCE389FDB19F72", "APPLE:B024BD5A4A1BC1AB787EB653885921E7", "APPLE:5A7667EB1C2807FB57684E7C75480D66", "APPLE:4EE9E3A8FC6D6AFFAB0C6D52FC5D0FC0", "APPLE:7D0DC7CC460887BCABD42581944E47F4", "APPLE:7440F921D6E435C184D04D7BBB1C792F", "APPLE:FC8342DFA1FB389BFF63707187601E04", "APPLE:B48082D98B6BA029A905A36AB5B5E3F5", "APPLE:FD264D87BAFB1F61EA0F916A10C184DF", "APPLE:ABA73FEAAAB2192DEAFA24CF2EB1B8F9", "APPLE:52BCF4A20C9E6FF472F7E0FCF7A73C12", "APPLE:3B51A3793E650DEB4D5A524AEB10939D", "APPLE:E6EC20696D0DBE51E54B965532A9E633", "APPLE:AA82E5B3EBE5675FCCFBBBEE9BFD411D", "APPLE:083455936A7BFF0A7723E989B92D241D", "APPLE:26C36A106263A094CCD2C0719C890E96", "APPLE:HT207921", "APPLE:D1CDEB8752AB6C8F5120085F64A20A9D", "APPLE:37F5E5B333A3674CD65B7E1287333A9E", "APPLE:EBE92F2438AB1A14C6BDE5158AEA3712", "APPLE:5754FEDA3B60E2951DA7C9DCE3CCD33B", "APPLE:7AFC35B4B1D8C25A050E4C951554FD97", "APPLE:F0FD4AF9E934E41AE6B540A3D8BD18F2", "APPLE:DAC745B8C02D20D12F100A493F79A2C5", "APPLE:00136C664E46E49235D7BEB52F02D4CB", "APPLE:BCCCAE11F083D3D4908149AD32040F19", "APPLE:BD4A974F6804F04E071FA17C0189F1EB", "APPLE:644500C0206E86708DC72EEBB59BF5EC", "APPLE:083507BEBDEC8A0954D205E0ADD992DE", "APPLE:A45EF6A390F7F91AE1E0B31A361E1EA5", "APPLE:DC836966564410BD83E958AC96F8DB12", "APPLE:5819CC48A7438816B3469D0A9F9187AA", "APPLE:0FDABBE26206F0203F18954597CC1A5D", "APPLE:19471D7C484C1D81E0DF2A2571339E50", "APPLE:596F2B486F0EBB6CEC1147A8407FE60C", "APPLE:12887AB5BB71C26CA347DA603F2A38E5", "APPLE:84CD68EDEDB02B20F3B9B36CE32978CF", "APPLE:55AE5F9E3C7913A2B25FF96BFEF29F8A", "APPLE:CEC7DCE5379D5C1DBB2795CA582D13CD", "APPLE:HT207928", "APPLE:737483D7FFBE6C182CBD53B150D149C1", "APPLE:B71AB19607886631A8390750EA7CCE3F", "APPLE:B6B88DE7A691BF48D70E3F17C90B66DC", "APPLE:502D37318A95B385FB39006D515FD2C7", "APPLE:01F01DC42D3C846351C9391E48A3A016", "APPLE:815274577073D1B995BDF8EABBECA8B3"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310873180", "OPENVAS:1361412562310811252", "OPENVAS:1361412562310873226", "OPENVAS:1361412562310843266", "OPENVAS:1361412562310811251", "OPENVAS:1361412562310811535", "OPENVAS:1361412562310873200", "OPENVAS:1361412562310811538"]}, {"type": "freebsd", "idList": ["0F66B901-715C-11E7-AD1F-BCAEC565249C"]}, {"type": "kaspersky", "idList": ["KLA11075"]}, {"type": "gentoo", "idList": ["GLSA-201710-14"]}, {"type": "fedora", "idList": ["FEDORA:417B06017118", "FEDORA:D681D609273A", "FEDORA:33FB9639A184"]}, {"type": "archlinux", "idList": ["ASA-201707-25"]}, {"type": "ubuntu", "idList": ["USN-3376-1"]}, {"type": "threatpost", "idList": ["THREATPOST:60D5DA46BF733084F46AB656BE8CC259"]}, {"type": "cve", "idList": ["CVE-2017-7030", "CVE-2017-7018", "CVE-2017-7041", "CVE-2017-7025", "CVE-2017-7022", "CVE-2017-7043", "CVE-2017-7013", "CVE-2017-7034", "CVE-2017-7006", "CVE-2017-7027", "CVE-2017-7061", "CVE-2017-7058", "CVE-2017-7024", "CVE-2017-7038", "CVE-2017-7069", "CVE-2017-7047", "CVE-2017-7009", "CVE-2017-9417", "CVE-2017-7060", "CVE-2017-7037", "CVE-2017-7040", "CVE-2017-7026", "CVE-2017-7020", "CVE-2017-7008", "CVE-2017-7012", "CVE-2017-7010", "CVE-2017-7028", "CVE-2017-7029", "CVE-2017-7049", "CVE-2017-7011", "CVE-2017-7023", "CVE-2017-7007", "CVE-2017-8248", "CVE-2017-7019", "CVE-2017-7046"]}, {"type": "android", "idList": ["ANDROID:CVE-2017-8248", "ANDROID:CVE-2017-9417"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2017-7037", "UB:CVE-2017-7010", "UB:CVE-2017-7020", "UB:CVE-2017-7038", "UB:CVE-2017-7019", "UB:CVE-2017-7011", "UB:CVE-2017-7018", "UB:CVE-2017-7043", "UB:CVE-2017-7049", "UB:CVE-2017-7006", "UB:CVE-2017-7030", "UB:CVE-2017-7046", "UB:CVE-2017-7041", "UB:CVE-2017-7012", "UB:CVE-2017-7034", "UB:CVE-2017-7061", "UB:CVE-2017-7013"]}], "modified": "2021-11-10T17:00:46", "rev": 2}, "score": {"value": 6.4, "vector": "NONE", "modified": "2021-11-10T17:00:46", "rev": 2}}, "objectVersion": "1.6", "affectedSoftware": [{"version": "10.3.3", "operator": "lt", "name": "ios"}]}, "lastseen": "2021-11-10T17:00:46", "differentElements": ["description"], "edition": 3}, {"bulletin": {"id": "APPLE:21F236C1A9D411224D0D290A7D88873F", "vendorId": null, "hash": "d1913189105f352fb399e126704668ac", "type": "apple", "bulletinFamily": "software", "title": "About the security content of iOS 10.3.3", "description": "# About the security content of iOS 10.3.3\n\nThis document describes the security content of iOS 10.3.3.\n\n## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss or confirm security issues until an investigation has taken place and patches or releases are available. Recent releases are listed on the [Apple security updates](<https://support.apple.com/en-gb/HT201222>) page.\n\nFor more information about security, see the [Apple Product Security](<https://support.apple.com/en-gb/HT201220>) page. You can encrypt communications with Apple using the [Apple Product Security PGP Key](<https://support.apple.com/en-uk/HT201601>).\n\nApple security documents reference vulnerabilities by [CVE-ID](<http://cve.mitre.org/about/>) when possible.\n\n\n\n## iOS 10.3.3\n\nReleased 19 July 2017\n\n**Contacts**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution\n\nDescription: A buffer overflow issue was addressed through improved memory handling.\n\nCVE-2017-7062: Shashank (@cyberboyIndia)\n\n**CoreAudio**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Processing a maliciously crafted film file may lead to arbitrary code execution\n\nDescription: A memory corruption issue was addressed with improved bounds checking.\n\nCVE-2017-7008: Yangkang (@dnpushme) of Qihoo 360 Qex Team\n\n**EventKitUI**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: A remote attacker may cause an unexpected application termination\n\nDescription: A resource exhaustion issue was addressed through improved input validation.\n\nCVE-2017-7007: Jos\u00e9 Antonio Esteban (@Erratum_) of Sapsi Consultores\n\n**IOUSBFamily**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-7009: shrek_wzw of Qihoo 360 Nirvan Team\n\n**Kernel**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-7022: an anonymous researcher\n\nCVE-2017-7024: an anonymous researcher\n\nCVE-2017-7026: an anonymous researcher\n\n**Kernel**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-7023: an anonymous researcher\n\nCVE-2017-7025: an anonymous researcher\n\nCVE-2017-7027: an anonymous researcher\n\nCVE-2017-7069: Proteas of Qihoo 360 Nirvan Team\n\n**Kernel**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An application may be able to read restricted memory\n\nDescription: A validation issue was addressed with improved input sanitisation.\n\nCVE-2017-7028: an anonymous researcher\n\nCVE-2017-7029: an anonymous researcher\n\n**libarchive**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Unpacking a maliciously crafted archive may lead to arbitrary code execution\n\nDescription: A buffer overflow was addressed through improved bounds checking.\n\nCVE-2017-7068: found by OSS-Fuzz\n\n**libxml2**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Parsing a maliciously crafted XML document may lead to disclosure of user information\n\nDescription: An out-of-bounds read was addressed through improved bounds checking.\n\nCVE-2017-7010: Apple\n\nCVE-2017-7013: found by OSS-Fuzz\n\n**libxpc**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-7047: Ian Beer of Google Project Zero\n\n**Messages**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: A remote attacker may cause an unexpected application termination\n\nDescription: A memory consumption issue was addressed through improved memory handling.\n\nCVE-2017-7063: Shashank (@cyberboyIndia)\n\n**Notifications**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Notifications may appear on the lock screen when disabled\n\nDescription: A lock screen issue was addressed with improved state management.\n\nCVE-2017-7058: Beyza Sevin\u00e7 of S\u00fcleyman Demirel \u00dcniversitesi\n\nEntry updated 28 July 2017\n\n**Safari**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Visiting a malicious website may lead to address bar spoofing\n\nDescription: An inconsistent user interface issue was addressed with improved state management.\n\nCVE-2017-2517: xisigr of Tencent's Xuanwu Lab (tencent.com)\n\n**Safari Printing**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Processing maliciously crafted web content may lead to an infinite number of print dialogs\n\nDescription: An issue existed where a malicious or compromised website could show infinite print dialogs and make users believe their browser was locked. The issue was addressed through throttling of print dialogs.\n\nCVE-2017-7060: Travis Kelley of City of Mishawaka, Indiana\n\n**Telephony**\n\nAvailable for: iPhone 5 and later, and Wi-Fi + Cellular models of iPad 4th generation and later\n\nImpact: An attacker in a privileged network position may be able to execute arbitrary code\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-8248\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: A malicious website may exfiltrate data cross-origin\n\nDescription: Processing maliciously crafted web content may allow cross-origin data to be exfiltrated by using SVG filters to conduct a timing side-channel attack. This issue was addressed by not painting the cross-origin buffer into the frame that gets filtered.\n\nCVE-2017-7006: an anonymous researcher, David Kohlbrenner of UC San Diego\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Visiting a malicious website may lead to address bar spoofing\n\nDescription: A state management issue was addressed with improved frame handling.\n\nCVE-2017-7011: xisigr of Tencent's Xuanwu Lab (tencent.com)\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved memory handling.\n\nCVE-2017-7018: lokihardt of Google Project Zero\n\nCVE-2017-7020: likemeng of Baidu Security Lab\n\nCVE-2017-7030: chenqin of Ant-financial Light-Year Security Lab (\u8682\u8681\u91d1\u670d\u5df4\u65af\u5149\u5e74\u5b89\u5168\u5b9e\u9a8c\u5ba4)\n\nCVE-2017-7034: chenqin of Ant-financial Light-Year Security Lab (\u8682\u8681\u91d1\u670d\u5df4\u65af\u5149\u5e74\u5b89\u5168\u5b9e\u9a8c\u5ba4)\n\nCVE-2017-7037: lokihardt of Google Project Zero\n\nCVE-2017-7039: Ivan Fratric of Google Project Zero\n\nCVE-2017-7040: Ivan Fratric of Google Project Zero\n\nCVE-2017-7041: Ivan Fratric of Google Project Zero\n\nCVE-2017-7042: Ivan Fratric of Google Project Zero\n\nCVE-2017-7043: Ivan Fratric of Google Project Zero\n\nCVE-2017-7046: Ivan Fratric of Google Project Zero\n\nCVE-2017-7048: Ivan Fratric of Google Project Zero\n\nCVE-2017-7052: cc working with Trend Micro's Zero Day Initiative\n\nCVE-2017-7055: The UK's National Cyber Security Centre (NCSC)\n\nCVE-2017-7056: lokihardt of Google Project Zero\n\nCVE-2017-7061: lokihardt of Google Project Zero\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Processing maliciously crafted web content with DOMParser may lead to cross site scripting\n\nDescription: A logic issue existed in the handling of DOMParser. This issue was addressed with improved state management.\n\nCVE-2017-7038: Egor Karbutov (@ShikariSenpai) of Digital Security and Egor Saltykov (@ansjdnakjdnajkd) of Digital Security, Neil Jenkins of FastMail Pty Ltd\n\nCVE-2017-7059: Masato Kinugawa and Mario Heiderich of Cure53\n\nEntry updated 28 July 2017\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed through improved memory handling.\n\nCVE-2017-7049: Ivan Fratric of Google Project Zero\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An application may be able to read restricted memory\n\nDescription: A memory initialisation issue was addressed through improved memory handling.\n\nCVE-2017-7064: lokihardt of Google Project Zero\n\n**WebKit Page Loading**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved memory handling.\n\nCVE-2017-7019: Zhiyang Zeng of Tencent Security Platform Department\n\n**WebKit Web Inspector**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved memory handling.\n\nCVE-2017-7012: Apple\n\n**Wi-Fi**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An attacker within range may be able to execute arbitrary code on the Wi-Fi chip\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-7065: Gal Beniamini of Google Project Zero\n\nEntry added 25 September 2017\n\n**Wi-Fi**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An attacker in Wi-Fi range may be able to cause a denial of service on the Wi-Fi chip\n\nDescription: A memory corruption issue was addressed with improved validation.\n\nCVE-2017-7066: Gal Beniamini of Google Project Zero\n\nEntry added 26 September 2017\n\n**Wi-Fi**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An attacker within range may be able to execute arbitrary code on the Wi-Fi chip\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-9417: Nitay Artenstein of Exodus Intelligence\n\nInformation about products not manufactured by Apple, or independent websites not controlled or tested by Apple, is provided without recommendation or endorsement. Apple assumes no responsibility with regard to the selection, performance or use of third-party websites or products. Apple makes no representations regarding third-party website accuracy or reliability. [Contact the vendor](<http://support.apple.com/en-gb/HT2693>) for additional information.\n\nPublished Date: August 05, 2020\n", "published": "2017-07-19T00:00:00", "modified": "2017-07-19T00:00:00", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {"acInsufInfo": true, "cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 10.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 5.9}, "href": "https://support.apple.com/kb/HT207923", "reporter": "Apple", "references": ["https://support.apple.com/en-us/HT201222"], "cvelist": ["CVE-2017-2517", "CVE-2017-7006", "CVE-2017-7007", "CVE-2017-7008", "CVE-2017-7009", "CVE-2017-7010", "CVE-2017-7011", "CVE-2017-7012", "CVE-2017-7013", "CVE-2017-7018", "CVE-2017-7019", "CVE-2017-7020", "CVE-2017-7022", "CVE-2017-7023", "CVE-2017-7024", "CVE-2017-7025", "CVE-2017-7026", "CVE-2017-7027", "CVE-2017-7028", "CVE-2017-7029", "CVE-2017-7030", "CVE-2017-7034", "CVE-2017-7037", "CVE-2017-7038", "CVE-2017-7039", "CVE-2017-7040", "CVE-2017-7041", "CVE-2017-7042", "CVE-2017-7043", "CVE-2017-7046", "CVE-2017-7047", "CVE-2017-7048", "CVE-2017-7049", "CVE-2017-7052", "CVE-2017-7055", "CVE-2017-7056", "CVE-2017-7058", "CVE-2017-7059", "CVE-2017-7060", "CVE-2017-7061", "CVE-2017-7062", "CVE-2017-7063", "CVE-2017-7064", "CVE-2017-7065", "CVE-2017-7066", "CVE-2017-7068", "CVE-2017-7069", "CVE-2017-8248", "CVE-2017-9417"], "immutableFields": [], "lastseen": "2021-11-13T17:07:28", "history": [], "viewCount": 0, "enchantments": {"dependencies": {"references": [{"type": "nessus", "idList": ["MACOSX_SECUPD2017-003.NASL", "MACOS_ITUNES_12_6_2.NASL", "MACOSX_SAFARI10_1_2.NASL", "FEDORA_2017-73D6A0DFBB.NASL", "FREEBSD_PKG_0F66B901715C11E7AD1FBCAEC565249C.NASL", "700167.PRM", "700169.PRM", "700166.PRM", "ITUNES_12_6_2.NASL", "UBUNTU_USN-3376-1.NASL", "GENTOO_GLSA-201710-14.NASL", "APPLE_IOS_1033_CHECK.NBIN", "FEDORA_2017-9D572CC64A.NASL", "700168.PRM", "ITUNES_12_6_2_BANNER.NASL", "700170.PRM", "FEDORA_2017-24BDDB96B5.NASL"]}, {"type": "apple", "idList": ["APPLE:155325C26D846BCC4F51291908B84E68", "APPLE:502D37318A95B385FB39006D515FD2C7", "APPLE:84CD68EDEDB02B20F3B9B36CE32978CF", "APPLE:3B51A3793E650DEB4D5A524AEB10939D", "APPLE:A45EF6A390F7F91AE1E0B31A361E1EA5", "APPLE:D842C156864A70351F1DAF73F853B39E", "APPLE:B3381378B2D293A36BD1738ADC2FF0EA", "APPLE:D1CDEB8752AB6C8F5120085F64A20A9D", "APPLE:A0476A092DA4082BF1935886E3AAC659", "APPLE:DAC745B8C02D20D12F100A493F79A2C5", "APPLE:815274577073D1B995BDF8EABBECA8B3", "APPLE:37F5E5B333A3674CD65B7E1287333A9E", "APPLE:43A82761AF2332E4585261BA13AEFC4C", "APPLE:62DFB1CE05BA14AE0AFC0750696284DD", "APPLE:25A40F47C0600E8BF083E9F8CF4D02B3", "APPLE:B024BD5A4A1BC1AB787EB653885921E7", "APPLE:4E7284A6AEF4E46C141581D00E147328", "APPLE:DD06626CF4C4BC3354ACDF2F54357778", "APPLE:EA3F435869D64A0598E3657B87468918", "APPLE:CDB5926BE5F0E664D5030C0C869E6E0C", "APPLE:6727C433A1BED2433083F36AE0550F46", "APPLE:596F2B486F0EBB6CEC1147A8407FE60C", "APPLE:644500C0206E86708DC72EEBB59BF5EC", "APPLE:4DC59130923980C324535772E9C08242", "APPLE:D612BFE41CEFBE4E494B64FB483B9B14", "APPLE:083507BEBDEC8A0954D205E0ADD992DE", "APPLE:E6EC20696D0DBE51E54B965532A9E633", "APPLE:6719BBA2C54C882380F2507C6DB8B594", "APPLE:ABA73FEAAAB2192DEAFA24CF2EB1B8F9", "APPLE:F0FD4AF9E934E41AE6B540A3D8BD18F2", "APPLE:7440F921D6E435C184D04D7BBB1C792F", "APPLE:ACE092CEDA446FEA9C5C469D75279A62", "APPLE:83954851679CA201EF1EDF83CE5D2FB9", "APPLE:8B25F57269F562980EF0ED157CF784AD", "APPLE:1C16D7507A975B0063CF2C60AFABD796", "APPLE:1BAEE8F17DD7D2B63370193032CB0611", "APPLE:C6B3A88CDD73B885B12A7090E29D430A", "APPLE:649EC14F69D11DE4A4E4CC7FDD2AE31D", "APPLE:B71AB19607886631A8390750EA7CCE3F", "APPLE:EAA7B151972D42F49D932465866AD0F7", "APPLE:E14BE055BDC628889501E4B8D8323353", "APPLE:9D3E0F979B2323616FFC792A28E9EBCF", "APPLE:5D035145E3EE53A8C36DC063A0DC8B49", "APPLE:CDCA78BF77C684BAA926DF5FFE0759B1", "APPLE:7D0DC7CC460887BCABD42581944E47F4", "APPLE:4EE9E3A8FC6D6AFFAB0C6D52FC5D0FC0", "APPLE:46B417AA5A0A127D706DC5B844F0D8D2", "APPLE:3B8870F50950E87AEF0659EF5C65CFB2", "APPLE:0FDABBE26206F0203F18954597CC1A5D", "APPLE:7EC62CB7770B86C6FBAD6DBD45DFEBDB", "APPLE:93C3C089A84DF055788C6DF8D286780E", "APPLE:0536CA1502248219C54E9CDB47CB476A", "APPLE:EBE92F2438AB1A14C6BDE5158AEA3712", "APPLE:01F01DC42D3C846351C9391E48A3A016", "APPLE:CD72329F98AF4F612400C211AE4DE5CC", "APPLE:C576D3548381302A5BCBE22EF67C0131", "APPLE:HT207921", "APPLE:9A1CF1662DFE33B08BD0240BEB4B2AC9", "APPLE:083455936A7BFF0A7723E989B92D241D", "APPLE:FF13DA99117BB17B1756DC5DE416D8A3", "APPLE:7C7051A76860B9F3DAE82C86DAEF0153", "APPLE:CEC7DCE5379D5C1DBB2795CA582D13CD", "APPLE:8B4FE732ABB73A15CDDCD6E8294E3EF8", "APPLE:850E0FF3FD533A5E9217C78C670C8D25", "APPLE:C50B697E972C6E21765EAA60E58C7164", "APPLE:4DBBB66883DC836291AECACDF707050A", "APPLE:6AE3A9A931912C620F58D34455568B3A", "APPLE:A81762EC72891DE2E2EC4EDE80EB0AEC", "APPLE:B735252C3D9C5C2DDA47BD2AF9C792F9", "APPLE:B3A807C5D0DD225155CDE5C5E2179CEF", "APPLE:HT207927", "APPLE:FE3D63232171294398F45858A10B5295", "APPLE:F234B75385D1403C977E0F0F5AEA4D95", "APPLE:26C36A106263A094CCD2C0719C890E96", "APPLE:DC836966564410BD83E958AC96F8DB12", "APPLE:737483D7FFBE6C182CBD53B150D149C1", "APPLE:HT207923", "APPLE:5819CC48A7438816B3469D0A9F9187AA", "APPLE:BEF29044688160BB997E6A04A1810D9C", "APPLE:AA2FD3FD451FF46FC41684D914CB84ED", "APPLE:HT207925", "APPLE:89861DA71DDD36B8AE0F5BFD245CA715", "APPLE:6F6BF8D47BE448E52B0BCA8D19A345B5", "APPLE:HT207924", "APPLE:8FD7AEB23933D85EE69AC12E78C61047", "APPLE:FC8342DFA1FB389BFF63707187601E04", "APPLE:60BFB2B2ABBB461BE6997F0ACF5B6660", "APPLE:80AF69490F769A089C16F62E11014AFD", "APPLE:285028331CB1F05E710AC01558861C92", "APPLE:D5D920B70CE939C66CFD6D8D9DD56054", "APPLE:7AFC35B4B1D8C25A050E4C951554FD97", "APPLE:BCCCAE11F083D3D4908149AD32040F19", "APPLE:D6FFE312C543C07E83B2A006624D4484", "APPLE:8AE775955605BF8E8F9449AD0B7FAD96", "APPLE:4B48BECF80E840904FBDE3226587C1B1", "APPLE:AA82E5B3EBE5675FCCFBBBEE9BFD411D", "APPLE:55AE5F9E3C7913A2B25FF96BFEF29F8A", "APPLE:FA56DF7B2D68C4F8B67EE47903C325FC", "APPLE:00136C664E46E49235D7BEB52F02D4CB", "APPLE:HT207928", "APPLE:913B7B79E4560DB158829B9D29B2539D", "APPLE:99264BBD02673CF1A5BD1F2971DF24AC", "APPLE:665D8628576372427A4867A3D76727EE", "APPLE:0783FAB2C58195BC3E602300DC944B07", "APPLE:CACA88252C556295CF96592D24F4B9BF", "APPLE:D8AA375B2A70526D307BD55B04B1963B", "APPLE:DE4DB38835B966AACCBFDA230F2290D0", "APPLE:A0D2512CFF25D0D5D3BCE389FDB19F72", "APPLE:12887AB5BB71C26CA347DA603F2A38E5", "APPLE:81D1748785BDBD9E6AAE8352ACF7C294", "APPLE:5754FEDA3B60E2951DA7C9DCE3CCD33B"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310811252", "OPENVAS:1361412562310811251", "OPENVAS:1361412562310873226", "OPENVAS:1361412562310873180", "OPENVAS:1361412562310873200", "OPENVAS:1361412562310811538", "OPENVAS:1361412562310843266", "OPENVAS:1361412562310811535"]}, {"type": "freebsd", "idList": ["0F66B901-715C-11E7-AD1F-BCAEC565249C"]}, {"type": "kaspersky", "idList": ["KLA11075"]}, {"type": "gentoo", "idList": ["GLSA-201710-14"]}, {"type": "fedora", "idList": ["FEDORA:417B06017118", "FEDORA:33FB9639A184", "FEDORA:D681D609273A"]}, {"type": "archlinux", "idList": ["ASA-201707-25"]}, {"type": "ubuntu", "idList": ["USN-3376-1"]}, {"type": "threatpost", "idList": ["THREATPOST:60D5DA46BF733084F46AB656BE8CC259"]}, {"type": "cve", "idList": ["CVE-2017-7029", "CVE-2017-7049", "CVE-2017-7011", "CVE-2017-7047", "CVE-2017-7046", "CVE-2017-9417", "CVE-2017-7043", "CVE-2017-7038", "CVE-2017-7025", "CVE-2017-7012", "CVE-2017-7040", "CVE-2017-7013", "CVE-2017-7069", "CVE-2017-7006", "CVE-2017-7034", "CVE-2017-7022", "CVE-2017-7030", "CVE-2017-7026", "CVE-2017-7008", "CVE-2017-7058", "CVE-2017-7060", "CVE-2017-7010", "CVE-2017-7028", "CVE-2017-7019", "CVE-2017-7041", "CVE-2017-7024", "CVE-2017-8248", "CVE-2017-7037", "CVE-2017-7027", "CVE-2017-7018", "CVE-2017-7020", "CVE-2017-7023", "CVE-2017-7009", "CVE-2017-7007"]}, {"type": "android", "idList": ["ANDROID:CVE-2017-9417", "ANDROID:CVE-2017-8248"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2017-7034", "UB:CVE-2017-7012", "UB:CVE-2017-7030", "UB:CVE-2017-7037", "UB:CVE-2017-7038", "UB:CVE-2017-7018", "UB:CVE-2017-7041", "UB:CVE-2017-7019", "UB:CVE-2017-7020", "UB:CVE-2017-7011", "UB:CVE-2017-7013", "UB:CVE-2017-7061", "UB:CVE-2017-7006", "UB:CVE-2017-7046", "UB:CVE-2017-7040", "UB:CVE-2017-7043", "UB:CVE-2017-7010", "UB:CVE-2017-7049"]}], "modified": "2021-11-13T17:07:28", "rev": 2}, "score": {"value": 6.5, "vector": "NONE", "modified": "2021-11-13T17:07:28", "rev": 2}}, "objectVersion": "1.6", "affectedSoftware": [{"version": "10.3.3", "operator": "lt", "name": "ios"}]}, "lastseen": "2021-11-13T17:07:28", "differentElements": ["description"], "edition": 4}, {"bulletin": {"id": "APPLE:21F236C1A9D411224D0D290A7D88873F", "vendorId": null, "hash": "53f6c089ce85f23b05a5d3e9114dacf2", "type": "apple", "bulletinFamily": "software", "title": "About the security content of iOS 10.3.3", "description": "# About the security content of iOS 10.3.3\n\nThis document describes the security content of iOS 10.3.3.\n\n## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the [Apple security updates](<https://support.apple.com/kb/HT201222>) page.\n\nFor more information about security, see the [Apple Product Security](<https://support.apple.com/kb/HT201220>) page. You can encrypt communications with Apple using the [Apple Product Security PGP Key](<https://support.apple.com/kb/HT201601>).\n\nApple security documents reference vulnerabilities by [CVE-ID](<http://cve.mitre.org/about/>) when possible.\n\n\n\n## iOS 10.3.3\n\nReleased July 19, 2017\n\n**Contacts**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution\n\nDescription: A buffer overflow issue was addressed through improved memory handling.\n\nCVE-2017-7062: Shashank (@cyberboyIndia)\n\n**CoreAudio**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Processing a maliciously crafted movie file may lead to arbitrary code execution\n\nDescription: A memory corruption issue was addressed with improved bounds checking.\n\nCVE-2017-7008: Yangkang (@dnpushme) of Qihoo 360 Qex Team\n\n**EventKitUI**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: A remote attacker may cause an unexpected application termination\n\nDescription: A resource exhaustion issue was addressed through improved input validation.\n\nCVE-2017-7007: Jos\u00e9 Antonio Esteban (@Erratum_) of Sapsi Consultores\n\n**IOUSBFamily**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-7009: shrek_wzw of Qihoo 360 Nirvan Team\n\n**Kernel**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-7022: an anonymous researcher\n\nCVE-2017-7024: an anonymous researcher\n\nCVE-2017-7026: an anonymous researcher\n\n**Kernel**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-7023: an anonymous researcher\n\nCVE-2017-7025: an anonymous researcher\n\nCVE-2017-7027: an anonymous researcher\n\nCVE-2017-7069: Proteas of Qihoo 360 Nirvan Team\n\n**Kernel**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An application may be able to read restricted memory\n\nDescription: A validation issue was addressed with improved input sanitization.\n\nCVE-2017-7028: an anonymous researcher\n\nCVE-2017-7029: an anonymous researcher\n\n**libarchive**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Unpacking a maliciously crafted archive may lead to arbitrary code execution\n\nDescription: A buffer overflow was addressed through improved bounds checking.\n\nCVE-2017-7068: found by OSS-Fuzz\n\n**libxml2**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: Parsing a maliciously crafted XML document may lead to disclosure of user information\n\nDescription: An out-of-bounds read was addressed through improved bounds checking.\n\nCVE-2017-7010: Apple\n\nCVE-2017-7013: found by OSS-Fuzz\n\n**libxpc**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-7047: Ian Beer of Google Project Zero\n\n**Messages**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: A remote attacker may cause an unexpected application termination\n\nDescription: A memory consumption issue was addressed through improved memory handling.\n\nCVE-2017-7063: Shashank (@cyberboyIndia)\n\n**Notifications**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Notifications may appear on the lock screen when disabled\n\nDescription: A lock screen issue was addressed with improved state management.\n\nCVE-2017-7058: Beyza Sevin\u00e7 of S\u00fcleyman Demirel \u00dcniversitesi\n\nEntry updated July 28, 2017\n\n**Safari**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Visiting a malicious website may lead to address bar spoofing\n\nDescription: An inconsistent user interface issue was addressed with improved state management.\n\nCVE-2017-2517: xisigr of Tencent's Xuanwu Lab (tencent.com)\n\n**Safari Printing**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: Processing maliciously crafted web content may lead to an infinite number of print dialogs\n\nDescription: An issue existed where a malicious or compromised website could show infinite print dialogs and make users believe their browser was locked. The issue was addressed through throttling of print dialogs.\n\nCVE-2017-7060: Travis Kelley of City of Mishawaka, Indiana\n\n**Telephony**\n\nAvailable for: iPhone 5 and later, and Wi-Fi + Cellular models of iPad 4th generation and later\n\nImpact: An attacker in a privileged network position may be able to execute arbitrary code\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-8248\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: A malicious website may exfiltrate data cross-origin\n\nDescription: Processing maliciously crafted web content may allow cross-origin data to be exfiltrated by using SVG filters to conduct a timing side-channel attack. This issue was addressed by not painting the cross-origin buffer into the frame that gets filtered.\n\nCVE-2017-7006: an anonymous researcher, David Kohlbrenner of UC San Diego\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Visiting a malicious website may lead to address bar spoofing\n\nDescription: A state management issue was addressed with improved frame handling.\n\nCVE-2017-7011: xisigr of Tencent's Xuanwu Lab (tencent.com)\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved memory handling.\n\nCVE-2017-7018: lokihardt of Google Project Zero\n\nCVE-2017-7020: likemeng of Baidu Security Lab\n\nCVE-2017-7030: chenqin of Ant-financial Light-Year Security Lab (\u8682\u8681\u91d1\u670d\u5df4\u65af\u5149\u5e74\u5b89\u5168\u5b9e\u9a8c\u5ba4)\n\nCVE-2017-7034: chenqin of Ant-financial Light-Year Security Lab (\u8682\u8681\u91d1\u670d\u5df4\u65af\u5149\u5e74\u5b89\u5168\u5b9e\u9a8c\u5ba4)\n\nCVE-2017-7037: lokihardt of Google Project Zero\n\nCVE-2017-7039: Ivan Fratric of Google Project Zero\n\nCVE-2017-7040: Ivan Fratric of Google Project Zero\n\nCVE-2017-7041: Ivan Fratric of Google Project Zero\n\nCVE-2017-7042: Ivan Fratric of Google Project Zero\n\nCVE-2017-7043: Ivan Fratric of Google Project Zero\n\nCVE-2017-7046: Ivan Fratric of Google Project Zero\n\nCVE-2017-7048: Ivan Fratric of Google Project Zero\n\nCVE-2017-7052: cc working with Trend Micro's Zero Day Initiative\n\nCVE-2017-7055: The UK's National Cyber Security Centre (NCSC)\n\nCVE-2017-7056: lokihardt of Google Project Zero\n\nCVE-2017-7061: lokihardt of Google Project Zero\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Processing maliciously crafted web content with DOMParser may lead to cross site scripting\n\nDescription: A logic issue existed in the handling of DOMParser. This issue was addressed with improved state management.\n\nCVE-2017-7038: Egor Karbutov (@ShikariSenpai) of Digital Security and Egor Saltykov (@ansjdnakjdnajkd) of Digital Security, Neil Jenkins of FastMail Pty Ltd\n\nCVE-2017-7059: Masato Kinugawa and Mario Heiderich of Cure53\n\nEntry updated July 28, 2017\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed through improved memory handling.\n\nCVE-2017-7049: Ivan Fratric of Google Project Zero\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An application may be able to read restricted memory\n\nDescription: A memory initialization issue was addressed through improved memory handling.\n\nCVE-2017-7064: lokihardt of Google Project Zero\n\n**WebKit Page Loading**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved memory handling.\n\nCVE-2017-7019: Zhiyang Zeng of Tencent Security Platform Department\n\n**WebKit Web Inspector**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved memory handling.\n\nCVE-2017-7012: Apple\n\n**Wi-Fi**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An attacker within range may be able to execute arbitrary code on the Wi-Fi chip\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-7065: Gal Beniamini of Google Project Zero\n\nEntry added September 25, 2017\n\n**Wi-Fi**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An attacker in Wi-Fi range may be able to cause a denial of service on the Wi-Fi chip\n\nDescription: A memory corruption issue was addressed with improved validation.\n\nCVE-2017-7066: Gal Beniamini of Google Project Zero\n\nEntry added September 26, 2017\n\n**Wi-Fi**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An attacker within range may be able to execute arbitrary code on the Wi-Fi chip\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-9417: Nitay Artenstein of Exodus Intelligence\n\nInformation about products not manufactured by Apple, or independent websites not controlled or tested by Apple, is provided without recommendation or endorsement. Apple assumes no responsibility with regard to the selection, performance, or use of third-party websites or products. Apple makes no representations regarding third-party website accuracy or reliability. [Contact the vendor](<http://support.apple.com/kb/HT2693>) for additional information.\n\nPublished Date: July 27, 2020\n", "published": "2017-07-19T00:00:00", "modified": "2017-07-19T00:00:00", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {"acInsufInfo": true, "cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 10.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 5.9}, "href": "https://support.apple.com/kb/HT207923", "reporter": "Apple", "references": ["https://support.apple.com/en-us/HT201222"], "cvelist": ["CVE-2017-2517", "CVE-2017-7006", "CVE-2017-7007", "CVE-2017-7008", "CVE-2017-7009", "CVE-2017-7010", "CVE-2017-7011", "CVE-2017-7012", "CVE-2017-7013", "CVE-2017-7018", "CVE-2017-7019", "CVE-2017-7020", "CVE-2017-7022", "CVE-2017-7023", "CVE-2017-7024", "CVE-2017-7025", "CVE-2017-7026", "CVE-2017-7027", "CVE-2017-7028", "CVE-2017-7029", "CVE-2017-7030", "CVE-2017-7034", "CVE-2017-7037", "CVE-2017-7038", "CVE-2017-7039", "CVE-2017-7040", "CVE-2017-7041", "CVE-2017-7042", "CVE-2017-7043", "CVE-2017-7046", "CVE-2017-7047", "CVE-2017-7048", "CVE-2017-7049", "CVE-2017-7052", "CVE-2017-7055", "CVE-2017-7056", "CVE-2017-7058", "CVE-2017-7059", "CVE-2017-7060", "CVE-2017-7061", "CVE-2017-7062", "CVE-2017-7063", "CVE-2017-7064", "CVE-2017-7065", "CVE-2017-7066", "CVE-2017-7068", "CVE-2017-7069", "CVE-2017-8248", "CVE-2017-9417"], "immutableFields": [], "lastseen": "2021-11-14T01:02:56", "history": [], "viewCount": 0, "enchantments": {"dependencies": {"references": [{"type": "nessus", "idList": ["700166.PRM", "ITUNES_12_6_2.NASL", "MACOSX_SECUPD2017-003.NASL", "ITUNES_12_6_2_BANNER.NASL", "APPLE_IOS_1033_CHECK.NBIN", "GENTOO_GLSA-201710-14.NASL", "700169.PRM", "FEDORA_2017-73D6A0DFBB.NASL", "UBUNTU_USN-3376-1.NASL", "FEDORA_2017-24BDDB96B5.NASL", "700170.PRM", "FEDORA_2017-9D572CC64A.NASL", "FREEBSD_PKG_0F66B901715C11E7AD1FBCAEC565249C.NASL", "700167.PRM", "MACOS_ITUNES_12_6_2.NASL", "MACOSX_SAFARI10_1_2.NASL", "700168.PRM"]}, {"type": "apple", "idList": ["APPLE:HT207923", "APPLE:89861DA71DDD36B8AE0F5BFD245CA715", "APPLE:665D8628576372427A4867A3D76727EE", "APPLE:4E7284A6AEF4E46C141581D00E147328", "APPLE:B024BD5A4A1BC1AB787EB653885921E7", "APPLE:26C36A106263A094CCD2C0719C890E96", "APPLE:EA3F435869D64A0598E3657B87468918", "APPLE:12887AB5BB71C26CA347DA603F2A38E5", "APPLE:93C3C089A84DF055788C6DF8D286780E", "APPLE:HT207924", "APPLE:FA56DF7B2D68C4F8B67EE47903C325FC", "APPLE:7440F921D6E435C184D04D7BBB1C792F", "APPLE:01F01DC42D3C846351C9391E48A3A016", "APPLE:649EC14F69D11DE4A4E4CC7FDD2AE31D", "APPLE:C50B697E972C6E21765EAA60E58C7164", "APPLE:ABA73FEAAAB2192DEAFA24CF2EB1B8F9", "APPLE:FF13DA99117BB17B1756DC5DE416D8A3", "APPLE:9D3E0F979B2323616FFC792A28E9EBCF", "APPLE:0783FAB2C58195BC3E602300DC944B07", "APPLE:00227F7C8FECB8511DEA87CEE1A35651", "APPLE:80AF69490F769A089C16F62E11014AFD", "APPLE:B735252C3D9C5C2DDA47BD2AF9C792F9", "APPLE:DD06626CF4C4BC3354ACDF2F54357778", "APPLE:815274577073D1B995BDF8EABBECA8B3", "APPLE:083507BEBDEC8A0954D205E0ADD992DE", "APPLE:6719BBA2C54C882380F2507C6DB8B594", "APPLE:25A40F47C0600E8BF083E9F8CF4D02B3", "APPLE:FC8342DFA1FB389BFF63707187601E04", "APPLE:HT207921", "APPLE:8AE775955605BF8E8F9449AD0B7FAD96", "APPLE:C6B3A88CDD73B885B12A7090E29D430A", "APPLE:HT207925", "APPLE:43A82761AF2332E4585261BA13AEFC4C", "APPLE:8E2DBBB775EAF9EB0E77728F1F327519", "APPLE:CDCA78BF77C684BAA926DF5FFE0759B1", "APPLE:502D37318A95B385FB39006D515FD2C7", "APPLE:BCCCAE11F083D3D4908149AD32040F19", "APPLE:083455936A7BFF0A7723E989B92D241D", "APPLE:5819CC48A7438816B3469D0A9F9187AA", "APPLE:EBE92F2438AB1A14C6BDE5158AEA3712", "APPLE:3B51A3793E650DEB4D5A524AEB10939D", "APPLE:4EE9E3A8FC6D6AFFAB0C6D52FC5D0FC0", "APPLE:0FDABBE26206F0203F18954597CC1A5D", "APPLE:EAA7B151972D42F49D932465866AD0F7", "APPLE:F234B75385D1403C977E0F0F5AEA4D95", "APPLE:D8AA375B2A70526D307BD55B04B1963B", "APPLE:AA2FD3FD451FF46FC41684D914CB84ED", "APPLE:1C16D7507A975B0063CF2C60AFABD796", "APPLE:DAC745B8C02D20D12F100A493F79A2C5", "APPLE:4B48BECF80E840904FBDE3226587C1B1", "APPLE:CEC7DCE5379D5C1DBB2795CA582D13CD", "APPLE:D1CDEB8752AB6C8F5120085F64A20A9D", "APPLE:B71AB19607886631A8390750EA7CCE3F", "APPLE:CDB5926BE5F0E664D5030C0C869E6E0C", "APPLE:285028331CB1F05E710AC01558861C92", "APPLE:62DFB1CE05BA14AE0AFC0750696284DD", "APPLE:D842C156864A70351F1DAF73F853B39E", "APPLE:7AFC35B4B1D8C25A050E4C951554FD97", "APPLE:99264BBD02673CF1A5BD1F2971DF24AC", "APPLE:D612BFE41CEFBE4E494B64FB483B9B14", "APPLE:9A1CF1662DFE33B08BD0240BEB4B2AC9", "APPLE:FE3D63232171294398F45858A10B5295", "APPLE:0536CA1502248219C54E9CDB47CB476A", "APPLE:A0476A092DA4082BF1935886E3AAC659", "APPLE:5D035145E3EE53A8C36DC063A0DC8B49", "APPLE:4DC59130923980C324535772E9C08242", "APPLE:E14BE055BDC628889501E4B8D8323353", "APPLE:DE4DB38835B966AACCBFDA230F2290D0", "APPLE:83954851679CA201EF1EDF83CE5D2FB9", "APPLE:F0FD4AF9E934E41AE6B540A3D8BD18F2", "APPLE:737483D7FFBE6C182CBD53B150D149C1", "APPLE:644500C0206E86708DC72EEBB59BF5EC", "APPLE:B3381378B2D293A36BD1738ADC2FF0EA", "APPLE:DC836966564410BD83E958AC96F8DB12", "APPLE:55AE5F9E3C7913A2B25FF96BFEF29F8A", "APPLE:81D1748785BDBD9E6AAE8352ACF7C294", "APPLE:850E0FF3FD533A5E9217C78C670C8D25", "APPLE:00136C664E46E49235D7BEB52F02D4CB", "APPLE:7EC62CB7770B86C6FBAD6DBD45DFEBDB", "APPLE:CD72329F98AF4F612400C211AE4DE5CC", "APPLE:1BAEE8F17DD7D2B63370193032CB0611", "APPLE:6F6BF8D47BE448E52B0BCA8D19A345B5", "APPLE:596F2B486F0EBB6CEC1147A8407FE60C", "APPLE:D6FFE312C543C07E83B2A006624D4484", "APPLE:AA82E5B3EBE5675FCCFBBBEE9BFD411D", "APPLE:37F5E5B333A3674CD65B7E1287333A9E", "APPLE:46B417AA5A0A127D706DC5B844F0D8D2", "APPLE:BEF29044688160BB997E6A04A1810D9C", "APPLE:3B8870F50950E87AEF0659EF5C65CFB2", "APPLE:0474FDB2C3BAED2BEB8F3F589A9A751B", "APPLE:60BFB2B2ABBB461BE6997F0ACF5B6660", "APPLE:4DBBB66883DC836291AECACDF707050A", "APPLE:HT207927", "APPLE:155325C26D846BCC4F51291908B84E68", "APPLE:5754FEDA3B60E2951DA7C9DCE3CCD33B", "APPLE:913B7B79E4560DB158829B9D29B2539D", "APPLE:7D0DC7CC460887BCABD42581944E47F4", "APPLE:B3A807C5D0DD225155CDE5C5E2179CEF", "APPLE:E6EC20696D0DBE51E54B965532A9E633", "APPLE:A0D2512CFF25D0D5D3BCE389FDB19F72", "APPLE:7C7051A76860B9F3DAE82C86DAEF0153", "APPLE:C576D3548381302A5BCBE22EF67C0131", "APPLE:84CD68EDEDB02B20F3B9B36CE32978CF", "APPLE:6AE3A9A931912C620F58D34455568B3A", "APPLE:ACE092CEDA446FEA9C5C469D75279A62", "APPLE:6727C433A1BED2433083F36AE0550F46", "APPLE:HT207928", "APPLE:CACA88252C556295CF96592D24F4B9BF", "APPLE:A81762EC72891DE2E2EC4EDE80EB0AEC", "APPLE:D5D920B70CE939C66CFD6D8D9DD56054", "APPLE:8FD7AEB23933D85EE69AC12E78C61047"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310873200", "OPENVAS:1361412562310811538", "OPENVAS:1361412562310811535", "OPENVAS:1361412562310811251", "OPENVAS:1361412562310811252", "OPENVAS:1361412562310873180", "OPENVAS:1361412562310843266", "OPENVAS:1361412562310873226"]}, {"type": "freebsd", "idList": ["0F66B901-715C-11E7-AD1F-BCAEC565249C"]}, {"type": "kaspersky", "idList": ["KLA11075"]}, {"type": "gentoo", "idList": ["GLSA-201710-14"]}, {"type": "fedora", "idList": ["FEDORA:33FB9639A184", "FEDORA:417B06017118", "FEDORA:D681D609273A"]}, {"type": "archlinux", "idList": ["ASA-201707-25"]}, {"type": "ubuntu", "idList": ["USN-3376-1"]}, {"type": "threatpost", "idList": ["THREATPOST:60D5DA46BF733084F46AB656BE8CC259"]}, {"type": "cve", "idList": ["CVE-2017-7025", "CVE-2017-7034", "CVE-2017-8248", "CVE-2017-7013", "CVE-2017-7060", "CVE-2017-7069", "CVE-2017-7010", "CVE-2017-7028", "CVE-2017-7007", "CVE-2017-7011", "CVE-2017-7023", "CVE-2017-7058", "CVE-2017-7063", "CVE-2017-7012", "CVE-2017-7037", "CVE-2017-7040", "CVE-2017-7043", "CVE-2017-7049", "CVE-2017-7026", "CVE-2017-7041", "CVE-2017-7030", "CVE-2017-7046", "CVE-2017-7020", "CVE-2017-7038", "CVE-2017-7047", "CVE-2017-7009", "CVE-2017-7027", "CVE-2017-7022", "CVE-2017-7024", "CVE-2017-7019", "CVE-2017-7018", "CVE-2017-9417", "CVE-2017-7029", "CVE-2017-7006", "CVE-2017-7008"]}, {"type": "android", "idList": ["ANDROID:CVE-2017-8248", "ANDROID:CVE-2017-9417"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2017-7018", "UB:CVE-2017-7011", "UB:CVE-2017-7049", "UB:CVE-2017-7037", "UB:CVE-2017-7020", "UB:CVE-2017-7043", "UB:CVE-2017-7030", "UB:CVE-2017-7040", "UB:CVE-2017-7046", "UB:CVE-2017-7013", "UB:CVE-2017-7010", "UB:CVE-2017-7034", "UB:CVE-2017-7041", "UB:CVE-2017-7019", "UB:CVE-2017-7006", "UB:CVE-2017-7012", "UB:CVE-2017-7038"]}], "modified": "2021-11-14T01:02:56", "rev": 2}, "score": {"value": 6.4, "vector": "NONE", "modified": "2021-11-14T01:02:56", "rev": 2}}, "objectVersion": "1.6", "affectedSoftware": [{"version": "10.3.3", "operator": "lt", "name": "ios"}]}, "lastseen": "2021-11-14T01:02:56", "differentElements": ["description"], "edition": 5}, {"bulletin": {"id": "APPLE:21F236C1A9D411224D0D290A7D88873F", "vendorId": null, "hash": "d1913189105f352fb399e126704668ac", "type": "apple", "bulletinFamily": "software", "title": "About the security content of iOS 10.3.3", "description": "# About the security content of iOS 10.3.3\n\nThis document describes the security content of iOS 10.3.3.\n\n## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss or confirm security issues until an investigation has taken place and patches or releases are available. Recent releases are listed on the [Apple security updates](<https://support.apple.com/en-gb/HT201222>) page.\n\nFor more information about security, see the [Apple Product Security](<https://support.apple.com/en-gb/HT201220>) page. You can encrypt communications with Apple using the [Apple Product Security PGP Key](<https://support.apple.com/en-uk/HT201601>).\n\nApple security documents reference vulnerabilities by [CVE-ID](<http://cve.mitre.org/about/>) when possible.\n\n\n\n## iOS 10.3.3\n\nReleased 19 July 2017\n\n**Contacts**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution\n\nDescription: A buffer overflow issue was addressed through improved memory handling.\n\nCVE-2017-7062: Shashank (@cyberboyIndia)\n\n**CoreAudio**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Processing a maliciously crafted film file may lead to arbitrary code execution\n\nDescription: A memory corruption issue was addressed with improved bounds checking.\n\nCVE-2017-7008: Yangkang (@dnpushme) of Qihoo 360 Qex Team\n\n**EventKitUI**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: A remote attacker may cause an unexpected application termination\n\nDescription: A resource exhaustion issue was addressed through improved input validation.\n\nCVE-2017-7007: Jos\u00e9 Antonio Esteban (@Erratum_) of Sapsi Consultores\n\n**IOUSBFamily**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-7009: shrek_wzw of Qihoo 360 Nirvan Team\n\n**Kernel**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-7022: an anonymous researcher\n\nCVE-2017-7024: an anonymous researcher\n\nCVE-2017-7026: an anonymous researcher\n\n**Kernel**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-7023: an anonymous researcher\n\nCVE-2017-7025: an anonymous researcher\n\nCVE-2017-7027: an anonymous researcher\n\nCVE-2017-7069: Proteas of Qihoo 360 Nirvan Team\n\n**Kernel**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An application may be able to read restricted memory\n\nDescription: A validation issue was addressed with improved input sanitisation.\n\nCVE-2017-7028: an anonymous researcher\n\nCVE-2017-7029: an anonymous researcher\n\n**libarchive**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Unpacking a maliciously crafted archive may lead to arbitrary code execution\n\nDescription: A buffer overflow was addressed through improved bounds checking.\n\nCVE-2017-7068: found by OSS-Fuzz\n\n**libxml2**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Parsing a maliciously crafted XML document may lead to disclosure of user information\n\nDescription: An out-of-bounds read was addressed through improved bounds checking.\n\nCVE-2017-7010: Apple\n\nCVE-2017-7013: found by OSS-Fuzz\n\n**libxpc**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-7047: Ian Beer of Google Project Zero\n\n**Messages**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: A remote attacker may cause an unexpected application termination\n\nDescription: A memory consumption issue was addressed through improved memory handling.\n\nCVE-2017-7063: Shashank (@cyberboyIndia)\n\n**Notifications**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Notifications may appear on the lock screen when disabled\n\nDescription: A lock screen issue was addressed with improved state management.\n\nCVE-2017-7058: Beyza Sevin\u00e7 of S\u00fcleyman Demirel \u00dcniversitesi\n\nEntry updated 28 July 2017\n\n**Safari**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Visiting a malicious website may lead to address bar spoofing\n\nDescription: An inconsistent user interface issue was addressed with improved state management.\n\nCVE-2017-2517: xisigr of Tencent's Xuanwu Lab (tencent.com)\n\n**Safari Printing**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Processing maliciously crafted web content may lead to an infinite number of print dialogs\n\nDescription: An issue existed where a malicious or compromised website could show infinite print dialogs and make users believe their browser was locked. The issue was addressed through throttling of print dialogs.\n\nCVE-2017-7060: Travis Kelley of City of Mishawaka, Indiana\n\n**Telephony**\n\nAvailable for: iPhone 5 and later, and Wi-Fi + Cellular models of iPad 4th generation and later\n\nImpact: An attacker in a privileged network position may be able to execute arbitrary code\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-8248\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: A malicious website may exfiltrate data cross-origin\n\nDescription: Processing maliciously crafted web content may allow cross-origin data to be exfiltrated by using SVG filters to conduct a timing side-channel attack. This issue was addressed by not painting the cross-origin buffer into the frame that gets filtered.\n\nCVE-2017-7006: an anonymous researcher, David Kohlbrenner of UC San Diego\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Visiting a malicious website may lead to address bar spoofing\n\nDescription: A state management issue was addressed with improved frame handling.\n\nCVE-2017-7011: xisigr of Tencent's Xuanwu Lab (tencent.com)\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved memory handling.\n\nCVE-2017-7018: lokihardt of Google Project Zero\n\nCVE-2017-7020: likemeng of Baidu Security Lab\n\nCVE-2017-7030: chenqin of Ant-financial Light-Year Security Lab (\u8682\u8681\u91d1\u670d\u5df4\u65af\u5149\u5e74\u5b89\u5168\u5b9e\u9a8c\u5ba4)\n\nCVE-2017-7034: chenqin of Ant-financial Light-Year Security Lab (\u8682\u8681\u91d1\u670d\u5df4\u65af\u5149\u5e74\u5b89\u5168\u5b9e\u9a8c\u5ba4)\n\nCVE-2017-7037: lokihardt of Google Project Zero\n\nCVE-2017-7039: Ivan Fratric of Google Project Zero\n\nCVE-2017-7040: Ivan Fratric of Google Project Zero\n\nCVE-2017-7041: Ivan Fratric of Google Project Zero\n\nCVE-2017-7042: Ivan Fratric of Google Project Zero\n\nCVE-2017-7043: Ivan Fratric of Google Project Zero\n\nCVE-2017-7046: Ivan Fratric of Google Project Zero\n\nCVE-2017-7048: Ivan Fratric of Google Project Zero\n\nCVE-2017-7052: cc working with Trend Micro's Zero Day Initiative\n\nCVE-2017-7055: The UK's National Cyber Security Centre (NCSC)\n\nCVE-2017-7056: lokihardt of Google Project Zero\n\nCVE-2017-7061: lokihardt of Google Project Zero\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Processing maliciously crafted web content with DOMParser may lead to cross site scripting\n\nDescription: A logic issue existed in the handling of DOMParser. This issue was addressed with improved state management.\n\nCVE-2017-7038: Egor Karbutov (@ShikariSenpai) of Digital Security and Egor Saltykov (@ansjdnakjdnajkd) of Digital Security, Neil Jenkins of FastMail Pty Ltd\n\nCVE-2017-7059: Masato Kinugawa and Mario Heiderich of Cure53\n\nEntry updated 28 July 2017\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed through improved memory handling.\n\nCVE-2017-7049: Ivan Fratric of Google Project Zero\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An application may be able to read restricted memory\n\nDescription: A memory initialisation issue was addressed through improved memory handling.\n\nCVE-2017-7064: lokihardt of Google Project Zero\n\n**WebKit Page Loading**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved memory handling.\n\nCVE-2017-7019: Zhiyang Zeng of Tencent Security Platform Department\n\n**WebKit Web Inspector**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved memory handling.\n\nCVE-2017-7012: Apple\n\n**Wi-Fi**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An attacker within range may be able to execute arbitrary code on the Wi-Fi chip\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-7065: Gal Beniamini of Google Project Zero\n\nEntry added 25 September 2017\n\n**Wi-Fi**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An attacker in Wi-Fi range may be able to cause a denial of service on the Wi-Fi chip\n\nDescription: A memory corruption issue was addressed with improved validation.\n\nCVE-2017-7066: Gal Beniamini of Google Project Zero\n\nEntry added 26 September 2017\n\n**Wi-Fi**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An attacker within range may be able to execute arbitrary code on the Wi-Fi chip\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-9417: Nitay Artenstein of Exodus Intelligence\n\nInformation about products not manufactured by Apple, or independent websites not controlled or tested by Apple, is provided without recommendation or endorsement. Apple assumes no responsibility with regard to the selection, performance or use of third-party websites or products. Apple makes no representations regarding third-party website accuracy or reliability. [Contact the vendor](<http://support.apple.com/en-gb/HT2693>) for additional information.\n\nPublished Date: August 05, 2020\n", "published": "2017-07-19T00:00:00", "modified": "2017-07-19T00:00:00", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {"acInsufInfo": true, "cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 10.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 5.9}, "href": "https://support.apple.com/kb/HT207923", "reporter": "Apple", "references": ["https://support.apple.com/en-us/HT201222"], "cvelist": ["CVE-2017-2517", "CVE-2017-7006", "CVE-2017-7007", "CVE-2017-7008", "CVE-2017-7009", "CVE-2017-7010", "CVE-2017-7011", "CVE-2017-7012", "CVE-2017-7013", "CVE-2017-7018", "CVE-2017-7019", "CVE-2017-7020", "CVE-2017-7022", "CVE-2017-7023", "CVE-2017-7024", "CVE-2017-7025", "CVE-2017-7026", "CVE-2017-7027", "CVE-2017-7028", "CVE-2017-7029", "CVE-2017-7030", "CVE-2017-7034", "CVE-2017-7037", "CVE-2017-7038", "CVE-2017-7039", "CVE-2017-7040", "CVE-2017-7041", "CVE-2017-7042", "CVE-2017-7043", "CVE-2017-7046", "CVE-2017-7047", "CVE-2017-7048", "CVE-2017-7049", "CVE-2017-7052", "CVE-2017-7055", "CVE-2017-7056", "CVE-2017-7058", "CVE-2017-7059", "CVE-2017-7060", "CVE-2017-7061", "CVE-2017-7062", "CVE-2017-7063", "CVE-2017-7064", "CVE-2017-7065", "CVE-2017-7066", "CVE-2017-7068", "CVE-2017-7069", "CVE-2017-8248", "CVE-2017-9417"], "immutableFields": [], "lastseen": "2021-11-14T17:00:42", "history": [], "viewCount": 0, "enchantments": {"dependencies": {"references": [{"type": "nessus", "idList": ["APPLE_IOS_1033_CHECK.NBIN", "FEDORA_2017-73D6A0DFBB.NASL", "700167.PRM", "FEDORA_2017-9D572CC64A.NASL", "700169.PRM", "FREEBSD_PKG_0F66B901715C11E7AD1FBCAEC565249C.NASL", "ITUNES_12_6_2.NASL", "UBUNTU_USN-3376-1.NASL", "MACOSX_SAFARI10_1_2.NASL", "ITUNES_12_6_2_BANNER.NASL", "700170.PRM", "700166.PRM", "700168.PRM", "FEDORA_2017-24BDDB96B5.NASL", "MACOSX_SECUPD2017-003.NASL", "GENTOO_GLSA-201710-14.NASL", "MACOS_ITUNES_12_6_2.NASL"]}, {"type": "apple", "idList": ["APPLE:815274577073D1B995BDF8EABBECA8B3", "APPLE:99264BBD02673CF1A5BD1F2971DF24AC", "APPLE:ABA73FEAAAB2192DEAFA24CF2EB1B8F9", "APPLE:80AF69490F769A089C16F62E11014AFD", "APPLE:850E0FF3FD533A5E9217C78C670C8D25", "APPLE:A81762EC72891DE2E2EC4EDE80EB0AEC", "APPLE:6AE3A9A931912C620F58D34455568B3A", "APPLE:62DFB1CE05BA14AE0AFC0750696284DD", "APPLE:8B25F57269F562980EF0ED157CF784AD", "APPLE:BEF29044688160BB997E6A04A1810D9C", "APPLE:A0D2512CFF25D0D5D3BCE389FDB19F72", "APPLE:5D035145E3EE53A8C36DC063A0DC8B49", "APPLE:FA56DF7B2D68C4F8B67EE47903C325FC", "APPLE:84CD68EDEDB02B20F3B9B36CE32978CF", "APPLE:649EC14F69D11DE4A4E4CC7FDD2AE31D", "APPLE:4EE9E3A8FC6D6AFFAB0C6D52FC5D0FC0", "APPLE:HT207925", "APPLE:8AE775955605BF8E8F9449AD0B7FAD96", "APPLE:0600663770AF736F5725D3DB90C23B77", "APPLE:7EC62CB7770B86C6FBAD6DBD45DFEBDB", "APPLE:E14BE055BDC628889501E4B8D8323353", "APPLE:37F5E5B333A3674CD65B7E1287333A9E", "APPLE:6719BBA2C54C882380F2507C6DB8B594", "APPLE:HT207921", "APPLE:3B51A3793E650DEB4D5A524AEB10939D", "APPLE:CDCA78BF77C684BAA926DF5FFE0759B1", "APPLE:8E2DBBB775EAF9EB0E77728F1F327519", "APPLE:D5D920B70CE939C66CFD6D8D9DD56054", "APPLE:00227F7C8FECB8511DEA87CEE1A35651", "APPLE:CD72329F98AF4F612400C211AE4DE5CC", "APPLE:1BAEE8F17DD7D2B63370193032CB0611", "APPLE:B735252C3D9C5C2DDA47BD2AF9C792F9", "APPLE:737483D7FFBE6C182CBD53B150D149C1", "APPLE:FC8342DFA1FB389BFF63707187601E04", "APPLE:DE4DB38835B966AACCBFDA230F2290D0", "APPLE:C3934642F271B78BEB3119DF3A66FB91", "APPLE:B024BD5A4A1BC1AB787EB653885921E7", "APPLE:155325C26D846BCC4F51291908B84E68", "APPLE:HT207924", "APPLE:0FDABBE26206F0203F18954597CC1A5D", "APPLE:BF63E0940D677DE6F4EA077CCBC8E3D4", "APPLE:7C7051A76860B9F3DAE82C86DAEF0153", "APPLE:60BFB2B2ABBB461BE6997F0ACF5B6660", "APPLE:FF13DA99117BB17B1756DC5DE416D8A3", "APPLE:FE3D63232171294398F45858A10B5295", "APPLE:93C3C089A84DF055788C6DF8D286780E", "APPLE:83954851679CA201EF1EDF83CE5D2FB9", "APPLE:HT207927", "APPLE:52BCF4A20C9E6FF472F7E0FCF7A73C12", "APPLE:00136C664E46E49235D7BEB52F02D4CB", "APPLE:HT207928", "APPLE:6F6BF8D47BE448E52B0BCA8D19A345B5", "APPLE:7D0DC7CC460887BCABD42581944E47F4", "APPLE:EAA7B151972D42F49D932465866AD0F7", "APPLE:7440F921D6E435C184D04D7BBB1C792F", "APPLE:3B8870F50950E87AEF0659EF5C65CFB2", "APPLE:DC836966564410BD83E958AC96F8DB12", "APPLE:ACE092CEDA446FEA9C5C469D75279A62", "APPLE:43A82761AF2332E4585261BA13AEFC4C", "APPLE:AA82E5B3EBE5675FCCFBBBEE9BFD411D", "APPLE:A0476A092DA4082BF1935886E3AAC659", "APPLE:7AFC35B4B1D8C25A050E4C951554FD97", "APPLE:DA07741FDE768B9B04857BE30D2B7CE9", "APPLE:502D37318A95B385FB39006D515FD2C7", "APPLE:D1CDEB8752AB6C8F5120085F64A20A9D", "APPLE:B3381378B2D293A36BD1738ADC2FF0EA", "APPLE:D842C156864A70351F1DAF73F853B39E", "APPLE:12887AB5BB71C26CA347DA603F2A38E5", "APPLE:CACA88252C556295CF96592D24F4B9BF", "APPLE:C50B697E972C6E21765EAA60E58C7164", "APPLE:083455936A7BFF0A7723E989B92D241D", "APPLE:C576D3548381302A5BCBE22EF67C0131", "APPLE:C6B3A88CDD73B885B12A7090E29D430A", "APPLE:CEC7DCE5379D5C1DBB2795CA582D13CD", "APPLE:D6FFE312C543C07E83B2A006624D4484", "APPLE:5819CC48A7438816B3469D0A9F9187AA", "APPLE:A45EF6A390F7F91AE1E0B31A361E1EA5", "APPLE:665D8628576372427A4867A3D76727EE", "APPLE:6727C433A1BED2433083F36AE0550F46", "APPLE:5A7667EB1C2807FB57684E7C75480D66", "APPLE:01F01DC42D3C846351C9391E48A3A016", "APPLE:4DBBB66883DC836291AECACDF707050A", "APPLE:AA2FD3FD451FF46FC41684D914CB84ED", "APPLE:285028331CB1F05E710AC01558861C92", "APPLE:D612BFE41CEFBE4E494B64FB483B9B14", "APPLE:B3A807C5D0DD225155CDE5C5E2179CEF", "APPLE:6FE699DFD1960FA47DAB0799E13A4698", "APPLE:26C36A106263A094CCD2C0719C890E96", "APPLE:B71AB19607886631A8390750EA7CCE3F", "APPLE:644500C0206E86708DC72EEBB59BF5EC", "APPLE:E6EC20696D0DBE51E54B965532A9E633", "APPLE:27AB2999EC34EB5C57F0EBF39ED32563", "APPLE:596F2B486F0EBB6CEC1147A8407FE60C", "APPLE:89861DA71DDD36B8AE0F5BFD245CA715", "APPLE:4E7284A6AEF4E46C141581D00E147328", "APPLE:4B48BECF80E840904FBDE3226587C1B1", "APPLE:4DC59130923980C324535772E9C08242", "APPLE:DAC745B8C02D20D12F100A493F79A2C5", "APPLE:9A1CF1662DFE33B08BD0240BEB4B2AC9", "APPLE:913B7B79E4560DB158829B9D29B2539D", "APPLE:1C16D7507A975B0063CF2C60AFABD796", "APPLE:8FD7AEB23933D85EE69AC12E78C61047", "APPLE:CDB5926BE5F0E664D5030C0C869E6E0C", "APPLE:81D1748785BDBD9E6AAE8352ACF7C294", "APPLE:0536CA1502248219C54E9CDB47CB476A", "APPLE:F234B75385D1403C977E0F0F5AEA4D95", "APPLE:D8AA375B2A70526D307BD55B04B1963B", "APPLE:25A40F47C0600E8BF083E9F8CF4D02B3", "APPLE:8B4FE732ABB73A15CDDCD6E8294E3EF8", "APPLE:083507BEBDEC8A0954D205E0ADD992DE", "APPLE:HT207923"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310873200", "OPENVAS:1361412562310873180", "OPENVAS:1361412562310873226", "OPENVAS:1361412562310843266", "OPENVAS:1361412562310811252", "OPENVAS:1361412562310811535", "OPENVAS:1361412562310811538", "OPENVAS:1361412562310811251"]}, {"type": "freebsd", "idList": ["0F66B901-715C-11E7-AD1F-BCAEC565249C"]}, {"type": "kaspersky", "idList": ["KLA11075"]}, {"type": "gentoo", "idList": ["GLSA-201710-14"]}, {"type": "fedora", "idList": ["FEDORA:33FB9639A184", "FEDORA:417B06017118", "FEDORA:D681D609273A"]}, {"type": "archlinux", "idList": ["ASA-201707-25"]}, {"type": "ubuntu", "idList": ["USN-3376-1"]}, {"type": "threatpost", "idList": ["THREATPOST:60D5DA46BF733084F46AB656BE8CC259"]}, {"type": "cve", "idList": ["CVE-2017-7019", "CVE-2017-7007", "CVE-2017-7038", "CVE-2017-7006", "CVE-2017-7040", "CVE-2017-7024", "CVE-2017-7027", "CVE-2017-7047", "CVE-2017-7028", "CVE-2017-7043", "CVE-2017-7020", "CVE-2017-7060", "CVE-2017-9417", "CVE-2017-7012", "CVE-2017-7018", "CVE-2017-7030", "CVE-2017-7009", "CVE-2017-7029", "CVE-2017-7025", "CVE-2017-7046", "CVE-2017-7022", "CVE-2017-7049", "CVE-2017-7010", "CVE-2017-7069", "CVE-2017-7026", "CVE-2017-7011", "CVE-2017-7058", "CVE-2017-7037", "CVE-2017-8248", "CVE-2017-7008", "CVE-2017-7013", "CVE-2017-7041", "CVE-2017-7023", "CVE-2017-7034"]}, {"type": "android", "idList": ["ANDROID:CVE-2017-8248", "ANDROID:CVE-2017-9417"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2017-7049", "UB:CVE-2017-7020", "UB:CVE-2017-7011", "UB:CVE-2017-7041", "UB:CVE-2017-7018", "UB:CVE-2017-7013", "UB:CVE-2017-7019", "UB:CVE-2017-7043", "UB:CVE-2017-7034", "UB:CVE-2017-7010", "UB:CVE-2017-7046", "UB:CVE-2017-7040", "UB:CVE-2017-7061", "UB:CVE-2017-7012", "UB:CVE-2017-7037", "UB:CVE-2017-7038", "UB:CVE-2017-7030", "UB:CVE-2017-7006"]}], "modified": "2021-11-14T17:00:42", "rev": 2}, "score": {"value": 6.5, "vector": "NONE", "modified": "2021-11-14T17:00:42", "rev": 2}}, "objectVersion": "1.6", "affectedSoftware": [{"version": "10.3.3", "operator": "lt", "name": "ios"}]}, "lastseen": "2021-11-14T17:00:42", "differentElements": ["description"], "edition": 6}, {"bulletin": {"id": "APPLE:21F236C1A9D411224D0D290A7D88873F", "vendorId": null, "hash": "53f6c089ce85f23b05a5d3e9114dacf2", "type": "apple", "bulletinFamily": "software", "title": "About the security content of iOS 10.3.3", "description": "# About the security content of iOS 10.3.3\n\nThis document describes the security content of iOS 10.3.3.\n\n## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the [Apple security updates](<https://support.apple.com/kb/HT201222>) page.\n\nFor more information about security, see the [Apple Product Security](<https://support.apple.com/kb/HT201220>) page. You can encrypt communications with Apple using the [Apple Product Security PGP Key](<https://support.apple.com/kb/HT201601>).\n\nApple security documents reference vulnerabilities by [CVE-ID](<http://cve.mitre.org/about/>) when possible.\n\n\n\n## iOS 10.3.3\n\nReleased July 19, 2017\n\n**Contacts**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution\n\nDescription: A buffer overflow issue was addressed through improved memory handling.\n\nCVE-2017-7062: Shashank (@cyberboyIndia)\n\n**CoreAudio**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Processing a maliciously crafted movie file may lead to arbitrary code execution\n\nDescription: A memory corruption issue was addressed with improved bounds checking.\n\nCVE-2017-7008: Yangkang (@dnpushme) of Qihoo 360 Qex Team\n\n**EventKitUI**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: A remote attacker may cause an unexpected application termination\n\nDescription: A resource exhaustion issue was addressed through improved input validation.\n\nCVE-2017-7007: Jos\u00e9 Antonio Esteban (@Erratum_) of Sapsi Consultores\n\n**IOUSBFamily**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-7009: shrek_wzw of Qihoo 360 Nirvan Team\n\n**Kernel**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-7022: an anonymous researcher\n\nCVE-2017-7024: an anonymous researcher\n\nCVE-2017-7026: an anonymous researcher\n\n**Kernel**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-7023: an anonymous researcher\n\nCVE-2017-7025: an anonymous researcher\n\nCVE-2017-7027: an anonymous researcher\n\nCVE-2017-7069: Proteas of Qihoo 360 Nirvan Team\n\n**Kernel**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An application may be able to read restricted memory\n\nDescription: A validation issue was addressed with improved input sanitization.\n\nCVE-2017-7028: an anonymous researcher\n\nCVE-2017-7029: an anonymous researcher\n\n**libarchive**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Unpacking a maliciously crafted archive may lead to arbitrary code execution\n\nDescription: A buffer overflow was addressed through improved bounds checking.\n\nCVE-2017-7068: found by OSS-Fuzz\n\n**libxml2**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: Parsing a maliciously crafted XML document may lead to disclosure of user information\n\nDescription: An out-of-bounds read was addressed through improved bounds checking.\n\nCVE-2017-7010: Apple\n\nCVE-2017-7013: found by OSS-Fuzz\n\n**libxpc**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-7047: Ian Beer of Google Project Zero\n\n**Messages**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: A remote attacker may cause an unexpected application termination\n\nDescription: A memory consumption issue was addressed through improved memory handling.\n\nCVE-2017-7063: Shashank (@cyberboyIndia)\n\n**Notifications**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Notifications may appear on the lock screen when disabled\n\nDescription: A lock screen issue was addressed with improved state management.\n\nCVE-2017-7058: Beyza Sevin\u00e7 of S\u00fcleyman Demirel \u00dcniversitesi\n\nEntry updated July 28, 2017\n\n**Safari**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Visiting a malicious website may lead to address bar spoofing\n\nDescription: An inconsistent user interface issue was addressed with improved state management.\n\nCVE-2017-2517: xisigr of Tencent's Xuanwu Lab (tencent.com)\n\n**Safari Printing**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: Processing maliciously crafted web content may lead to an infinite number of print dialogs\n\nDescription: An issue existed where a malicious or compromised website could show infinite print dialogs and make users believe their browser was locked. The issue was addressed through throttling of print dialogs.\n\nCVE-2017-7060: Travis Kelley of City of Mishawaka, Indiana\n\n**Telephony**\n\nAvailable for: iPhone 5 and later, and Wi-Fi + Cellular models of iPad 4th generation and later\n\nImpact: An attacker in a privileged network position may be able to execute arbitrary code\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-8248\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: A malicious website may exfiltrate data cross-origin\n\nDescription: Processing maliciously crafted web content may allow cross-origin data to be exfiltrated by using SVG filters to conduct a timing side-channel attack. This issue was addressed by not painting the cross-origin buffer into the frame that gets filtered.\n\nCVE-2017-7006: an anonymous researcher, David Kohlbrenner of UC San Diego\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Visiting a malicious website may lead to address bar spoofing\n\nDescription: A state management issue was addressed with improved frame handling.\n\nCVE-2017-7011: xisigr of Tencent's Xuanwu Lab (tencent.com)\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved memory handling.\n\nCVE-2017-7018: lokihardt of Google Project Zero\n\nCVE-2017-7020: likemeng of Baidu Security Lab\n\nCVE-2017-7030: chenqin of Ant-financial Light-Year Security Lab (\u8682\u8681\u91d1\u670d\u5df4\u65af\u5149\u5e74\u5b89\u5168\u5b9e\u9a8c\u5ba4)\n\nCVE-2017-7034: chenqin of Ant-financial Light-Year Security Lab (\u8682\u8681\u91d1\u670d\u5df4\u65af\u5149\u5e74\u5b89\u5168\u5b9e\u9a8c\u5ba4)\n\nCVE-2017-7037: lokihardt of Google Project Zero\n\nCVE-2017-7039: Ivan Fratric of Google Project Zero\n\nCVE-2017-7040: Ivan Fratric of Google Project Zero\n\nCVE-2017-7041: Ivan Fratric of Google Project Zero\n\nCVE-2017-7042: Ivan Fratric of Google Project Zero\n\nCVE-2017-7043: Ivan Fratric of Google Project Zero\n\nCVE-2017-7046: Ivan Fratric of Google Project Zero\n\nCVE-2017-7048: Ivan Fratric of Google Project Zero\n\nCVE-2017-7052: cc working with Trend Micro's Zero Day Initiative\n\nCVE-2017-7055: The UK's National Cyber Security Centre (NCSC)\n\nCVE-2017-7056: lokihardt of Google Project Zero\n\nCVE-2017-7061: lokihardt of Google Project Zero\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Processing maliciously crafted web content with DOMParser may lead to cross site scripting\n\nDescription: A logic issue existed in the handling of DOMParser. This issue was addressed with improved state management.\n\nCVE-2017-7038: Egor Karbutov (@ShikariSenpai) of Digital Security and Egor Saltykov (@ansjdnakjdnajkd) of Digital Security, Neil Jenkins of FastMail Pty Ltd\n\nCVE-2017-7059: Masato Kinugawa and Mario Heiderich of Cure53\n\nEntry updated July 28, 2017\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed through improved memory handling.\n\nCVE-2017-7049: Ivan Fratric of Google Project Zero\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An application may be able to read restricted memory\n\nDescription: A memory initialization issue was addressed through improved memory handling.\n\nCVE-2017-7064: lokihardt of Google Project Zero\n\n**WebKit Page Loading**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved memory handling.\n\nCVE-2017-7019: Zhiyang Zeng of Tencent Security Platform Department\n\n**WebKit Web Inspector**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved memory handling.\n\nCVE-2017-7012: Apple\n\n**Wi-Fi**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An attacker within range may be able to execute arbitrary code on the Wi-Fi chip\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-7065: Gal Beniamini of Google Project Zero\n\nEntry added September 25, 2017\n\n**Wi-Fi**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An attacker in Wi-Fi range may be able to cause a denial of service on the Wi-Fi chip\n\nDescription: A memory corruption issue was addressed with improved validation.\n\nCVE-2017-7066: Gal Beniamini of Google Project Zero\n\nEntry added September 26, 2017\n\n**Wi-Fi**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An attacker within range may be able to execute arbitrary code on the Wi-Fi chip\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-9417: Nitay Artenstein of Exodus Intelligence\n\nInformation about products not manufactured by Apple, or independent websites not controlled or tested by Apple, is provided without recommendation or endorsement. Apple assumes no responsibility with regard to the selection, performance, or use of third-party websites or products. Apple makes no representations regarding third-party website accuracy or reliability. [Contact the vendor](<http://support.apple.com/kb/HT2693>) for additional information.\n\nPublished Date: July 27, 2020\n", "published": "2017-07-19T00:00:00", "modified": "2017-07-19T00:00:00", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {"acInsufInfo": true, "cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 10.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 5.9}, "href": "https://support.apple.com/kb/HT207923", "reporter": "Apple", "references": ["https://support.apple.com/en-us/HT201222"], "cvelist": ["CVE-2017-2517", "CVE-2017-7006", "CVE-2017-7007", "CVE-2017-7008", "CVE-2017-7009", "CVE-2017-7010", "CVE-2017-7011", "CVE-2017-7012", "CVE-2017-7013", "CVE-2017-7018", "CVE-2017-7019", "CVE-2017-7020", "CVE-2017-7022", "CVE-2017-7023", "CVE-2017-7024", "CVE-2017-7025", "CVE-2017-7026", "CVE-2017-7027", "CVE-2017-7028", "CVE-2017-7029", "CVE-2017-7030", "CVE-2017-7034", "CVE-2017-7037", "CVE-2017-7038", "CVE-2017-7039", "CVE-2017-7040", "CVE-2017-7041", "CVE-2017-7042", "CVE-2017-7043", "CVE-2017-7046", "CVE-2017-7047", "CVE-2017-7048", "CVE-2017-7049", "CVE-2017-7052", "CVE-2017-7055", "CVE-2017-7056", "CVE-2017-7058", "CVE-2017-7059", "CVE-2017-7060", "CVE-2017-7061", "CVE-2017-7062", "CVE-2017-7063", "CVE-2017-7064", "CVE-2017-7065", "CVE-2017-7066", "CVE-2017-7068", "CVE-2017-7069", "CVE-2017-8248", "CVE-2017-9417"], "immutableFields": [], "lastseen": "2021-11-15T01:01:28", "history": [], "viewCount": 0, "enchantments": {"dependencies": {"references": [{"type": "nessus", "idList": ["ITUNES_12_6_2.NASL", "UBUNTU_USN-3376-1.NASL", "700166.PRM", "APPLE_IOS_1033_CHECK.NBIN", "FEDORA_2017-73D6A0DFBB.NASL", "700169.PRM", "FEDORA_2017-9D572CC64A.NASL", "700167.PRM", "MACOS_ITUNES_12_6_2.NASL", "MACOSX_SECUPD2017-003.NASL", "700170.PRM", "FREEBSD_PKG_0F66B901715C11E7AD1FBCAEC565249C.NASL", "700168.PRM", "GENTOO_GLSA-201710-14.NASL", "MACOSX_SAFARI10_1_2.NASL", "FEDORA_2017-24BDDB96B5.NASL", "ITUNES_12_6_2_BANNER.NASL"]}, {"type": "apple", "idList": ["APPLE:99264BBD02673CF1A5BD1F2971DF24AC", "APPLE:E14BE055BDC628889501E4B8D8323353", "APPLE:BF63E0940D677DE6F4EA077CCBC8E3D4", "APPLE:850E0FF3FD533A5E9217C78C670C8D25", "APPLE:01F01DC42D3C846351C9391E48A3A016", "APPLE:B3381378B2D293A36BD1738ADC2FF0EA", "APPLE:665D8628576372427A4867A3D76727EE", "APPLE:FE3D63232171294398F45858A10B5295", "APPLE:FA56DF7B2D68C4F8B67EE47903C325FC", "APPLE:D3F21FB4BBD17C5C85FBDC0D8CF2647B", "APPLE:D1CDEB8752AB6C8F5120085F64A20A9D", "APPLE:5D035145E3EE53A8C36DC063A0DC8B49", "APPLE:0474FDB2C3BAED2BEB8F3F589A9A751B", "APPLE:HT207924", "APPLE:1BAEE8F17DD7D2B63370193032CB0611", "APPLE:EBE92F2438AB1A14C6BDE5158AEA3712", "APPLE:HT207925", "APPLE:A81762EC72891DE2E2EC4EDE80EB0AEC", "APPLE:155325C26D846BCC4F51291908B84E68", "APPLE:7AFC35B4B1D8C25A050E4C951554FD97", "APPLE:HT207923", "APPLE:AA82E5B3EBE5675FCCFBBBEE9BFD411D", "APPLE:81D1748785BDBD9E6AAE8352ACF7C294", "APPLE:A0D2512CFF25D0D5D3BCE389FDB19F72", "APPLE:HT207928", "APPLE:B3A807C5D0DD225155CDE5C5E2179CEF", "APPLE:C50B697E972C6E21765EAA60E58C7164", "APPLE:5819CC48A7438816B3469D0A9F9187AA", "APPLE:B48082D98B6BA029A905A36AB5B5E3F5", "APPLE:649EC14F69D11DE4A4E4CC7FDD2AE31D", "APPLE:00227F7C8FECB8511DEA87CEE1A35651", "APPLE:D842C156864A70351F1DAF73F853B39E", "APPLE:6727C433A1BED2433083F36AE0550F46", "APPLE:285028331CB1F05E710AC01558861C92", "APPLE:7EC62CB7770B86C6FBAD6DBD45DFEBDB", "APPLE:CEC7DCE5379D5C1DBB2795CA582D13CD", "APPLE:D612BFE41CEFBE4E494B64FB483B9B14", "APPLE:FD264D87BAFB1F61EA0F916A10C184DF", "APPLE:6AE3A9A931912C620F58D34455568B3A", "APPLE:0536CA1502248219C54E9CDB47CB476A", "APPLE:4DC59130923980C324535772E9C08242", "APPLE:9D3E0F979B2323616FFC792A28E9EBCF", "APPLE:89861DA71DDD36B8AE0F5BFD245CA715", "APPLE:BCCCAE11F083D3D4908149AD32040F19", "APPLE:D6FFE312C543C07E83B2A006624D4484", "APPLE:CDB5926BE5F0E664D5030C0C869E6E0C", "APPLE:DA6A0A4635C393E244ADA3BDE050BFE1", "APPLE:8B4FE732ABB73A15CDDCD6E8294E3EF8", "APPLE:596F2B486F0EBB6CEC1147A8407FE60C", "APPLE:B71AB19607886631A8390750EA7CCE3F", "APPLE:AA2FD3FD451FF46FC41684D914CB84ED", "APPLE:C3934642F271B78BEB3119DF3A66FB91", "APPLE:DC836966564410BD83E958AC96F8DB12", "APPLE:1C16D7507A975B0063CF2C60AFABD796", "APPLE:27AB2999EC34EB5C57F0EBF39ED32563", "APPLE:644500C0206E86708DC72EEBB59BF5EC", "APPLE:8B4D5A0EE5EE0A6A992EA96178ADFF6A", "APPLE:C576D3548381302A5BCBE22EF67C0131", "APPLE:D5D920B70CE939C66CFD6D8D9DD56054", "APPLE:4DBBB66883DC836291AECACDF707050A", "APPLE:550F4565D3703279E446C7E1A4786DD8", "APPLE:A0476A092DA4082BF1935886E3AAC659", "APPLE:EAA7B151972D42F49D932465866AD0F7", "APPLE:A45EF6A390F7F91AE1E0B31A361E1EA5", "APPLE:6034BA803B4B160822250FBFD4439E9E", "APPLE:52BCF4A20C9E6FF472F7E0FCF7A73C12", "APPLE:8B25F57269F562980EF0ED157CF784AD", "APPLE:083455936A7BFF0A7723E989B92D241D", "APPLE:4E7284A6AEF4E46C141581D00E147328", "APPLE:BD4A974F6804F04E071FA17C0189F1EB", "APPLE:F234B75385D1403C977E0F0F5AEA4D95", "APPLE:HT207921", "APPLE:CB426D947C3D021DA94A94D51AB31FDD", "APPLE:DD06626CF4C4BC3354ACDF2F54357778", "APPLE:80AF69490F769A089C16F62E11014AFD", "APPLE:19471D7C484C1D81E0DF2A2571339E50", "APPLE:6719BBA2C54C882380F2507C6DB8B594", "APPLE:25A40F47C0600E8BF083E9F8CF4D02B3", "APPLE:7440F921D6E435C184D04D7BBB1C792F", "APPLE:502D37318A95B385FB39006D515FD2C7", "APPLE:B9B20A47252B46B5523401A12BFE03B3", "APPLE:CACA88252C556295CF96592D24F4B9BF", "APPLE:ACE092CEDA446FEA9C5C469D75279A62", "APPLE:8AE775955605BF8E8F9449AD0B7FAD96", "APPLE:9A1CF1662DFE33B08BD0240BEB4B2AC9", "APPLE:7C7051A76860B9F3DAE82C86DAEF0153", "APPLE:26C36A106263A094CCD2C0719C890E96", "APPLE:3B51A3793E650DEB4D5A524AEB10939D", "APPLE:E6EC20696D0DBE51E54B965532A9E633", "APPLE:FC8342DFA1FB389BFF63707187601E04", "APPLE:HT207927", "APPLE:B735252C3D9C5C2DDA47BD2AF9C792F9", "APPLE:4EE9E3A8FC6D6AFFAB0C6D52FC5D0FC0", "APPLE:93C3C089A84DF055788C6DF8D286780E", "APPLE:0783FAB2C58195BC3E602300DC944B07", "APPLE:B6B88DE7A691BF48D70E3F17C90B66DC", "APPLE:DAC745B8C02D20D12F100A493F79A2C5", "APPLE:43A82761AF2332E4585261BA13AEFC4C", "APPLE:FF13DA99117BB17B1756DC5DE416D8A3", "APPLE:84CD68EDEDB02B20F3B9B36CE32978CF", "APPLE:B930D70697973AFE8560BB5CB5C8FF7E", "APPLE:0FDABBE26206F0203F18954597CC1A5D", "APPLE:12887AB5BB71C26CA347DA603F2A38E5", "APPLE:DA07741FDE768B9B04857BE30D2B7CE9", "APPLE:4B48BECF80E840904FBDE3226587C1B1", "APPLE:46B417AA5A0A127D706DC5B844F0D8D2", "APPLE:ABA73FEAAAB2192DEAFA24CF2EB1B8F9", "APPLE:EA3F435869D64A0598E3657B87468918", "APPLE:00136C664E46E49235D7BEB52F02D4CB", "APPLE:9A1C80AF038E85E8590D4B815BA273FD", "APPLE:5754FEDA3B60E2951DA7C9DCE3CCD33B"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310873200", "OPENVAS:1361412562310811252", "OPENVAS:1361412562310873180", "OPENVAS:1361412562310811251", "OPENVAS:1361412562310811538", "OPENVAS:1361412562310843266", "OPENVAS:1361412562310873226", "OPENVAS:1361412562310811535"]}, {"type": "freebsd", "idList": ["0F66B901-715C-11E7-AD1F-BCAEC565249C"]}, {"type": "kaspersky", "idList": ["KLA11075"]}, {"type": "gentoo", "idList": ["GLSA-201710-14"]}, {"type": "fedora", "idList": ["FEDORA:417B06017118", "FEDORA:33FB9639A184", "FEDORA:D681D609273A"]}, {"type": "archlinux", "idList": ["ASA-201707-25"]}, {"type": "ubuntu", "idList": ["USN-3376-1"]}, {"type": "threatpost", "idList": ["THREATPOST:60D5DA46BF733084F46AB656BE8CC259"]}, {"type": "cve", "idList": ["CVE-2017-7037", "CVE-2017-7058", "CVE-2017-7034", "CVE-2017-7012", "CVE-2017-7040", "CVE-2017-7007", "CVE-2017-7043", "CVE-2017-7009", "CVE-2017-7038", "CVE-2017-7006", "CVE-2017-7029", "CVE-2017-7046", "CVE-2017-7028", "CVE-2017-7020", "CVE-2017-7041", "CVE-2017-7049", "CVE-2017-7011", "CVE-2017-7023", "CVE-2017-7027", "CVE-2017-7008", "CVE-2017-9417", "CVE-2017-7069", "CVE-2017-7026", "CVE-2017-7063", "CVE-2017-7019", "CVE-2017-7030", "CVE-2017-7025", "CVE-2017-8248", "CVE-2017-7047", "CVE-2017-7060", "CVE-2017-7018", "CVE-2017-7024", "CVE-2017-7022", "CVE-2017-7013", "CVE-2017-7010"]}, {"type": "android", "idList": ["ANDROID:CVE-2017-9417", "ANDROID:CVE-2017-8248"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2017-7038", "UB:CVE-2017-7012", "UB:CVE-2017-7046", "UB:CVE-2017-7037", "UB:CVE-2017-7010", "UB:CVE-2017-7030", "UB:CVE-2017-7006", "UB:CVE-2017-7019", "UB:CVE-2017-7013", "UB:CVE-2017-7049", "UB:CVE-2017-7011", "UB:CVE-2017-7043", "UB:CVE-2017-7040", "UB:CVE-2017-7041", "UB:CVE-2017-7020", "UB:CVE-2017-7018", "UB:CVE-2017-7034"]}], "modified": "2021-11-15T01:01:28", "rev": 2}, "score": {"value": 6.4, "vector": "NONE", "modified": "2021-11-15T01:01:28", "rev": 2}}, "objectVersion": "1.6", "affectedSoftware": [{"version": "10.3.3", "operator": "lt", "name": "ios"}]}, "lastseen": "2021-11-15T01:01:28", "differentElements": ["description"], "edition": 7}, {"bulletin": {"id": "APPLE:21F236C1A9D411224D0D290A7D88873F", "vendorId": null, "hash": "d1913189105f352fb399e126704668ac", "type": "apple", "bulletinFamily": "software", "title": "About the security content of iOS 10.3.3", "description": "# About the security content of iOS 10.3.3\n\nThis document describes the security content of iOS 10.3.3.\n\n## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss or confirm security issues until an investigation has taken place and patches or releases are available. Recent releases are listed on the [Apple security updates](<https://support.apple.com/en-gb/HT201222>) page.\n\nFor more information about security, see the [Apple Product Security](<https://support.apple.com/en-gb/HT201220>) page. You can encrypt communications with Apple using the [Apple Product Security PGP Key](<https://support.apple.com/en-uk/HT201601>).\n\nApple security documents reference vulnerabilities by [CVE-ID](<http://cve.mitre.org/about/>) when possible.\n\n\n\n## iOS 10.3.3\n\nReleased 19 July 2017\n\n**Contacts**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution\n\nDescription: A buffer overflow issue was addressed through improved memory handling.\n\nCVE-2017-7062: Shashank (@cyberboyIndia)\n\n**CoreAudio**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Processing a maliciously crafted film file may lead to arbitrary code execution\n\nDescription: A memory corruption issue was addressed with improved bounds checking.\n\nCVE-2017-7008: Yangkang (@dnpushme) of Qihoo 360 Qex Team\n\n**EventKitUI**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: A remote attacker may cause an unexpected application termination\n\nDescription: A resource exhaustion issue was addressed through improved input validation.\n\nCVE-2017-7007: Jos\u00e9 Antonio Esteban (@Erratum_) of Sapsi Consultores\n\n**IOUSBFamily**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-7009: shrek_wzw of Qihoo 360 Nirvan Team\n\n**Kernel**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-7022: an anonymous researcher\n\nCVE-2017-7024: an anonymous researcher\n\nCVE-2017-7026: an anonymous researcher\n\n**Kernel**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-7023: an anonymous researcher\n\nCVE-2017-7025: an anonymous researcher\n\nCVE-2017-7027: an anonymous researcher\n\nCVE-2017-7069: Proteas of Qihoo 360 Nirvan Team\n\n**Kernel**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An application may be able to read restricted memory\n\nDescription: A validation issue was addressed with improved input sanitisation.\n\nCVE-2017-7028: an anonymous researcher\n\nCVE-2017-7029: an anonymous researcher\n\n**libarchive**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Unpacking a maliciously crafted archive may lead to arbitrary code execution\n\nDescription: A buffer overflow was addressed through improved bounds checking.\n\nCVE-2017-7068: found by OSS-Fuzz\n\n**libxml2**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Parsing a maliciously crafted XML document may lead to disclosure of user information\n\nDescription: An out-of-bounds read was addressed through improved bounds checking.\n\nCVE-2017-7010: Apple\n\nCVE-2017-7013: found by OSS-Fuzz\n\n**libxpc**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-7047: Ian Beer of Google Project Zero\n\n**Messages**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: A remote attacker may cause an unexpected application termination\n\nDescription: A memory consumption issue was addressed through improved memory handling.\n\nCVE-2017-7063: Shashank (@cyberboyIndia)\n\n**Notifications**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Notifications may appear on the lock screen when disabled\n\nDescription: A lock screen issue was addressed with improved state management.\n\nCVE-2017-7058: Beyza Sevin\u00e7 of S\u00fcleyman Demirel \u00dcniversitesi\n\nEntry updated 28 July 2017\n\n**Safari**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Visiting a malicious website may lead to address bar spoofing\n\nDescription: An inconsistent user interface issue was addressed with improved state management.\n\nCVE-2017-2517: xisigr of Tencent's Xuanwu Lab (tencent.com)\n\n**Safari Printing**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Processing maliciously crafted web content may lead to an infinite number of print dialogs\n\nDescription: An issue existed where a malicious or compromised website could show infinite print dialogs and make users believe their browser was locked. The issue was addressed through throttling of print dialogs.\n\nCVE-2017-7060: Travis Kelley of City of Mishawaka, Indiana\n\n**Telephony**\n\nAvailable for: iPhone 5 and later, and Wi-Fi + Cellular models of iPad 4th generation and later\n\nImpact: An attacker in a privileged network position may be able to execute arbitrary code\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-8248\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: A malicious website may exfiltrate data cross-origin\n\nDescription: Processing maliciously crafted web content may allow cross-origin data to be exfiltrated by using SVG filters to conduct a timing side-channel attack. This issue was addressed by not painting the cross-origin buffer into the frame that gets filtered.\n\nCVE-2017-7006: an anonymous researcher, David Kohlbrenner of UC San Diego\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Visiting a malicious website may lead to address bar spoofing\n\nDescription: A state management issue was addressed with improved frame handling.\n\nCVE-2017-7011: xisigr of Tencent's Xuanwu Lab (tencent.com)\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved memory handling.\n\nCVE-2017-7018: lokihardt of Google Project Zero\n\nCVE-2017-7020: likemeng of Baidu Security Lab\n\nCVE-2017-7030: chenqin of Ant-financial Light-Year Security Lab (\u8682\u8681\u91d1\u670d\u5df4\u65af\u5149\u5e74\u5b89\u5168\u5b9e\u9a8c\u5ba4)\n\nCVE-2017-7034: chenqin of Ant-financial Light-Year Security Lab (\u8682\u8681\u91d1\u670d\u5df4\u65af\u5149\u5e74\u5b89\u5168\u5b9e\u9a8c\u5ba4)\n\nCVE-2017-7037: lokihardt of Google Project Zero\n\nCVE-2017-7039: Ivan Fratric of Google Project Zero\n\nCVE-2017-7040: Ivan Fratric of Google Project Zero\n\nCVE-2017-7041: Ivan Fratric of Google Project Zero\n\nCVE-2017-7042: Ivan Fratric of Google Project Zero\n\nCVE-2017-7043: Ivan Fratric of Google Project Zero\n\nCVE-2017-7046: Ivan Fratric of Google Project Zero\n\nCVE-2017-7048: Ivan Fratric of Google Project Zero\n\nCVE-2017-7052: cc working with Trend Micro's Zero Day Initiative\n\nCVE-2017-7055: The UK's National Cyber Security Centre (NCSC)\n\nCVE-2017-7056: lokihardt of Google Project Zero\n\nCVE-2017-7061: lokihardt of Google Project Zero\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Processing maliciously crafted web content with DOMParser may lead to cross site scripting\n\nDescription: A logic issue existed in the handling of DOMParser. This issue was addressed with improved state management.\n\nCVE-2017-7038: Egor Karbutov (@ShikariSenpai) of Digital Security and Egor Saltykov (@ansjdnakjdnajkd) of Digital Security, Neil Jenkins of FastMail Pty Ltd\n\nCVE-2017-7059: Masato Kinugawa and Mario Heiderich of Cure53\n\nEntry updated 28 July 2017\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed through improved memory handling.\n\nCVE-2017-7049: Ivan Fratric of Google Project Zero\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An application may be able to read restricted memory\n\nDescription: A memory initialisation issue was addressed through improved memory handling.\n\nCVE-2017-7064: lokihardt of Google Project Zero\n\n**WebKit Page Loading**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved memory handling.\n\nCVE-2017-7019: Zhiyang Zeng of Tencent Security Platform Department\n\n**WebKit Web Inspector**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved memory handling.\n\nCVE-2017-7012: Apple\n\n**Wi-Fi**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An attacker within range may be able to execute arbitrary code on the Wi-Fi chip\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-7065: Gal Beniamini of Google Project Zero\n\nEntry added 25 September 2017\n\n**Wi-Fi**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An attacker in Wi-Fi range may be able to cause a denial of service on the Wi-Fi chip\n\nDescription: A memory corruption issue was addressed with improved validation.\n\nCVE-2017-7066: Gal Beniamini of Google Project Zero\n\nEntry added 26 September 2017\n\n**Wi-Fi**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An attacker within range may be able to execute arbitrary code on the Wi-Fi chip\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-9417: Nitay Artenstein of Exodus Intelligence\n\nInformation about products not manufactured by Apple, or independent websites not controlled or tested by Apple, is provided without recommendation or endorsement. Apple assumes no responsibility with regard to the selection, performance or use of third-party websites or products. Apple makes no representations regarding third-party website accuracy or reliability. [Contact the vendor](<http://support.apple.com/en-gb/HT2693>) for additional information.\n\nPublished Date: August 05, 2020\n", "published": "2017-07-19T00:00:00", "modified": "2017-07-19T00:00:00", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {"acInsufInfo": true, "cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 10.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 5.9}, "href": "https://support.apple.com/kb/HT207923", "reporter": "Apple", "references": ["https://support.apple.com/en-us/HT201222"], "cvelist": ["CVE-2017-2517", "CVE-2017-7006", "CVE-2017-7007", "CVE-2017-7008", "CVE-2017-7009", "CVE-2017-7010", "CVE-2017-7011", "CVE-2017-7012", "CVE-2017-7013", "CVE-2017-7018", "CVE-2017-7019", "CVE-2017-7020", "CVE-2017-7022", "CVE-2017-7023", "CVE-2017-7024", "CVE-2017-7025", "CVE-2017-7026", "CVE-2017-7027", "CVE-2017-7028", "CVE-2017-7029", "CVE-2017-7030", "CVE-2017-7034", "CVE-2017-7037", "CVE-2017-7038", "CVE-2017-7039", "CVE-2017-7040", "CVE-2017-7041", "CVE-2017-7042", "CVE-2017-7043", "CVE-2017-7046", "CVE-2017-7047", "CVE-2017-7048", "CVE-2017-7049", "CVE-2017-7052", "CVE-2017-7055", "CVE-2017-7056", "CVE-2017-7058", "CVE-2017-7059", "CVE-2017-7060", "CVE-2017-7061", "CVE-2017-7062", "CVE-2017-7063", "CVE-2017-7064", "CVE-2017-7065", "CVE-2017-7066", "CVE-2017-7068", "CVE-2017-7069", "CVE-2017-8248", "CVE-2017-9417"], "immutableFields": [], "lastseen": "2021-11-15T09:00:40", "history": [], "viewCount": 0, "enchantments": {"dependencies": {"references": [{"type": "nessus", "idList": ["ITUNES_12_6_2.NASL", "UBUNTU_USN-3376-1.NASL", "700166.PRM", "APPLE_IOS_1033_CHECK.NBIN", "FEDORA_2017-73D6A0DFBB.NASL", "700169.PRM", "FEDORA_2017-9D572CC64A.NASL", "700167.PRM", "MACOS_ITUNES_12_6_2.NASL", "MACOSX_SECUPD2017-003.NASL", "700170.PRM", "FREEBSD_PKG_0F66B901715C11E7AD1FBCAEC565249C.NASL", "700168.PRM", "GENTOO_GLSA-201710-14.NASL", "MACOSX_SAFARI10_1_2.NASL", "FEDORA_2017-24BDDB96B5.NASL", "ITUNES_12_6_2_BANNER.NASL"]}, {"type": "apple", "idList": ["APPLE:99264BBD02673CF1A5BD1F2971DF24AC", "APPLE:E14BE055BDC628889501E4B8D8323353", "APPLE:BF63E0940D677DE6F4EA077CCBC8E3D4", "APPLE:850E0FF3FD533A5E9217C78C670C8D25", "APPLE:01F01DC42D3C846351C9391E48A3A016", "APPLE:B3381378B2D293A36BD1738ADC2FF0EA", "APPLE:665D8628576372427A4867A3D76727EE", "APPLE:FE3D63232171294398F45858A10B5295", "APPLE:FA56DF7B2D68C4F8B67EE47903C325FC", "APPLE:D3F21FB4BBD17C5C85FBDC0D8CF2647B", "APPLE:D1CDEB8752AB6C8F5120085F64A20A9D", "APPLE:5D035145E3EE53A8C36DC063A0DC8B49", "APPLE:0474FDB2C3BAED2BEB8F3F589A9A751B", "APPLE:HT207924", "APPLE:1BAEE8F17DD7D2B63370193032CB0611", "APPLE:EBE92F2438AB1A14C6BDE5158AEA3712", "APPLE:HT207925", "APPLE:A81762EC72891DE2E2EC4EDE80EB0AEC", "APPLE:155325C26D846BCC4F51291908B84E68", "APPLE:7AFC35B4B1D8C25A050E4C951554FD97", "APPLE:HT207923", "APPLE:AA82E5B3EBE5675FCCFBBBEE9BFD411D", "APPLE:81D1748785BDBD9E6AAE8352ACF7C294", "APPLE:A0D2512CFF25D0D5D3BCE389FDB19F72", "APPLE:HT207928", "APPLE:B3A807C5D0DD225155CDE5C5E2179CEF", "APPLE:C50B697E972C6E21765EAA60E58C7164", "APPLE:5819CC48A7438816B3469D0A9F9187AA", "APPLE:B48082D98B6BA029A905A36AB5B5E3F5", "APPLE:649EC14F69D11DE4A4E4CC7FDD2AE31D", "APPLE:00227F7C8FECB8511DEA87CEE1A35651", "APPLE:D842C156864A70351F1DAF73F853B39E", "APPLE:6727C433A1BED2433083F36AE0550F46", "APPLE:285028331CB1F05E710AC01558861C92", "APPLE:7EC62CB7770B86C6FBAD6DBD45DFEBDB", "APPLE:CEC7DCE5379D5C1DBB2795CA582D13CD", "APPLE:D612BFE41CEFBE4E494B64FB483B9B14", "APPLE:FD264D87BAFB1F61EA0F916A10C184DF", "APPLE:6AE3A9A931912C620F58D34455568B3A", "APPLE:0536CA1502248219C54E9CDB47CB476A", "APPLE:4DC59130923980C324535772E9C08242", "APPLE:9D3E0F979B2323616FFC792A28E9EBCF", "APPLE:89861DA71DDD36B8AE0F5BFD245CA715", "APPLE:BCCCAE11F083D3D4908149AD32040F19", "APPLE:D6FFE312C543C07E83B2A006624D4484", "APPLE:CDB5926BE5F0E664D5030C0C869E6E0C", "APPLE:DA6A0A4635C393E244ADA3BDE050BFE1", "APPLE:8B4FE732ABB73A15CDDCD6E8294E3EF8", "APPLE:596F2B486F0EBB6CEC1147A8407FE60C", "APPLE:B71AB19607886631A8390750EA7CCE3F", "APPLE:AA2FD3FD451FF46FC41684D914CB84ED", "APPLE:C3934642F271B78BEB3119DF3A66FB91", "APPLE:DC836966564410BD83E958AC96F8DB12", "APPLE:1C16D7507A975B0063CF2C60AFABD796", "APPLE:27AB2999EC34EB5C57F0EBF39ED32563", "APPLE:644500C0206E86708DC72EEBB59BF5EC", "APPLE:8B4D5A0EE5EE0A6A992EA96178ADFF6A", "APPLE:C576D3548381302A5BCBE22EF67C0131", "APPLE:D5D920B70CE939C66CFD6D8D9DD56054", "APPLE:4DBBB66883DC836291AECACDF707050A", "APPLE:550F4565D3703279E446C7E1A4786DD8", "APPLE:A0476A092DA4082BF1935886E3AAC659", "APPLE:EAA7B151972D42F49D932465866AD0F7", "APPLE:A45EF6A390F7F91AE1E0B31A361E1EA5", "APPLE:6034BA803B4B160822250FBFD4439E9E", "APPLE:52BCF4A20C9E6FF472F7E0FCF7A73C12", "APPLE:8B25F57269F562980EF0ED157CF784AD", "APPLE:083455936A7BFF0A7723E989B92D241D", "APPLE:4E7284A6AEF4E46C141581D00E147328", "APPLE:BD4A974F6804F04E071FA17C0189F1EB", "APPLE:F234B75385D1403C977E0F0F5AEA4D95", "APPLE:HT207921", "APPLE:CB426D947C3D021DA94A94D51AB31FDD", "APPLE:DD06626CF4C4BC3354ACDF2F54357778", "APPLE:80AF69490F769A089C16F62E11014AFD", "APPLE:19471D7C484C1D81E0DF2A2571339E50", "APPLE:6719BBA2C54C882380F2507C6DB8B594", "APPLE:25A40F47C0600E8BF083E9F8CF4D02B3", "APPLE:7440F921D6E435C184D04D7BBB1C792F", "APPLE:502D37318A95B385FB39006D515FD2C7", "APPLE:B9B20A47252B46B5523401A12BFE03B3", "APPLE:CACA88252C556295CF96592D24F4B9BF", "APPLE:ACE092CEDA446FEA9C5C469D75279A62", "APPLE:8AE775955605BF8E8F9449AD0B7FAD96", "APPLE:9A1CF1662DFE33B08BD0240BEB4B2AC9", "APPLE:7C7051A76860B9F3DAE82C86DAEF0153", "APPLE:26C36A106263A094CCD2C0719C890E96", "APPLE:3B51A3793E650DEB4D5A524AEB10939D", "APPLE:E6EC20696D0DBE51E54B965532A9E633", "APPLE:FC8342DFA1FB389BFF63707187601E04", "APPLE:HT207927", "APPLE:B735252C3D9C5C2DDA47BD2AF9C792F9", "APPLE:4EE9E3A8FC6D6AFFAB0C6D52FC5D0FC0", "APPLE:93C3C089A84DF055788C6DF8D286780E", "APPLE:0783FAB2C58195BC3E602300DC944B07", "APPLE:B6B88DE7A691BF48D70E3F17C90B66DC", "APPLE:DAC745B8C02D20D12F100A493F79A2C5", "APPLE:43A82761AF2332E4585261BA13AEFC4C", "APPLE:FF13DA99117BB17B1756DC5DE416D8A3", "APPLE:84CD68EDEDB02B20F3B9B36CE32978CF", "APPLE:B930D70697973AFE8560BB5CB5C8FF7E", "APPLE:0FDABBE26206F0203F18954597CC1A5D", "APPLE:12887AB5BB71C26CA347DA603F2A38E5", "APPLE:DA07741FDE768B9B04857BE30D2B7CE9", "APPLE:4B48BECF80E840904FBDE3226587C1B1", "APPLE:46B417AA5A0A127D706DC5B844F0D8D2", "APPLE:ABA73FEAAAB2192DEAFA24CF2EB1B8F9", "APPLE:EA3F435869D64A0598E3657B87468918", "APPLE:00136C664E46E49235D7BEB52F02D4CB", "APPLE:9A1C80AF038E85E8590D4B815BA273FD", "APPLE:5754FEDA3B60E2951DA7C9DCE3CCD33B"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310873200", "OPENVAS:1361412562310811252", "OPENVAS:1361412562310873180", "OPENVAS:1361412562310811251", "OPENVAS:1361412562310811538", "OPENVAS:1361412562310843266", "OPENVAS:1361412562310873226", "OPENVAS:1361412562310811535"]}, {"type": "freebsd", "idList": ["0F66B901-715C-11E7-AD1F-BCAEC565249C"]}, {"type": "kaspersky", "idList": ["KLA11075"]}, {"type": "gentoo", "idList": ["GLSA-201710-14"]}, {"type": "fedora", "idList": ["FEDORA:417B06017118", "FEDORA:33FB9639A184", "FEDORA:D681D609273A"]}, {"type": "archlinux", "idList": ["ASA-201707-25"]}, {"type": "ubuntu", "idList": ["USN-3376-1"]}, {"type": "threatpost", "idList": ["THREATPOST:60D5DA46BF733084F46AB656BE8CC259"]}, {"type": "cve", "idList": ["CVE-2017-7037", "CVE-2017-7058", "CVE-2017-7034", "CVE-2017-7012", "CVE-2017-7040", "CVE-2017-7007", "CVE-2017-7043", "CVE-2017-7009", "CVE-2017-7038", "CVE-2017-7006", "CVE-2017-7029", "CVE-2017-7046", "CVE-2017-7028", "CVE-2017-7020", "CVE-2017-7041", "CVE-2017-7049", "CVE-2017-7011", "CVE-2017-7023", "CVE-2017-7027", "CVE-2017-7008", "CVE-2017-9417", "CVE-2017-7069", "CVE-2017-7026", "CVE-2017-7063", "CVE-2017-7019", "CVE-2017-7030", "CVE-2017-7025", "CVE-2017-8248", "CVE-2017-7047", "CVE-2017-7060", "CVE-2017-7018", "CVE-2017-7024", "CVE-2017-7022", "CVE-2017-7013", "CVE-2017-7010"]}, {"type": "android", "idList": ["ANDROID:CVE-2017-9417", "ANDROID:CVE-2017-8248"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2017-7038", "UB:CVE-2017-7012", "UB:CVE-2017-7046", "UB:CVE-2017-7037", "UB:CVE-2017-7010", "UB:CVE-2017-7030", "UB:CVE-2017-7006", "UB:CVE-2017-7019", "UB:CVE-2017-7013", "UB:CVE-2017-7049", "UB:CVE-2017-7011", "UB:CVE-2017-7043", "UB:CVE-2017-7040", "UB:CVE-2017-7041", "UB:CVE-2017-7020", "UB:CVE-2017-7018", "UB:CVE-2017-7034"]}], "modified": "2021-11-15T01:01:28", "rev": 2}, "score": {"value": 6.4, "vector": "NONE", "modified": "2021-11-15T01:01:28", "rev": 2}}, "objectVersion": "1.6", "affectedSoftware": [{"version": "10.3.3", "operator": "lt", "name": "ios"}]}, "lastseen": "2021-11-15T09:00:40", "differentElements": ["description"], "edition": 8}], "viewCount": 0, "enchantments": {"dependencies": {"references": [{"type": "nessus", "idList": ["APPLE_IOS_1033_CHECK.NBIN", "700169.PRM", "FEDORA_2017-73D6A0DFBB.NASL", "FEDORA_2017-9D572CC64A.NASL", "ITUNES_12_6_2_BANNER.NASL", "FEDORA_2017-24BDDB96B5.NASL", "FREEBSD_PKG_0F66B901715C11E7AD1FBCAEC565249C.NASL", "ITUNES_12_6_2.NASL", "700167.PRM", "700166.PRM", "700168.PRM", "UBUNTU_USN-3376-1.NASL", "MACOSX_SAFARI10_1_2.NASL", "MACOS_ITUNES_12_6_2.NASL", "GENTOO_GLSA-201710-14.NASL"]}, {"type": "apple", "idList": ["APPLE:60BFB2B2ABBB461BE6997F0ACF5B6660", "APPLE:EE55C3071874473DB618E002433D978C", "APPLE:26C36A106263A094CCD2C0719C890E96", "APPLE:A81762EC72891DE2E2EC4EDE80EB0AEC", "APPLE:HT207923", "APPLE:550F4565D3703279E446C7E1A4786DD8", "APPLE:9D3E0F979B2323616FFC792A28E9EBCF", "APPLE:D1CDEB8752AB6C8F5120085F64A20A9D", "APPLE:7D0DC7CC460887BCABD42581944E47F4", "APPLE:4B48BECF80E840904FBDE3226587C1B1", "APPLE:HT207925", "APPLE:ABA73FEAAAB2192DEAFA24CF2EB1B8F9", "APPLE:99264BBD02673CF1A5BD1F2971DF24AC", "APPLE:B9B20A47252B46B5523401A12BFE03B3", "APPLE:9A1CF1662DFE33B08BD0240BEB4B2AC9", "APPLE:HT207928", "APPLE:7D85C3857A518CC0896E1AC4FC721A5F", "APPLE:D842C156864A70351F1DAF73F853B39E", "APPLE:DA6A0A4635C393E244ADA3BDE050BFE1", "APPLE:F234B75385D1403C977E0F0F5AEA4D95", "APPLE:0474FDB2C3BAED2BEB8F3F589A9A751B", "APPLE:C6B3A88CDD73B885B12A7090E29D430A", "APPLE:FC8342DFA1FB389BFF63707187601E04", "APPLE:EA3F435869D64A0598E3657B87468918", "APPLE:DD06626CF4C4BC3354ACDF2F54357778", "APPLE:FE3D63232171294398F45858A10B5295", "APPLE:93C3C089A84DF055788C6DF8D286780E", "APPLE:CACA88252C556295CF96592D24F4B9BF", "APPLE:19471D7C484C1D81E0DF2A2571339E50", "APPLE:CDCA78BF77C684BAA926DF5FFE0759B1", "APPLE:B735252C3D9C5C2DDA47BD2AF9C792F9", "APPLE:BEF29044688160BB997E6A04A1810D9C", "APPLE:8B4D5A0EE5EE0A6A992EA96178ADFF6A", "APPLE:83954851679CA201EF1EDF83CE5D2FB9", "APPLE:759F88BAB5737822FFB312B9AE028B11", "APPLE:52BCF4A20C9E6FF472F7E0FCF7A73C12", "APPLE:DC836966564410BD83E958AC96F8DB12", "APPLE:HT207927", "APPLE:43A82761AF2332E4585261BA13AEFC4C", "APPLE:CB426D947C3D021DA94A94D51AB31FDD", "APPLE:D612BFE41CEFBE4E494B64FB483B9B14", "APPLE:1BAEE8F17DD7D2B63370193032CB0611", "APPLE:BF63E0940D677DE6F4EA077CCBC8E3D4", "APPLE:8FD7AEB23933D85EE69AC12E78C61047", "APPLE:D3F21FB4BBD17C5C85FBDC0D8CF2647B", "APPLE:8E2DBBB775EAF9EB0E77728F1F327519", "APPLE:E6EC20696D0DBE51E54B965532A9E633", "APPLE:37F5E5B333A3674CD65B7E1287333A9E", "APPLE:0600663770AF736F5725D3DB90C23B77", "APPLE:083455936A7BFF0A7723E989B92D241D", "APPLE:7AFC35B4B1D8C25A050E4C951554FD97", "APPLE:A0D2512CFF25D0D5D3BCE389FDB19F72", "APPLE:5754FEDA3B60E2951DA7C9DCE3CCD33B", "APPLE:80AF69490F769A089C16F62E11014AFD", "APPLE:913B7B79E4560DB158829B9D29B2539D", "APPLE:6FE699DFD1960FA47DAB0799E13A4698", "APPLE:6719BBA2C54C882380F2507C6DB8B594", "APPLE:FA56DF7B2D68C4F8B67EE47903C325FC", "APPLE:8B4FE732ABB73A15CDDCD6E8294E3EF8", "APPLE:DAC745B8C02D20D12F100A493F79A2C5", "APPLE:0FDABBE26206F0203F18954597CC1A5D", "APPLE:FB3A3605DE2C511E500E4556C137E0AF", "APPLE:083507BEBDEC8A0954D205E0ADD992DE", "APPLE:B3381378B2D293A36BD1738ADC2FF0EA", "APPLE:B930D70697973AFE8560BB5CB5C8FF7E", "APPLE:4DBBB66883DC836291AECACDF707050A", "APPLE:7EC62CB7770B86C6FBAD6DBD45DFEBDB", "APPLE:B48082D98B6BA029A905A36AB5B5E3F5", "APPLE:B024BD5A4A1BC1AB787EB653885921E7", "APPLE:DA07741FDE768B9B04857BE30D2B7CE9", "APPLE:00136C664E46E49235D7BEB52F02D4CB", "APPLE:HT207921", "APPLE:B71AB19607886631A8390750EA7CCE3F", "APPLE:8B25F57269F562980EF0ED157CF784AD", "APPLE:BD4A974F6804F04E071FA17C0189F1EB", "APPLE:C3934642F271B78BEB3119DF3A66FB91", "APPLE:596F2B486F0EBB6CEC1147A8407FE60C", "APPLE:55AE5F9E3C7913A2B25FF96BFEF29F8A", "APPLE:62DFB1CE05BA14AE0AFC0750696284DD", "APPLE:C50B697E972C6E21765EAA60E58C7164", "APPLE:9A1C80AF038E85E8590D4B815BA273FD", "APPLE:EAA7B151972D42F49D932465866AD0F7", "APPLE:7C7051A76860B9F3DAE82C86DAEF0153", "APPLE:4DC59130923980C324535772E9C08242", "APPLE:AA2FD3FD451FF46FC41684D914CB84ED", "APPLE:B3A807C5D0DD225155CDE5C5E2179CEF", "APPLE:B6B88DE7A691BF48D70E3F17C90B66DC", "APPLE:E14BE055BDC628889501E4B8D8323353", "APPLE:01F01DC42D3C846351C9391E48A3A016", "APPLE:5D035145E3EE53A8C36DC063A0DC8B49", "APPLE:HT207924", "APPLE:A45EF6A390F7F91AE1E0B31A361E1EA5", "APPLE:0783FAB2C58195BC3E602300DC944B07", "APPLE:BCCCAE11F083D3D4908149AD32040F19", "APPLE:C576D3548381302A5BCBE22EF67C0131", "APPLE:850E0FF3FD533A5E9217C78C670C8D25", "APPLE:665D8628576372427A4867A3D76727EE", "APPLE:25A40F47C0600E8BF083E9F8CF4D02B3", "APPLE:F0FD4AF9E934E41AE6B540A3D8BD18F2", "APPLE:CEC7DCE5379D5C1DBB2795CA582D13CD", "APPLE:8AE775955605BF8E8F9449AD0B7FAD96", "APPLE:D6FFE312C543C07E83B2A006624D4484", "APPLE:5A7667EB1C2807FB57684E7C75480D66", "APPLE:3B8870F50950E87AEF0659EF5C65CFB2", "APPLE:737483D7FFBE6C182CBD53B150D149C1", "APPLE:CDB5926BE5F0E664D5030C0C869E6E0C", "APPLE:12887AB5BB71C26CA347DA603F2A38E5", "APPLE:27AB2999EC34EB5C57F0EBF39ED32563", "APPLE:00227F7C8FECB8511DEA87CEE1A35651", "APPLE:FD264D87BAFB1F61EA0F916A10C184DF", "APPLE:6034BA803B4B160822250FBFD4439E9E"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310873200", "OPENVAS:1361412562310811251", "OPENVAS:1361412562310873180", "OPENVAS:1361412562310811535", "OPENVAS:1361412562310873226", "OPENVAS:1361412562310843266", "OPENVAS:1361412562310811252", "OPENVAS:1361412562310811538"]}, {"type": "freebsd", "idList": ["0F66B901-715C-11E7-AD1F-BCAEC565249C"]}, {"type": "kaspersky", "idList": ["KLA11075"]}, {"type": "gentoo", "idList": ["GLSA-201710-14"]}, {"type": "archlinux", "idList": ["ASA-201707-25"]}, {"type": "fedora", "idList": ["FEDORA:417B06017118", "FEDORA:D681D609273A", "FEDORA:33FB9639A184"]}, {"type": "ubuntu", "idList": ["USN-3376-1"]}, {"type": "threatpost", "idList": ["THREATPOST:60D5DA46BF733084F46AB656BE8CC259"]}, {"type": "cve", "idList": ["CVE-2017-7028", "CVE-2017-7047", "CVE-2017-7013", "CVE-2017-7025", "CVE-2017-7006", "CVE-2017-7037", "CVE-2017-7038", "CVE-2017-9417", "CVE-2017-7030", "CVE-2017-7008", "CVE-2017-7022", "CVE-2017-7012", "CVE-2017-7043", "CVE-2017-7027", "CVE-2017-7058", "CVE-2017-7023", "CVE-2017-7024", "CVE-2017-7034", "CVE-2017-7026", "CVE-2017-7069", "CVE-2017-7010", "CVE-2017-7018", "CVE-2017-7049", "CVE-2017-7011", "CVE-2017-7029", "CVE-2017-7009", "CVE-2017-7019", "CVE-2017-7007", "CVE-2017-8248"]}, {"type": "android", "idList": ["ANDROID:CVE-2017-9417", "ANDROID:CVE-2017-8248"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2017-7011", "UB:CVE-2017-7043", "UB:CVE-2017-7018", "UB:CVE-2017-7030", "UB:CVE-2017-7013", "UB:CVE-2017-7006", "UB:CVE-2017-7034", "UB:CVE-2017-7010", "UB:CVE-2017-7049", "UB:CVE-2017-7038", "UB:CVE-2017-7012", "UB:CVE-2017-7019", "UB:CVE-2017-7037"]}, {"type": "debiancve", "idList": ["DEBIANCVE:CVE-2017-7006", "DEBIANCVE:CVE-2017-7019", "DEBIANCVE:CVE-2017-7037", "DEBIANCVE:CVE-2017-7034", "DEBIANCVE:CVE-2017-9417", "DEBIANCVE:CVE-2017-7049", "DEBIANCVE:CVE-2017-7043", "DEBIANCVE:CVE-2017-7018", "DEBIANCVE:CVE-2017-7030", "DEBIANCVE:CVE-2017-7012", "DEBIANCVE:CVE-2017-7038", "DEBIANCVE:CVE-2017-7011"]}], "modified": "2021-11-16T01:01:59", "rev": 2}, "score": {"value": 6.4, "vector": "NONE", "modified": "2021-11-16T01:01:59", "rev": 2}}, "objectVersion": "1.6", "affectedSoftware": [{"version": "10.3.3", "operator": "lt", "name": "ios"}], "_object_type": "robots.models.apple.AppleBulletin", "_object_types": ["robots.models.base.Bulletin", "robots.models.apple.AppleBulletin"]}, {"id": "APPLE:HT207923", "bulletinFamily": "software", "title": "About the security content of iOS 10.3.3 - Apple Support", "description": "## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the [Apple security updates](<https://support.apple.com/kb/HT201222>) page.\n\nFor more information about security, see the [Apple Product Security](<https://support.apple.com/kb/HT201220>) page. You can encrypt communications with Apple using the [Apple Product Security PGP Key](<https://support.apple.com/kb/HT201601>).\n\nApple security documents reference vulnerabilities by [CVE-ID](<http://cve.mitre.org/about/>) when possible.\n\n\n\n## iOS 10.3.3\n\nReleased July 19, 2017\n\n**Contacts**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution\n\nDescription: A buffer overflow issue was addressed through improved memory handling.\n\nCVE-2017-7062: Shashank (@cyberboyIndia)\n\n**CoreAudio**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Processing a maliciously crafted movie file may lead to arbitrary code execution\n\nDescription: A memory corruption issue was addressed with improved bounds checking.\n\nCVE-2017-7008: Yangkang (@dnpushme) of Qihoo 360 Qex Team\n\n**EventKitUI**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: A remote attacker may cause an unexpected application termination\n\nDescription: A resource exhaustion issue was addressed through improved input validation.\n\nCVE-2017-7007: Jos\u00e9 Antonio Esteban (@Erratum_) of Sapsi Consultores\n\n**IOUSBFamily**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-7009: shrek_wzw of Qihoo 360 Nirvan Team\n\n**Kernel**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-7022: an anonymous researcher\n\nCVE-2017-7024: an anonymous researcher\n\nCVE-2017-7026: an anonymous researcher\n\n**Kernel**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-7023: an anonymous researcher\n\nCVE-2017-7025: an anonymous researcher\n\nCVE-2017-7027: an anonymous researcher\n\nCVE-2017-7069: Proteas of Qihoo 360 Nirvan Team\n\n**Kernel**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An application may be able to read restricted memory\n\nDescription: A validation issue was addressed with improved input sanitization.\n\nCVE-2017-7028: an anonymous researcher\n\nCVE-2017-7029: an anonymous researcher\n\n**libarchive**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Unpacking a maliciously crafted archive may lead to arbitrary code execution\n\nDescription: A buffer overflow was addressed through improved bounds checking.\n\nCVE-2017-7068: found by OSS-Fuzz\n\n**libxml2**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: Parsing a maliciously crafted XML document may lead to disclosure of user information\n\nDescription: An out-of-bounds read was addressed through improved bounds checking.\n\nCVE-2017-7010: Apple\n\nCVE-2017-7013: found by OSS-Fuzz\n\n**libxpc**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-7047: Ian Beer of Google Project Zero\n\n**Messages**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: A remote attacker may cause an unexpected application termination\n\nDescription: A memory consumption issue was addressed through improved memory handling.\n\nCVE-2017-7063: Shashank (@cyberboyIndia)\n\n**Notifications**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Notifications may appear on the lock screen when disabled\n\nDescription: A lock screen issue was addressed with improved state management.\n\nCVE-2017-7058: Beyza Sevin\u00e7 of S\u00fcleyman Demirel \u00dcniversitesi\n\nEntry updated July 28, 2017\n\n**Safari**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Visiting a malicious website may lead to address bar spoofing\n\nDescription: An inconsistent user interface issue was addressed with improved state management.\n\nCVE-2017-2517: xisigr of Tencent's Xuanwu Lab (tencent.com)\n\n**Safari Printing**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: Processing maliciously crafted web content may lead to an infinite number of print dialogs\n\nDescription: An issue existed where a malicious or compromised website could show infinite print dialogs and make users believe their browser was locked. The issue was addressed through throttling of print dialogs.\n\nCVE-2017-7060: Travis Kelley of City of Mishawaka, Indiana\n\n**Telephony**\n\nAvailable for: iPhone 5 and later, and Wi-Fi + Cellular models of iPad 4th generation and later\n\nImpact: An attacker in a privileged network position may be able to execute arbitrary code\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-8248\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: A malicious website may exfiltrate data cross-origin\n\nDescription: Processing maliciously crafted web content may allow cross-origin data to be exfiltrated by using SVG filters to conduct a timing side-channel attack. This issue was addressed by not painting the cross-origin buffer into the frame that gets filtered.\n\nCVE-2017-7006: an anonymous researcher, David Kohlbrenner of UC San Diego\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Visiting a malicious website may lead to address bar spoofing\n\nDescription: A state management issue was addressed with improved frame handling.\n\nCVE-2017-7011: xisigr of Tencent's Xuanwu Lab (tencent.com)\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved memory handling.\n\nCVE-2017-7018: lokihardt of Google Project Zero\n\nCVE-2017-7020: likemeng of Baidu Security Lab\n\nCVE-2017-7030: chenqin of Ant-financial Light-Year Security Lab (\u8682\u8681\u91d1\u670d\u5df4\u65af\u5149\u5e74\u5b89\u5168\u5b9e\u9a8c\u5ba4)\n\nCVE-2017-7034: chenqin of Ant-financial Light-Year Security Lab (\u8682\u8681\u91d1\u670d\u5df4\u65af\u5149\u5e74\u5b89\u5168\u5b9e\u9a8c\u5ba4)\n\nCVE-2017-7037: lokihardt of Google Project Zero\n\nCVE-2017-7039: Ivan Fratric of Google Project Zero\n\nCVE-2017-7040: Ivan Fratric of Google Project Zero\n\nCVE-2017-7041: Ivan Fratric of Google Project Zero\n\nCVE-2017-7042: Ivan Fratric of Google Project Zero\n\nCVE-2017-7043: Ivan Fratric of Google Project Zero\n\nCVE-2017-7046: Ivan Fratric of Google Project Zero\n\nCVE-2017-7048: Ivan Fratric of Google Project Zero\n\nCVE-2017-7052: cc working with Trend Micro's Zero Day Initiative\n\nCVE-2017-7055: The UK's National Cyber Security Centre (NCSC)\n\nCVE-2017-7056: lokihardt of Google Project Zero\n\nCVE-2017-7061: lokihardt of Google Project Zero\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Processing maliciously crafted web content with DOMParser may lead to cross site scripting\n\nDescription: A logic issue existed in the handling of DOMParser. This issue was addressed with improved state management.\n\nCVE-2017-7038: Egor Karbutov (@ShikariSenpai) of Digital Security and Egor Saltykov (@ansjdnakjdnajkd) of Digital Security, Neil Jenkins of FastMail Pty Ltd\n\nCVE-2017-7059: Masato Kinugawa and Mario Heiderich of Cure53\n\nEntry updated July 28, 2017\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed through improved memory handling.\n\nCVE-2017-7049: Ivan Fratric of Google Project Zero\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An application may be able to read restricted memory\n\nDescription: A memory initialization issue was addressed through improved memory handling.\n\nCVE-2017-7064: lokihardt of Google Project Zero\n\n**WebKit Page Loading**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved memory handling.\n\nCVE-2017-7019: Zhiyang Zeng of Tencent Security Platform Department\n\n**WebKit Web Inspector**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved memory handling.\n\nCVE-2017-7012: Apple\n\n**Wi-Fi**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An attacker within range may be able to execute arbitrary code on the Wi-Fi chip\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-7065: Gal Beniamini of Google Project Zero\n\nEntry added September 25, 2017\n\n**Wi-Fi**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An attacker in Wi-Fi range may be able to cause a denial of service on the Wi-Fi chip\n\nDescription: A memory corruption issue was addressed with improved validation.\n\nCVE-2017-7066: Gal Beniamini of Google Project Zero\n\nEntry added September 26, 2017\n\n**Wi-Fi**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An attacker within range may be able to execute arbitrary code on the Wi-Fi chip\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-9417: Nitay Artenstein of Exodus Intelligence\n", "published": "2020-07-27T08:16:12", "modified": "2020-07-27T08:16:12", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}, "href": "https://support.apple.com/kb/HT207923", "reporter": "Apple", "references": [], "cvelist": ["CVE-2017-7063", "CVE-2017-7034", "CVE-2017-7043", "CVE-2017-7062", "CVE-2017-7064", "CVE-2017-7020", "CVE-2017-8248", "CVE-2017-7008", "CVE-2017-7038", "CVE-2017-7026", "CVE-2017-7056", "CVE-2017-7024", "CVE-2017-7055", "CVE-2017-7022", "CVE-2017-7013", "CVE-2017-7042", "CVE-2017-7049", "CVE-2017-7060", "CVE-2017-9417", "CVE-2017-7007", "CVE-2017-7037", "CVE-2017-7010", "CVE-2017-7018", "CVE-2017-7052", "CVE-2017-7029", "CVE-2017-7061", "CVE-2017-7048", "CVE-2017-7039", "CVE-2017-7046", "CVE-2017-7023", "CVE-2017-7066", "CVE-2017-7028", "CVE-2017-7058", "CVE-2017-7025", "CVE-2017-7012", "CVE-2017-7019", "CVE-2017-7040", "CVE-2017-7069", "CVE-2017-2517", "CVE-2017-7009", "CVE-2017-7011", "CVE-2017-7006", "CVE-2017-7059", "CVE-2017-7065", "CVE-2017-7047", "CVE-2017-7068", "CVE-2017-7030", "CVE-2017-7041", "CVE-2017-7027"], "type": "apple", "lastseen": "2020-12-24T20:42:09", "history": [{"bulletin": {"affectedSoftware": [{"name": "iOS", "operator": "lt", "version": "10.3.3"}], "bulletinFamily": "software", "cvelist": ["CVE-2017-7063", "CVE-2017-7034", "CVE-2017-7043", "CVE-2017-7062", "CVE-2017-7064", "CVE-2017-7020", "CVE-2017-8248", "CVE-2017-7008", "CVE-2017-7038", "CVE-2017-7026", "CVE-2017-7056", "CVE-2017-7024", "CVE-2017-7055", "CVE-2017-7022", "CVE-2017-7013", "CVE-2017-7042", "CVE-2017-7049", "CVE-2017-7060", "CVE-2017-9417", "CVE-2017-7007", "CVE-2017-7037", "CVE-2017-7010", "CVE-2017-7018", "CVE-2017-7052", "CVE-2017-7029", "CVE-2017-7061", "CVE-2017-7048", "CVE-2017-7039", "CVE-2017-7046", "CVE-2017-7023", "CVE-2017-7066", "CVE-2017-7028", "CVE-2017-7058", "CVE-2017-7025", "CVE-2017-7012", "CVE-2017-7019", "CVE-2017-7040", "CVE-2017-7069", "CVE-2017-2517", "CVE-2017-7009", "CVE-2017-7011", "CVE-2017-7006", "CVE-2017-7059", "CVE-2017-7065", "CVE-2017-7047", "CVE-2017-7068", "CVE-2017-7030", "CVE-2017-7041", "CVE-2017-7027"], "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}, "description": "## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the [Apple security updates](<https://support.apple.com/kb/HT201222>) page.\n\nFor more information about security, see the [Apple Product Security](<https://support.apple.com/kb/HT201220>) page. You can encrypt communications with Apple using the [Apple Product Security PGP Key](<https://support.apple.com/kb/HT201601>).\n\nApple security documents reference vulnerabilities by [CVE-ID](<http://cve.mitre.org/about/>) when possible.\n\n\n\n## iOS 10.3.3\n\nReleased July 19, 2017\n\n**Contacts**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution\n\nDescription: A buffer overflow issue was addressed through improved memory handling.\n\nCVE-2017-7062: Shashank (@cyberboyIndia)\n\n**CoreAudio**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Processing a maliciously crafted movie file may lead to arbitrary code execution\n\nDescription: A memory corruption issue was addressed with improved bounds checking.\n\nCVE-2017-7008: Yangkang (@dnpushme) of Qihoo 360 Qex Team\n\n**EventKitUI**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: A remote attacker may cause an unexpected application termination\n\nDescription: A resource exhaustion issue was addressed through improved input validation.\n\nCVE-2017-7007: Jos\u00e9 Antonio Esteban (@Erratum_) of Sapsi Consultores\n\n**IOUSBFamily**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-7009: shrek_wzw of Qihoo 360 Nirvan Team\n\n**Kernel**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-7022: an anonymous researcher\n\nCVE-2017-7024: an anonymous researcher\n\nCVE-2017-7026: an anonymous researcher\n\n**Kernel**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-7023: an anonymous researcher\n\nCVE-2017-7025: an anonymous researcher\n\nCVE-2017-7027: an anonymous researcher\n\nCVE-2017-7069: Proteas of Qihoo 360 Nirvan Team\n\n**Kernel**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An application may be able to read restricted memory\n\nDescription: A validation issue was addressed with improved input sanitization.\n\nCVE-2017-7028: an anonymous researcher\n\nCVE-2017-7029: an anonymous researcher\n\n**libarchive**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Unpacking a maliciously crafted archive may lead to arbitrary code execution\n\nDescription: A buffer overflow was addressed through improved bounds checking.\n\nCVE-2017-7068: found by OSS-Fuzz\n\n**libxml2**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: Parsing a maliciously crafted XML document may lead to disclosure of user information\n\nDescription: An out-of-bounds read was addressed through improved bounds checking.\n\nCVE-2017-7010: Apple\n\nCVE-2017-7013: found by OSS-Fuzz\n\n**libxpc**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-7047: Ian Beer of Google Project Zero\n\n**Messages**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: A remote attacker may cause an unexpected application termination\n\nDescription: A memory consumption issue was addressed through improved memory handling.\n\nCVE-2017-7063: Shashank (@cyberboyIndia)\n\n**Notifications**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Notifications may appear on the lock screen when disabled\n\nDescription: A lock screen issue was addressed with improved state management.\n\nCVE-2017-7058: Beyza Sevin\u00e7 of S\u00fcleyman Demirel \u00dcniversitesi\n\nEntry updated July 28, 2017\n\n**Safari**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Visiting a malicious website may lead to address bar spoofing\n\nDescription: An inconsistent user interface issue was addressed with improved state management.\n\nCVE-2017-2517: xisigr of Tencent's Xuanwu Lab (tencent.com)\n\n**Safari Printing**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: Processing maliciously crafted web content may lead to an infinite number of print dialogs\n\nDescription: An issue existed where a malicious or compromised website could show infinite print dialogs and make users believe their browser was locked. The issue was addressed through throttling of print dialogs.\n\nCVE-2017-7060: Travis Kelley of City of Mishawaka, Indiana\n\n**Telephony**\n\nAvailable for: iPhone 5 and later, and Wi-Fi + Cellular models of iPad 4th generation and later\n\nImpact: An attacker in a privileged network position may be able to execute arbitrary code\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-8248\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: A malicious website may exfiltrate data cross-origin\n\nDescription: Processing maliciously crafted web content may allow cross-origin data to be exfiltrated by using SVG filters to conduct a timing side-channel attack. This issue was addressed by not painting the cross-origin buffer into the frame that gets filtered.\n\nCVE-2017-7006: an anonymous researcher, David Kohlbrenner of UC San Diego\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Visiting a malicious website may lead to address bar spoofing\n\nDescription: A state management issue was addressed with improved frame handling.\n\nCVE-2017-7011: xisigr of Tencent's Xuanwu Lab (tencent.com)\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved memory handling.\n\nCVE-2017-7018: lokihardt of Google Project Zero\n\nCVE-2017-7020: likemeng of Baidu Security Lab\n\nCVE-2017-7030: chenqin of Ant-financial Light-Year Security Lab (\u8682\u8681\u91d1\u670d\u5df4\u65af\u5149\u5e74\u5b89\u5168\u5b9e\u9a8c\u5ba4)\n\nCVE-2017-7034: chenqin of Ant-financial Light-Year Security Lab (\u8682\u8681\u91d1\u670d\u5df4\u65af\u5149\u5e74\u5b89\u5168\u5b9e\u9a8c\u5ba4)\n\nCVE-2017-7037: lokihardt of Google Project Zero\n\nCVE-2017-7039: Ivan Fratric of Google Project Zero\n\nCVE-2017-7040: Ivan Fratric of Google Project Zero\n\nCVE-2017-7041: Ivan Fratric of Google Project Zero\n\nCVE-2017-7042: Ivan Fratric of Google Project Zero\n\nCVE-2017-7043: Ivan Fratric of Google Project Zero\n\nCVE-2017-7046: Ivan Fratric of Google Project Zero\n\nCVE-2017-7048: Ivan Fratric of Google Project Zero\n\nCVE-2017-7052: cc working with Trend Micro's Zero Day Initiative\n\nCVE-2017-7055: The UK's National Cyber Security Centre (NCSC)\n\nCVE-2017-7056: lokihardt of Google Project Zero\n\nCVE-2017-7061: lokihardt of Google Project Zero\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Processing maliciously crafted web content with DOMParser may lead to cross site scripting\n\nDescription: A logic issue existed in the handling of DOMParser. This issue was addressed with improved state management.\n\nCVE-2017-7038: Egor Karbutov (@ShikariSenpai) of Digital Security and Egor Saltykov (@ansjdnakjdnajkd) of Digital Security, Neil Jenkins of FastMail Pty Ltd\n\nCVE-2017-7059: Masato Kinugawa and Mario Heiderich of Cure53\n\nEntry updated July 28, 2017\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed through improved memory handling.\n\nCVE-2017-7049: Ivan Fratric of Google Project Zero\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An application may be able to read restricted memory\n\nDescription: A memory initialization issue was addressed through improved memory handling.\n\nCVE-2017-7064: lokihardt of Google Project Zero\n\n**WebKit Page Loading**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved memory handling.\n\nCVE-2017-7019: Zhiyang Zeng of Tencent Security Platform Department\n\n**WebKit Web Inspector**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved memory handling.\n\nCVE-2017-7012: Apple\n\n**Wi-Fi**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An attacker within range may be able to execute arbitrary code on the Wi-Fi chip\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-7065: Gal Beniamini of Google Project Zero\n\nEntry added September 25, 2017\n\n**Wi-Fi**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An attacker in Wi-Fi range may be able to cause a denial of service on the Wi-Fi chip\n\nDescription: A memory corruption issue was addressed with improved validation.\n\nCVE-2017-7066: Gal Beniamini of Google Project Zero\n\nEntry added September 26, 2017\n\n**Wi-Fi**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An attacker within range may be able to execute arbitrary code on the Wi-Fi chip\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-9417: Nitay Artenstein of Exodus Intelligence\n", "edition": 2, "enchantments": {"dependencies": {"modified": "2020-07-28T03:17:15", "references": [{"idList": ["GLSA-201710-14"], "type": "gentoo"}, {"idList": ["CVE-2017-8248", "CVE-2017-7008", "CVE-2017-7024", "CVE-2017-7007", "CVE-2017-7029", "CVE-2017-7023", "CVE-2017-7028", "CVE-2017-7058", "CVE-2017-7025", "CVE-2017-7009"], "type": "cve"}, {"idList": ["USN-3376-1"], "type": "ubuntu"}, {"idList": ["KLA11075"], "type": "kaspersky"}, {"idList": ["ITUNES_12_6_2_BANNER.NASL", "FEDORA_2017-73D6A0DFBB.NASL", "ITUNES_12_6_2.NASL", "FEDORA_2017-24BDDB96B5.NASL", "FEDORA_2017-9D572CC64A.NASL", "FREEBSD_PKG_0F66B901715C11E7AD1FBCAEC565249C.NASL", "MACOSX_SAFARI10_1_2.NASL", "MACOS_ITUNES_12_6_2.NASL", "UBUNTU_USN-3376-1.NASL", "GENTOO_GLSA-201710-14.NASL"], "type": "nessus"}, {"idList": ["0F66B901-715C-11E7-AD1F-BCAEC565249C"], "type": "freebsd"}, {"idList": ["APPLE:HT207921", "APPLE:HT207924", "APPLE:HT207922", "APPLE:HT207925", "APPLE:HT207927", "APPLE:HT207928"], "type": "apple"}, {"idList": ["OPENVAS:1361412562310873200", "OPENVAS:1361412562310811252", "OPENVAS:1361412562310873226", "OPENVAS:1361412562310843266", "OPENVAS:1361412562310811251", "OPENVAS:1361412562310811538", "OPENVAS:1361412562310811535", "OPENVAS:1361412562310873180"], "type": "openvas"}, {"idList": ["ASA-201707-25"], "type": "archlinux"}, {"idList": ["THREATPOST:60D5DA46BF733084F46AB656BE8CC259"], "type": "threatpost"}, {"idList": ["ANDROID:CVE-2017-9417", "ANDROID:CVE-2017-7065", "ANDROID:CVE-2017-8248"], "type": "android"}, {"idList": ["FEDORA:417B06017118", "FEDORA:33FB9639A184", "FEDORA:D681D609273A"], "type": "fedora"}, {"idList": ["SSV:96298", "SSV:96302", "SSV:96629", "SSV:96311", "SSV:96313", "SSV:96314", "SSV:96301", "SSV:96307", "SSV:96306", "SSV:96310"], "type": "seebug"}], "rev": 2}, "score": {"modified": "2020-07-28T03:17:15", "rev": 2, "value": 6.6, "vector": "NONE"}}, "hash": "49cd36381d71a2830da3380ff0da6520c5a2e930fd33e415e68f65eb4fcebdf0", "hashmap": [{"hash": "d50e1a28f26c4fab774ba4fd99ade3a4", "key": "published"}, {"hash": "1f3870be274f6c49b3e31a0c6728957f", "key": "type"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "references"}, {"hash": "96d39609ef24ed848117a637588148ad", "key": "description"}, {"hash": "9f6290f4436e5a2351f12e03b6433c3c", "key": "reporter"}, {"hash": "f9fa10ba956cacf91d7878861139efb9", "key": "bulletinFamily"}, {"hash": "7778093421d79f6b58223d4d98424790", "key": "title"}, {"hash": "edfca85c4c320ffaa9dcfdcb6a20ce1d", "key": "cvss"}, {"hash": "7343320d1bb0b79df34c2a605cc6d3ef", "key": "cvelist"}, {"hash": "4dacbbc9556b5669270345a38d765924", "key": "affectedSoftware"}, {"hash": "d50e1a28f26c4fab774ba4fd99ade3a4", "key": "modified"}, {"hash": "7e0409b68c66fb6768b1a14f1e1b113c", "key": "href"}], "history": [], "href": "https://support.apple.com/kb/HT207923", "id": "APPLE:HT207923", "lastseen": "2020-07-28T03:17:15", "modified": "2020-07-27T08:16:12", "objectVersion": "1.3", "published": "2020-07-27T08:16:12", "references": [], "reporter": "Apple", "title": "About the security content of iOS 10.3.3 - Apple Support", "type": "apple", "viewCount": 2}, "differentElements": ["affectedSoftware"], "edition": 2, "lastseen": "2020-07-28T03:17:15"}, {"bulletin": {"affectedSoftware": [{"name": "iOS", "operator": "lt", "version": "10.3.3"}], "bulletinFamily": "software", "cvelist": ["CVE-2017-7063", "CVE-2017-7034", "CVE-2017-7043", "CVE-2017-7062", "CVE-2017-7064", "CVE-2017-7020", "CVE-2017-8248", "CVE-2017-7008", "CVE-2017-7038", "CVE-2017-7026", "CVE-2017-7056", "CVE-2017-7024", "CVE-2017-7055", "CVE-2017-7022", "CVE-2017-7013", "CVE-2017-7042", "CVE-2017-7049", "CVE-2017-7060", "CVE-2017-9417", "CVE-2017-7007", "CVE-2017-7037", "CVE-2017-7010", "CVE-2017-7018", "CVE-2017-7052", "CVE-2017-7029", "CVE-2017-7061", "CVE-2017-7048", "CVE-2017-7039", "CVE-2017-7046", "CVE-2017-7023", "CVE-2017-7066", "CVE-2017-7028", "CVE-2017-7058", "CVE-2017-7025", "CVE-2017-7012", "CVE-2017-7019", "CVE-2017-7040", "CVE-2017-7069", "CVE-2017-2517", "CVE-2017-7009", "CVE-2017-7011", "CVE-2017-7006", "CVE-2017-7059", "CVE-2017-7065", "CVE-2017-7047", "CVE-2017-7068", "CVE-2017-7030", "CVE-2017-7041", "CVE-2017-7027"], "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}, "description": "## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the [Apple security updates](<https://support.apple.com/kb/HT201222>) page.\n\nFor more information about security, see the [Apple Product Security](<https://support.apple.com/kb/HT201220>) page. You can encrypt communications with Apple using the [Apple Product Security PGP Key](<https://support.apple.com/kb/HT201601>).\n\nApple security documents reference vulnerabilities by [CVE-ID](<http://cve.mitre.org/about/>) when possible.\n\n\n\n## iOS 10.3.3\n\nReleased July 19, 2017\n\n**Contacts**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution\n\nDescription: A buffer overflow issue was addressed through improved memory handling.\n\nCVE-2017-7062: Shashank (@cyberboyIndia)\n\n**CoreAudio**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Processing a maliciously crafted movie file may lead to arbitrary code execution\n\nDescription: A memory corruption issue was addressed with improved bounds checking.\n\nCVE-2017-7008: Yangkang (@dnpushme) of Qihoo 360 Qex Team\n\n**EventKitUI**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: A remote attacker may cause an unexpected application termination\n\nDescription: A resource exhaustion issue was addressed through improved input validation.\n\nCVE-2017-7007: Jos\u00e9 Antonio Esteban (@Erratum_) of Sapsi Consultores\n\n**IOUSBFamily**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-7009: shrek_wzw of Qihoo 360 Nirvan Team\n\n**Kernel**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-7022: an anonymous researcher\n\nCVE-2017-7024: an anonymous researcher\n\nCVE-2017-7026: an anonymous researcher\n\n**Kernel**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-7023: an anonymous researcher\n\nCVE-2017-7025: an anonymous researcher\n\nCVE-2017-7027: an anonymous researcher\n\nCVE-2017-7069: Proteas of Qihoo 360 Nirvan Team\n\n**Kernel**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An application may be able to read restricted memory\n\nDescription: A validation issue was addressed with improved input sanitization.\n\nCVE-2017-7028: an anonymous researcher\n\nCVE-2017-7029: an anonymous researcher\n\n**libarchive**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Unpacking a maliciously crafted archive may lead to arbitrary code execution\n\nDescription: A buffer overflow was addressed through improved bounds checking.\n\nCVE-2017-7068: found by OSS-Fuzz\n\n**libxml2**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: Parsing a maliciously crafted XML document may lead to disclosure of user information\n\nDescription: An out-of-bounds read was addressed through improved bounds checking.\n\nCVE-2017-7010: Apple\n\nCVE-2017-7013: found by OSS-Fuzz\n\n**libxpc**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-7047: Ian Beer of Google Project Zero\n\n**Messages**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: A remote attacker may cause an unexpected application termination\n\nDescription: A memory consumption issue was addressed through improved memory handling.\n\nCVE-2017-7063: Shashank (@cyberboyIndia)\n\n**Notifications**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Notifications may appear on the lock screen when disabled\n\nDescription: A lock screen issue was addressed with improved state management.\n\nCVE-2017-7058: Beyza Sevin\u00e7 of S\u00fcleyman Demirel \u00dcniversitesi\n\nEntry updated July 28, 2017\n\n**Safari**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Visiting a malicious website may lead to address bar spoofing\n\nDescription: An inconsistent user interface issue was addressed with improved state management.\n\nCVE-2017-2517: xisigr of Tencent's Xuanwu Lab (tencent.com)\n\n**Safari Printing**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: Processing maliciously crafted web content may lead to an infinite number of print dialogs\n\nDescription: An issue existed where a malicious or compromised website could show infinite print dialogs and make users believe their browser was locked. The issue was addressed through throttling of print dialogs.\n\nCVE-2017-7060: Travis Kelley of City of Mishawaka, Indiana\n\n**Telephony**\n\nAvailable for: iPhone 5 and later, and WiFi + Cellular models of iPad 4th generation and later\n\nImpact: An attacker in a privileged network position may be able to execute arbitrary code\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-8248\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: A malicious website may exfiltrate data cross-origin\n\nDescription: Processing maliciously crafted web content may allow cross-origin data to be exfiltrated by using SVG filters to conduct a timing side-channel attack. This issue was addressed by not painting the cross-origin buffer into the frame that gets filtered.\n\nCVE-2017-7006: an anonymous researcher, David Kohlbrenner of UC San Diego\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Visiting a malicious website may lead to address bar spoofing\n\nDescription: A state management issue was addressed with improved frame handling.\n\nCVE-2017-7011: xisigr of Tencent's Xuanwu Lab (tencent.com)\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved memory handling.\n\nCVE-2017-7018: lokihardt of Google Project Zero\n\nCVE-2017-7020: likemeng of Baidu Security Lab\n\nCVE-2017-7030: chenqin of Ant-financial Light-Year Security Lab (\u8682\u8681\u91d1\u670d\u5df4\u65af\u5149\u5e74\u5b89\u5168\u5b9e\u9a8c\u5ba4)\n\nCVE-2017-7034: chenqin of Ant-financial Light-Year Security Lab (\u8682\u8681\u91d1\u670d\u5df4\u65af\u5149\u5e74\u5b89\u5168\u5b9e\u9a8c\u5ba4)\n\nCVE-2017-7037: lokihardt of Google Project Zero\n\nCVE-2017-7039: Ivan Fratric of Google Project Zero\n\nCVE-2017-7040: Ivan Fratric of Google Project Zero\n\nCVE-2017-7041: Ivan Fratric of Google Project Zero\n\nCVE-2017-7042: Ivan Fratric of Google Project Zero\n\nCVE-2017-7043: Ivan Fratric of Google Project Zero\n\nCVE-2017-7046: Ivan Fratric of Google Project Zero\n\nCVE-2017-7048: Ivan Fratric of Google Project Zero\n\nCVE-2017-7052: cc working with Trend Micro's Zero Day Initiative\n\nCVE-2017-7055: The UK's National Cyber Security Centre (NCSC)\n\nCVE-2017-7056: lokihardt of Google Project Zero\n\nCVE-2017-7061: lokihardt of Google Project Zero\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Processing maliciously crafted web content with DOMParser may lead to cross site scripting\n\nDescription: A logic issue existed in the handling of DOMParser. This issue was addressed with improved state management.\n\nCVE-2017-7038: Egor Karbutov (@ShikariSenpai) of Digital Security and Egor Saltykov (@ansjdnakjdnajkd) of Digital Security, Neil Jenkins of FastMail Pty Ltd\n\nCVE-2017-7059: Masato Kinugawa and Mario Heiderich of Cure53\n\nEntry updated July 28, 2017\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed through improved memory handling.\n\nCVE-2017-7049: Ivan Fratric of Google Project Zero\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An application may be able to read restricted memory\n\nDescription: A memory initialization issue was addressed through improved memory handling.\n\nCVE-2017-7064: lokihardt of Google Project Zero\n\n**WebKit Page Loading**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved memory handling.\n\nCVE-2017-7019: Zhiyang Zeng of Tencent Security Platform Department\n\n**WebKit Web Inspector**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved memory handling.\n\nCVE-2017-7012: Apple\n\n**Wi-Fi**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An attacker within range may be able to execute arbitrary code on the Wi-Fi chip\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-7065: Gal Beniamini of Google Project Zero\n\nEntry added September 25, 2017\n\n**Wi-Fi**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An attacker in Wi-Fi range may be able to cause a denial of service on the Wi-Fi chip\n\nDescription: A memory corruption issue was addressed with improved validation.\n\nCVE-2017-7066: Gal Beniamini of Google Project Zero\n\nEntry added September 26, 2017\n\n**Wi-Fi**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An attacker within range may be able to execute arbitrary code on the Wi-Fi chip\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-9417: Nitay Artenstein of Exodus Intelligence\n", "edition": 1, "enchantments": {"dependencies": {"modified": "2020-05-07T18:05:47", "references": [{"idList": ["GLSA-201710-14"], "type": "gentoo"}, {"idList": ["USN-3376-1"], "type": "ubuntu"}, {"idList": ["KLA11075"], "type": "kaspersky"}, {"idList": ["ITUNES_12_6_2_BANNER.NASL", "FEDORA_2017-73D6A0DFBB.NASL", "ITUNES_12_6_2.NASL", "FEDORA_2017-24BDDB96B5.NASL", "FEDORA_2017-9D572CC64A.NASL", "FREEBSD_PKG_0F66B901715C11E7AD1FBCAEC565249C.NASL", "MACOSX_SAFARI10_1_2.NASL", "MACOS_ITUNES_12_6_2.NASL", "UBUNTU_USN-3376-1.NASL", "GENTOO_GLSA-201710-14.NASL"], "type": "nessus"}, {"idList": ["0F66B901-715C-11E7-AD1F-BCAEC565249C"], "type": "freebsd"}, {"idList": ["OPENSUSE-SU-2018:0326-1"], "type": "suse"}, {"idList": ["APPLE:HT207921", "APPLE:HT207924", "APPLE:HT207922", "APPLE:HT207925", "APPLE:HT207927", "APPLE:HT207928"], "type": "apple"}, {"idList": ["THREATPOST:60D5DA46BF733084F46AB656BE8CC259"], "type": "threatpost"}, {"idList": ["ANDROID:CVE-2017-9417", "ANDROID:CVE-2017-7065", "ANDROID:CVE-2017-8248"], "type": "android"}, {"idList": ["MYHACK58:62201788562"], "type": "myhack58"}, {"idList": ["SSV:96607", "SSV:96298", "SSV:96302", "SSV:96629", "SSV:96309", "SSV:96311", "SSV:96313", "SSV:96605", "SSV:96307", "SSV:96306"], "type": "seebug"}, {"idList": ["CVE-2017-8248", "CVE-2017-7026", "CVE-2017-7024", "CVE-2017-7022", "CVE-2017-7007", "CVE-2017-7010", "CVE-2017-7029", "CVE-2017-7028", "CVE-2017-7025", "CVE-2017-7065"], "type": "cve"}, {"idList": ["OPENVAS:1361412562310873200", "OPENVAS:1361412562310811252", "OPENVAS:1361412562310873226", "OPENVAS:1361412562310843266", "OPENVAS:1361412562310811251", "OPENVAS:1361412562310811538", "OPENVAS:1361412562310811535", "OPENVAS:1361412562310873180", "OPENVAS:1361412562310811536"], "type": "openvas"}], "rev": 2}, "score": {"modified": "2020-05-07T18:05:47", "rev": 2, "value": 7.0, "vector": "NONE"}}, "hash": "7c522f5c79fae9b7070c2effa20a12f57be65892e2a0fb6358c3fdf90cd1a081", "hashmap": [{"hash": "1f3870be274f6c49b3e31a0c6728957f", "key": "type"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "references"}, {"hash": "1aadd786a22b244a6b68b2176b701655", "key": "modified"}, {"hash": "bb5be3a548ec73d1c2f47389d0d03065", "key": "description"}, {"hash": "9f6290f4436e5a2351f12e03b6433c3c", "key": "reporter"}, {"hash": "f9fa10ba956cacf91d7878861139efb9", "key": "bulletinFamily"}, {"hash": "1aadd786a22b244a6b68b2176b701655", "key": "published"}, {"hash": "7778093421d79f6b58223d4d98424790", "key": "title"}, {"hash": "edfca85c4c320ffaa9dcfdcb6a20ce1d", "key": "cvss"}, {"hash": "7343320d1bb0b79df34c2a605cc6d3ef", "key": "cvelist"}, {"hash": "4dacbbc9556b5669270345a38d765924", "key": "affectedSoftware"}, {"hash": "7e0409b68c66fb6768b1a14f1e1b113c", "key": "href"}], "history": [], "href": "https://support.apple.com/kb/HT207923", "id": "APPLE:HT207923", "lastseen": "2020-05-07T18:05:47", "modified": "2017-09-26T09:38:25", "objectVersion": "1.3", "published": "2017-09-26T09:38:25", "references": [], "reporter": "Apple", "title": "About the security content of iOS 10.3.3 - Apple Support", "type": "apple", "viewCount": 0}, "differentElements": ["description", "published", "modified"], "edition": 1, "lastseen": "2020-05-07T18:05:47"}, {"bulletin": {"bulletinFamily": "software", "cvelist": ["CVE-2017-7063", "CVE-2017-7034", "CVE-2017-7043", "CVE-2017-7062", "CVE-2017-7064", "CVE-2017-7020", "CVE-2017-8248", "CVE-2017-7008", "CVE-2017-7038", "CVE-2017-7026", "CVE-2017-7056", "CVE-2017-7024", "CVE-2017-7055", "CVE-2017-7022", "CVE-2017-7013", "CVE-2017-7042", "CVE-2017-7049", "CVE-2017-7060", "CVE-2017-9417", "CVE-2017-7007", "CVE-2017-7037", "CVE-2017-7010", "CVE-2017-7018", "CVE-2017-7052", "CVE-2017-7029", "CVE-2017-7061", "CVE-2017-7048", "CVE-2017-7039", "CVE-2017-7046", "CVE-2017-7023", "CVE-2017-7066", "CVE-2017-7028", "CVE-2017-7058", "CVE-2017-7025", "CVE-2017-7012", "CVE-2017-7019", "CVE-2017-7040", "CVE-2017-7069", "CVE-2017-2517", "CVE-2017-7009", "CVE-2017-7011", "CVE-2017-7006", "CVE-2017-7059", "CVE-2017-7065", "CVE-2017-7047", "CVE-2017-7068", "CVE-2017-7030", "CVE-2017-7041", "CVE-2017-7027"], "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {}, "cvss3": {}, "description": "## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the [Apple security updates](<https://support.apple.com/kb/HT201222>) page.\n\nFor more information about security, see the [Apple Product Security](<https://support.apple.com/kb/HT201220>) page. You can encrypt communications with Apple using the [Apple Product Security PGP Key](<https://support.apple.com/kb/HT201601>).\n\nApple security documents reference vulnerabilities by [CVE-ID](<http://cve.mitre.org/about/>) when possible.\n\n\n\n## iOS 10.3.3\n\nReleased July 19, 2017\n\n**Contacts**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution\n\nDescription: A buffer overflow issue was addressed through improved memory handling.\n\nCVE-2017-7062: Shashank (@cyberboyIndia)\n\n**CoreAudio**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Processing a maliciously crafted movie file may lead to arbitrary code execution\n\nDescription: A memory corruption issue was addressed with improved bounds checking.\n\nCVE-2017-7008: Yangkang (@dnpushme) of Qihoo 360 Qex Team\n\n**EventKitUI**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: A remote attacker may cause an unexpected application termination\n\nDescription: A resource exhaustion issue was addressed through improved input validation.\n\nCVE-2017-7007: Jos\u00e9 Antonio Esteban (@Erratum_) of Sapsi Consultores\n\n**IOUSBFamily**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-7009: shrek_wzw of Qihoo 360 Nirvan Team\n\n**Kernel**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-7022: an anonymous researcher\n\nCVE-2017-7024: an anonymous researcher\n\nCVE-2017-7026: an anonymous researcher\n\n**Kernel**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-7023: an anonymous researcher\n\nCVE-2017-7025: an anonymous researcher\n\nCVE-2017-7027: an anonymous researcher\n\nCVE-2017-7069: Proteas of Qihoo 360 Nirvan Team\n\n**Kernel**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An application may be able to read restricted memory\n\nDescription: A validation issue was addressed with improved input sanitization.\n\nCVE-2017-7028: an anonymous researcher\n\nCVE-2017-7029: an anonymous researcher\n\n**libarchive**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Unpacking a maliciously crafted archive may lead to arbitrary code execution\n\nDescription: A buffer overflow was addressed through improved bounds checking.\n\nCVE-2017-7068: found by OSS-Fuzz\n\n**libxml2**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: Parsing a maliciously crafted XML document may lead to disclosure of user information\n\nDescription: An out-of-bounds read was addressed through improved bounds checking.\n\nCVE-2017-7010: Apple\n\nCVE-2017-7013: found by OSS-Fuzz\n\n**libxpc**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-7047: Ian Beer of Google Project Zero\n\n**Messages**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: A remote attacker may cause an unexpected application termination\n\nDescription: A memory consumption issue was addressed through improved memory handling.\n\nCVE-2017-7063: Shashank (@cyberboyIndia)\n\n**Notifications**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Notifications may appear on the lock screen when disabled\n\nDescription: A lock screen issue was addressed with improved state management.\n\nCVE-2017-7058: Beyza Sevin\u00e7 of S\u00fcleyman Demirel \u00dcniversitesi\n\nEntry updated July 28, 2017\n\n**Safari**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Visiting a malicious website may lead to address bar spoofing\n\nDescription: An inconsistent user interface issue was addressed with improved state management.\n\nCVE-2017-2517: xisigr of Tencent's Xuanwu Lab (tencent.com)\n\n**Safari Printing**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: Processing maliciously crafted web content may lead to an infinite number of print dialogs\n\nDescription: An issue existed where a malicious or compromised website could show infinite print dialogs and make users believe their browser was locked. The issue was addressed through throttling of print dialogs.\n\nCVE-2017-7060: Travis Kelley of City of Mishawaka, Indiana\n\n**Telephony**\n\nAvailable for: iPhone 5 and later, and Wi-Fi + Cellular models of iPad 4th generation and later\n\nImpact: An attacker in a privileged network position may be able to execute arbitrary code\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-8248\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: A malicious website may exfiltrate data cross-origin\n\nDescription: Processing maliciously crafted web content may allow cross-origin data to be exfiltrated by using SVG filters to conduct a timing side-channel attack. This issue was addressed by not painting the cross-origin buffer into the frame that gets filtered.\n\nCVE-2017-7006: an anonymous researcher, David Kohlbrenner of UC San Diego\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Visiting a malicious website may lead to address bar spoofing\n\nDescription: A state management issue was addressed with improved frame handling.\n\nCVE-2017-7011: xisigr of Tencent's Xuanwu Lab (tencent.com)\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved memory handling.\n\nCVE-2017-7018: lokihardt of Google Project Zero\n\nCVE-2017-7020: likemeng of Baidu Security Lab\n\nCVE-2017-7030: chenqin of Ant-financial Light-Year Security Lab (\u8682\u8681\u91d1\u670d\u5df4\u65af\u5149\u5e74\u5b89\u5168\u5b9e\u9a8c\u5ba4)\n\nCVE-2017-7034: chenqin of Ant-financial Light-Year Security Lab (\u8682\u8681\u91d1\u670d\u5df4\u65af\u5149\u5e74\u5b89\u5168\u5b9e\u9a8c\u5ba4)\n\nCVE-2017-7037: lokihardt of Google Project Zero\n\nCVE-2017-7039: Ivan Fratric of Google Project Zero\n\nCVE-2017-7040: Ivan Fratric of Google Project Zero\n\nCVE-2017-7041: Ivan Fratric of Google Project Zero\n\nCVE-2017-7042: Ivan Fratric of Google Project Zero\n\nCVE-2017-7043: Ivan Fratric of Google Project Zero\n\nCVE-2017-7046: Ivan Fratric of Google Project Zero\n\nCVE-2017-7048: Ivan Fratric of Google Project Zero\n\nCVE-2017-7052: cc working with Trend Micro's Zero Day Initiative\n\nCVE-2017-7055: The UK's National Cyber Security Centre (NCSC)\n\nCVE-2017-7056: lokihardt of Google Project Zero\n\nCVE-2017-7061: lokihardt of Google Project Zero\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: Processing maliciously crafted web content with DOMParser may lead to cross site scripting\n\nDescription: A logic issue existed in the handling of DOMParser. This issue was addressed with improved state management.\n\nCVE-2017-7038: Egor Karbutov (@ShikariSenpai) of Digital Security and Egor Saltykov (@ansjdnakjdnajkd) of Digital Security, Neil Jenkins of FastMail Pty Ltd\n\nCVE-2017-7059: Masato Kinugawa and Mario Heiderich of Cure53\n\nEntry updated July 28, 2017\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed through improved memory handling.\n\nCVE-2017-7049: Ivan Fratric of Google Project Zero\n\n**WebKit**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An application may be able to read restricted memory\n\nDescription: A memory initialization issue was addressed through improved memory handling.\n\nCVE-2017-7064: lokihardt of Google Project Zero\n\n**WebKit Page Loading**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved memory handling.\n\nCVE-2017-7019: Zhiyang Zeng of Tencent Security Platform Department\n\n**WebKit Web Inspector**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation \n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved memory handling.\n\nCVE-2017-7012: Apple\n\n**Wi-Fi**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An attacker within range may be able to execute arbitrary code on the Wi-Fi chip\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-7065: Gal Beniamini of Google Project Zero\n\nEntry added September 25, 2017\n\n**Wi-Fi**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An attacker in Wi-Fi range may be able to cause a denial of service on the Wi-Fi chip\n\nDescription: A memory corruption issue was addressed with improved validation.\n\nCVE-2017-7066: Gal Beniamini of Google Project Zero\n\nEntry added September 26, 2017\n\n**Wi-Fi**\n\nAvailable for: iPhone 5 and later, iPad 4th generation and later, and iPod touch 6th generation\n\nImpact: An attacker within range may be able to execute arbitrary code on the Wi-Fi chip\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2017-9417: Nitay Artenstein of Exodus Intelligence\n", "edition": 3, "enchantments": {"dependencies": {"modified": "2020-12-24T20:42:09", "references": [{"idList": ["GLSA-201710-14"], "type": "gentoo"}, {"idList": ["CVE-2017-8248", "CVE-2017-7008", "CVE-2017-7024", "CVE-2017-7022", "CVE-2017-7007", "CVE-2017-7029", "CVE-2017-7028", "CVE-2017-7058", "CVE-2017-7025", "CVE-2017-7009"], "type": "cve"}, {"idList": ["USN-3376-1"], "type": "ubuntu"}, {"idList": ["KLA11075"], "type": "kaspersky"}, {"idList": ["ITUNES_12_6_2_BANNER.NASL", "FEDORA_2017-73D6A0DFBB.NASL", "ITUNES_12_6_2.NASL", "FEDORA_2017-24BDDB96B5.NASL", "FEDORA_2017-9D572CC64A.NASL", "FREEBSD_PKG_0F66B901715C11E7AD1FBCAEC565249C.NASL", "MACOSX_SAFARI10_1_2.NASL", "MACOS_ITUNES_12_6_2.NASL", "UBUNTU_USN-3376-1.NASL", "GENTOO_GLSA-201710-14.NASL"], "type": "nessus"}, {"idList": ["0F66B901-715C-11E7-AD1F-BCAEC565249C"], "type": "freebsd"}, {"idList": ["APPLE:HT207921", "APPLE:HT207924", "APPLE:HT207925", "APPLE:HT207927", "APPLE:HT207928"], "type": "apple"}, {"idList": ["OPENVAS:1361412562310873200", "OPENVAS:1361412562310811252", "OPENVAS:1361412562310873226", "OPENVAS:1361412562310843266", "OPENVAS:1361412562310811251", "OPENVAS:1361412562310811538", "OPENVAS:1361412562310811535", "OPENVAS:1361412562310873180"], "type": "openvas"}, {"idList": ["ASA-201707-25"], "type": "archlinux"}, {"idList": ["THREATPOST:60D5DA46BF733084F46AB656BE8CC259"], "type": "threatpost"}, {"idList": ["UB:CVE-2017-7034", "UB:CVE-2017-7019", "UB:CVE-2017-7049", "UB:CVE-2017-7006", "UB:CVE-2017-7010", "UB:CVE-2017-7037", "UB:CVE-2017-7043", "UB:CVE-2017-7038", "UB:CVE-2017-7011", "UB:CVE-2017-7013"], "type": "ubuntucve"}, {"idList": ["ANDROID:CVE-2017-9417", "ANDROID:CVE-2017-7065", "ANDROID:CVE-2017-8248"], "type": "android"}, {"idList": ["FEDORA:417B06017118", "FEDORA:33FB9639A184", "FEDORA:D681D609273A"], "type": "fedora"}], "rev": 2}, "score": {"modified": "2020-12-24T20:42:09", "rev": 2, "value": 6.4, "vector": "NONE"}}, "hash": "df639cc0153c766df30ce087954ed28fa1f712f2376144999be977371c030d5d", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "immutableFields"}, {"hash": "d50e1a28f26c4fab774ba4fd99ade3a4", "key": "published"}, {"hash": "1f3870be274f6c49b3e31a0c6728957f", "key": "type"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "references"}, {"hash": "96d39609ef24ed848117a637588148ad", "key": "description"}, {"hash": "9f6290f4436e5a2351f12e03b6433c3c", "key": "reporter"}, {"hash": "f9fa10ba956cacf91d7878861139efb9", "key": "bulletinFamily"}, {"hash": "7778093421d79f6b58223d4d98424790", "key": "title"}, {"hash": "edfca85c4c320ffaa9dcfdcb6a20ce1d", "key": "cvss"}, {"hash": "7343320d1bb0b79df34c2a605cc6d3ef", "key": "cvelist"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss3"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss2"}, {"hash": "d50e1a28f26c4fab774ba4fd99ade3a4", "key": "modified"}, {"hash": "7e0409b68c66fb6768b1a14f1e1b113c", "key": "href"}], "history": [], "href": "https://support.apple.com/kb/HT207923", "id": "APPLE:HT207923", "immutableFields": [], "lastseen": "2020-12-24T20:42:09", "modified": "2020-07-27T08:16:12", "objectVersion": "1.5", "published": "2020-07-27T08:16:12", "references": [], "reporter": "Apple", "title": "About the security content of iOS 10.3.3 - Apple Support", "type": "apple", "viewCount": 4}, "different_elements": ["cvss3", "cvss2"], "edition": 3, "lastseen": "2020-12-24T20:42:09"}], "edition": 4, "hashmap": [{"key": "bulletinFamily", "hash": "f9fa10ba956cacf91d7878861139efb9"}, {"key": "cvelist", "hash": "7343320d1bb0b79df34c2a605cc6d3ef"}, {"key": "cvss", "hash": "edfca85c4c320ffaa9dcfdcb6a20ce1d"}, {"key": "cvss2", "hash": "2eda51aa00254f6a2acf49f602c4bbfa"}, {"key": "cvss3", "hash": "48cec8f43ff700f672081508fe3d5099"}, {"key": "description", "hash": "96d39609ef24ed848117a637588148ad"}, {"key": "href", "hash": "7e0409b68c66fb6768b1a14f1e1b113c"}, {"key": "immutableFields", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "modified", "hash": "d50e1a28f26c4fab774ba4fd99ade3a4"}, {"key": "published", "hash": "d50e1a28f26c4fab774ba4fd99ade3a4"}, {"key": "references", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "reporter", "hash": "9f6290f4436e5a2351f12e03b6433c3c"}, {"key": "title", "hash": "7778093421d79f6b58223d4d98424790"}, {"key": "type", "hash": "1f3870be274f6c49b3e31a0c6728957f"}], "hash": "94c7659d8418f21402ceba6cf54bd99ce8dab481e260c04c5e3e05b79a54daf2", "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "nessus", "idList": ["APPLE_IOS_1033_CHECK.NBIN", "700169.PRM", "FEDORA_2017-9D572CC64A.NASL", "FEDORA_2017-73D6A0DFBB.NASL", "ITUNES_12_6_2_BANNER.NASL", "FEDORA_2017-24BDDB96B5.NASL", "FREEBSD_PKG_0F66B901715C11E7AD1FBCAEC565249C.NASL", "ITUNES_12_6_2.NASL", "700167.PRM", "700166.PRM", "700168.PRM", "UBUNTU_USN-3376-1.NASL", "MACOSX_SAFARI10_1_2.NASL", "MACOS_ITUNES_12_6_2.NASL", "GENTOO_GLSA-201710-14.NASL"]}, {"type": "apple", "idList": ["APPLE:HT207928", "APPLE:CEC7DCE5379D5C1DBB2795CA582D13CD", "APPLE:F234B75385D1403C977E0F0F5AEA4D95", "APPLE:HT207925", "APPLE:ABA73FEAAAB2192DEAFA24CF2EB1B8F9", "APPLE:21F236C1A9D411224D0D290A7D88873F", "APPLE:5D035145E3EE53A8C36DC063A0DC8B49", "APPLE:7AFC35B4B1D8C25A050E4C951554FD97", "APPLE:HT207924", "APPLE:HT207927", "APPLE:HT207921"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310873200", "OPENVAS:1361412562310811251", "OPENVAS:1361412562310873180", "OPENVAS:1361412562310811535", "OPENVAS:1361412562310873226", "OPENVAS:1361412562310843266", "OPENVAS:1361412562310811252", "OPENVAS:1361412562310811538"]}, {"type": "freebsd", "idList": ["0F66B901-715C-11E7-AD1F-BCAEC565249C"]}, {"type": "kaspersky", "idList": ["KLA11075"]}, {"type": "gentoo", "idList": ["GLSA-201710-14"]}, {"type": "fedora", "idList": ["FEDORA:417B06017118", "FEDORA:D681D609273A", "FEDORA:33FB9639A184"]}, {"type": "archlinux", "idList": ["ASA-201707-25"]}, {"type": "ubuntu", "idList": ["USN-3376-1"]}, {"type": "threatpost", "idList": ["THREATPOST:60D5DA46BF733084F46AB656BE8CC259"]}, {"type": "cve", "idList": ["CVE-2017-7028", "CVE-2017-7047", "CVE-2017-7013", "CVE-2017-7025", "CVE-2017-7006", "CVE-2017-7037", "CVE-2017-7038", "CVE-2017-9417", "CVE-2017-7030", "CVE-2017-7008", "CVE-2017-7022", "CVE-2017-7012", "CVE-2017-7043", "CVE-2017-7027", "CVE-2017-7058", "CVE-2017-7023", "CVE-2017-7024", "CVE-2017-7034", "CVE-2017-7026", "CVE-2017-7069", "CVE-2017-7010", "CVE-2017-7018", "CVE-2017-7049", "CVE-2017-7011", "CVE-2017-7029", "CVE-2017-7009", "CVE-2017-7019", "CVE-2017-7007", "CVE-2017-8248"]}, {"type": "android", "idList": ["ANDROID:CVE-2017-9417", "ANDROID:CVE-2017-8248"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2017-7011", "UB:CVE-2017-7043", "UB:CVE-2017-7018", "UB:CVE-2017-7030", "UB:CVE-2017-7013", "UB:CVE-2017-7006", "UB:CVE-2017-7010", "UB:CVE-2017-7034", "UB:CVE-2017-7049", "UB:CVE-2017-7038", "UB:CVE-2017-7012", "UB:CVE-2017-7019", "UB:CVE-2017-7037"]}, {"type": "debiancve", "idList": ["DEBIANCVE:CVE-2017-7006", "DEBIANCVE:CVE-2017-7019", "DEBIANCVE:CVE-2017-7037", "DEBIANCVE:CVE-2017-7034", "DEBIANCVE:CVE-2017-9417", "DEBIANCVE:CVE-2017-7049", "DEBIANCVE:CVE-2017-7043", "DEBIANCVE:CVE-2017-7018", "DEBIANCVE:CVE-2017-7030", "DEBIANCVE:CVE-2017-7012", "DEBIANCVE:CVE-2017-7038", "DEBIANCVE:CVE-2017-7011"]}], "modified": "2020-12-24T20:42:09", "rev": 2}, "score": {"value": 6.4, "vector": "NONE", "modified": "2020-12-24T20:42:09", "rev": 2}}, "objectVersion": "1.5", "affectedSoftware": [{"name": "ios", "operator": "lt", "version": "10.3.3"}], "scheme": null, "immutableFields": [], "_object_type": "robots.models.apple.AppleBulletin", "_object_types": ["robots.models.apple.AppleBulletin", "robots.models.base.Bulletin"], "cvss2": {"acInsufInfo": true, "cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 10.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 5.9}}]}