Vulnerabilites related to broadcom - bcm4355c0
Vulnerability from fkie_nvd
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:broadcom:bcm4355c0_firmware:9.44.78.27.0.1.56:*:*:*:*:*:*:*",
"matchCriteriaId": "84F51115-D846-4E13-9EE3-AE29CFC0ECE6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:broadcom:bcm4355c0:-:*:*:*:*:*:*:*",
"matchCriteriaId": "76AA6E9F-384C-4981-B570-1B6B21DE5961",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
"matchCriteriaId": "17CE3EBB-FF76-4158-81FE-63AECECA988E",
"versionEndExcluding": "11.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "11895153-2FE5-4D73-B7FC-182FA280BA36",
"versionEndExcluding": "11.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor report frame to trigger an internal buffer overflow in the Wi-Fi firmware, aka B-V2017061204."
},
{
"lang": "es",
"value": "En los chips Wi-Fi Broadcom BCM4355C0 versi\u00f3n 9.44.78.27.0.1.56 y otros chips, un atacante puede crear un frame del RRM Neighbor Report Frame Handler malformadopara desencadenar un desbordamiento interno de b\u00fafer en el firmware Wi-Fi, tambi\u00e9n conocido como B-V2017061204."
}
],
"id": "CVE-2017-11120",
"lastModified": "2025-04-20T01:37:25.860",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": true,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-09-28T01:29:01.043",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/144328/Broadcom-802.11k-Neighbor-Report-Response-Out-Of-Bounds-Write.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/100984"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://bugs.chromium.org/p/project-zero/issues/detail?id=1289"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.apple.com/archives/security-announce/2017/Sep/msg00007.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.apple.com/archives/security-announce/2017/Sep/msg00009.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://source.android.com/security/bulletin/2017-09-01"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://support.apple.com/HT208112"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://support.apple.com/HT208113"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://support.apple.com/en-us/HT208112"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://support.apple.com/en-us/HT208113"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.exploit-db.com/exploits/42784/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/144328/Broadcom-802.11k-Neighbor-Report-Response-Out-Of-Bounds-Write.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/100984"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://bugs.chromium.org/p/project-zero/issues/detail?id=1289"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.apple.com/archives/security-announce/2017/Sep/msg00007.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.apple.com/archives/security-announce/2017/Sep/msg00009.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://source.android.com/security/bulletin/2017-09-01"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://support.apple.com/HT208112"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://support.apple.com/HT208113"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://support.apple.com/en-us/HT208112"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://support.apple.com/en-us/HT208113"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.exploit-db.com/exploits/42784/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-119"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:broadcom:bcm4355c0_firmware:9.44.78.27.0.1.56:*:*:*:*:*:*:*",
"matchCriteriaId": "84F51115-D846-4E13-9EE3-AE29CFC0ECE6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:broadcom:bcm4355c0:-:*:*:*:*:*:*:*",
"matchCriteriaId": "76AA6E9F-384C-4981-B570-1B6B21DE5961",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
"matchCriteriaId": "17CE3EBB-FF76-4158-81FE-63AECECA988E",
"versionEndExcluding": "11.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "11895153-2FE5-4D73-B7FC-182FA280BA36",
"versionEndExcluding": "11.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, properly crafted malicious over-the-air Fast Transition frames can potentially trigger internal Wi-Fi firmware heap and/or stack overflows, leading to denial of service or other effects, aka B-V2017061205."
},
{
"lang": "es",
"value": "En los chips Wi-Fi Broadcom BCM4355C0 9.44.78.27.0.1.56 y otros chips, se podr\u00edan desencadenar desbordamientos internos de la memoria din\u00e1mica (heap) del firmware Wi-Fi si se utilizan frames en modo Fast Transition con intinerancia Over-the-Air. Esto conducir\u00eda a una denegaci\u00f3n de servicio u otros efectos, lo que tambi\u00e9n se conoce como B-V2017061205."
}
],
"id": "CVE-2017-11121",
"lastModified": "2025-04-20T01:37:25.860",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": true,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-09-28T01:29:01.090",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/144329/Broadcom-802.11r-FT-Reassociation-Response-Overflows.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/100984"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://bugs.chromium.org/p/project-zero/issues/detail?id=1291"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.apple.com/archives/security-announce/2017/Sep/msg00007.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.apple.com/archives/security-announce/2017/Sep/msg00009.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://source.android.com/security/bulletin/2017-09-01"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://support.apple.com/HT208112"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://support.apple.com/HT208113"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://support.apple.com/en-us/HT208112"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://support.apple.com/en-us/HT208113"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/144329/Broadcom-802.11r-FT-Reassociation-Response-Overflows.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/100984"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://bugs.chromium.org/p/project-zero/issues/detail?id=1291"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.apple.com/archives/security-announce/2017/Sep/msg00007.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.apple.com/archives/security-announce/2017/Sep/msg00009.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://source.android.com/security/bulletin/2017-09-01"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://support.apple.com/HT208112"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://support.apple.com/HT208113"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://support.apple.com/en-us/HT208112"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://support.apple.com/en-us/HT208113"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-119"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:broadcom:bcm4355c0_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "170834EE-1E66-496B-B3D9-F27983162825",
"versionEndIncluding": "9.44.78.27.0.1.56",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:broadcom:bcm4355c0:-:*:*:*:*:*:*:*",
"matchCriteriaId": "76AA6E9F-384C-4981-B570-1B6B21DE5961",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B3F24ECA-0CD0-4F42-84C7-ED651C2C981B",
"versionEndIncluding": "10.3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B83AE012-4180-4C56-9173-C87749B8D284",
"versionEndIncluding": "10.2.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56, an attacker can trigger an information leak due to insufficient length validation, related to ICMPv6 router advertisement offloading."
},
{
"lang": "es",
"value": "En chips Wi-Fi de Broadcom con modelo BCM4355C0 y firmware 9.44.78.27.0.1.56, un atacante puede provocar una fuga de informaci\u00f3n por una validaci\u00f3n de longitudes insuficiente. Esto est\u00e1 relacionado con la descarga de anuncios de router ICMPv6."
}
],
"id": "CVE-2017-11122",
"lastModified": "2025-04-20T01:37:25.860",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": true,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-10-04T01:29:02.010",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/144461/Broadcom-ICMPv6-Information-Leak.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Issue Tracking",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://bugs.chromium.org/p/project-zero/issues/detail?id=1300"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://support.apple.com/HT208112"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://support.apple.com/HT208113"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://support.apple.com/en-us/HT208112"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://support.apple.com/en-us/HT208113"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/144461/Broadcom-ICMPv6-Information-Leak.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Issue Tracking",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://bugs.chromium.org/p/project-zero/issues/detail?id=1300"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://support.apple.com/HT208112"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://support.apple.com/HT208113"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://support.apple.com/en-us/HT208112"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://support.apple.com/en-us/HT208113"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
var-201906-1114
Vulnerability from variot
Broadcom firmware before summer 2014 on Nexus 5 BCM4335C0 2012-12-11, Raspberry Pi 3 BCM43438A1 2014-06-02, and unspecifed other devices does not properly restrict LMP commnds and executes certain memory contents upon receiving an LMP command, as demonstrated by executing an HCI command. Broadcom BCM4335C0 and BCM43438A1 Firmware contains vulnerabilities related to authorization, permissions, and access control.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Google Android is prone to a remote code execution vulnerability. Attackers can exploit this issue to execute arbitrary code within the context of a privileged process. Failed exploits may result in denial-of-service conditions. This issue is being tracked by Android Bug ID A-122249979. Android is a Linux-based open source operating system developed by Google and the Open Handheld Alliance (OHA). -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
APPLE-SA-2019-8-13-1 Additional information for APPLE-SA-2019-7-22-2 macOS Mojave 10.14.6, Security Update 2019-004 High Sierra, Security Update 2019-004 Sierra
macOS Mojave 10.14.6, Security Update 2019-004 High Sierra, Security Update 2019-004 Sierra address the following:
AppleGraphicsControl Available for: macOS Mojave 10.14.5 Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2019-8693: Arash Tohidi of Solita
autofs Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS Mojave 10.14.5 Impact: Extracting a zip file containing a symbolic link to an endpoint in an NFS mount that is attacker controlled may bypass Gatekeeper Description: This was addressed with additional checks by Gatekeeper on files mounted through a network share. CVE-2019-8656: Filippo Cavallarin
Bluetooth Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS Mojave 10.14.5 Impact: A remote attacker may be able to cause arbitrary code execution Description: A memory corruption issue was addressed with improved input validation. CVE-2018-19860
Bluetooth Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS Mojave 10.14.5 Impact: An attacker in a privileged network position may be able to intercept Bluetooth traffic (Key Negotiation of Bluetooth - KNOB) Description: An input validation issue existed in Bluetooth. This issue was addressed with improved input validation. CVE-2019-9506: Daniele Antonioli of SUTD, Singapore, Dr. Nils Ole Tippenhauer of CISPA, Germany, and Prof. Kasper Rasmussen of University of Oxford, England Entry added August 13, 2019
Carbon Core Available for: macOS Mojave 10.14.5 Impact: A remote attacker may be able to cause arbitrary code execution Description: A use after free issue was addressed with improved memory management. CVE-2019-8661: Natalie Silvanovich of Google Project Zero
Core Data Available for: macOS Mojave 10.14.5 Impact: A remote attacker may be able to leak memory Description: An out-of-bounds read was addressed with improved input validation. CVE-2019-8646: Natalie Silvanovich of Google Project Zero
Core Data Available for: macOS Mojave 10.14.5 Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution Description: A memory corruption issue was addressed with improved input validation. CVE-2019-8660: Samuel Groß and Natalie Silvanovich of Google Project Zero
Disk Management Available for: macOS Mojave 10.14.5 Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2019-8697: ccpwd working with Trend Micro's Zero Day Initiative
FaceTime Available for: macOS Mojave 10.14.5 Impact: A remote attacker may be able to cause arbitrary code execution Description: A memory corruption issue was addressed with improved input validation. CVE-2019-8648: Tao Huang and Tielei Wang of Team Pangu
Found in Apps Available for: macOS Mojave 10.14.5 Impact: A remote attacker may be able to leak memory Description: This issue was addressed with improved checks. CVE-2019-8663: Natalie Silvanovich of Google Project Zero
Foundation Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS Mojave 10.14.5 Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2019-8641: Samuel Groß and Natalie Silvanovich of Google Project Zero
Grapher Available for: macOS Mojave 10.14.5 Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2019-8695: riusksk of VulWar Corp working with Trend Micro's Zero Day Initiative
Graphics Drivers Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.5 Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2019-8691: Aleksandr Tarasikov (@astarasikov), Arash Tohidi of Solita, Lilang Wu and Moony Li of Trend Micro's Mobile Security Research Team working with Trend Micro's Zero Day Initiative CVE-2019-8692: Lilang Wu and Moony Li of Trend Micro Mobile Security Research Team working with Trend Micro's Zero Day Initiative
Heimdal Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS Mojave 10.14.5 Impact: An issue existed in Samba that may allow attackers to perform unauthorized actions by intercepting communications between services Description: This issue was addressed with improved checks to prevent unauthorized actions. CVE-2018-16860: Isaac Boukris and Andrew Bartlett of the Samba Team and Catalyst
IOAcceleratorFamily Available for: macOS Mojave 10.14.5 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2019-8694: Arash Tohidi of Solita
libxslt Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS Mojave 10.14.5 Impact: A remote attacker may be able to view sensitive information Description: A stack overflow was addressed with improved input validation. CVE-2019-13118: found by OSS-Fuzz
Quick Look Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS Mojave 10.14.5 Impact: An attacker may be able to trigger a use-after-free in an application deserializing an untrusted NSDictionary Description: This issue was addressed with improved checks. CVE-2019-8662: Natalie Silvanovich and Samuel Groß of Google Project Zero
Security Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6 Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2019-8697: ccpwd working with Trend Micro's Zero Day Initiative
Siri Available for: macOS Mojave 10.14.5 Impact: A remote attacker may be able to leak memory Description: An out-of-bounds read was addressed with improved input validation. CVE-2019-8646: Natalie Silvanovich of Google Project Zero
Time Machine Available for: macOS Mojave 10.14.5 Impact: The encryption status of a Time Machine backup may be incorrect Description: An inconsistent user interface issue was addressed with improved state management. CVE-2019-8667: Roland Kletzing of cyber:con GmbH
UIFoundation Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS Mojave 10.14.5 Impact: Parsing a maliciously crafted office document may lead to an unexpected application termination or arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2019-8657: riusksk of VulWar Corp working with Trend Micro's Zero Day Initiative
Additional recognition
Classroom We would like to acknowledge Jeff Johnson of underpassapp.com for their assistance.
Game Center We would like to acknowledge Min (Spark) Zheng and Xiaolong Bai of Alibaba Inc. for their assistance.
Installation note:
macOS Mojave 10.14.6, Security Update 2019-004 High Sierra, Security Update 2019-004 Sierra may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/
Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE-----
iQJdBAEBCABHFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAl1S688pHHByb2R1Y3Qt c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQeC9tht7TK3Hiog/+ PcWPEhxDpnU1ctoVPhyoqkV1tUs8z3hdNyX/tPtQZIQVFB7No1Md0GX8Zrv2libb LwrbU25ewe82XE9Es6ngxTdkRaREn8+hm9gxYPCMDXyKRlv904Q1b4zthYUt7/NO 7RG6ZRHEINOQORzrDsmgT/X6TukIy73HNob+4xZJTdJe9ZU3/zDCaqUgyUJSodou vsVFR3oqkwbVby4eT9+YbxJWMvVoFfB1+Qqo1w9kN7WXcYK3gb7sGtnNQlrE70kR pLRogcmwTQsi+sTm8bxQsuXXjdtTHeeCf0FRJg8NY5wZmdV9lNOghtmNxfTwIuir VeWusIgZWaK7IbgHW3PRYv3Sbrk40zcOraDsPv2rdgjOj4ReVyKHw5/f5Fyhcn+v WnIC4iNIBurz0HZU91QqD58Sqp+HtWl8xkM3ZW+Kd9LjnLty3fNw6Au5Aw8DTHzN 5F+lz7JRVV3+j7AYELog3WV6mdzMKW85gJRJtwXJ8hHSYZnvat06faFlPcDiKjBW rW7BehRykZpmZtaSZjL25IeOuXJHHdRfvabuTZ3nk47SSn7EJJ3xFBnvw6TgVFX+ TvmcUg5FinTSR81NkIY0ux6x1kuV/4vIUGZ4O0Houf/FoUhMQvig9ZkSw2B+Ynbd Xl3qBT4SVPWQyFAvjHwjCZA+GpNsnEKgZm8SlYVgqog= =tCwo -----END PGP SIGNATURE-----
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201906-1114",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "cyw20733a2kml1gt",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "cyw20733a2kfb1gt",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "cyw20706ua1kffb4g",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "cyw20707va2pkwbgt",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "bcm43438a1",
"scope": "eq",
"trust": 1.0,
"vendor": "broadcom",
"version": "2014-06-02"
},
{
"model": "cyw4343w1kubgt",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "cyw20704ua1kffb1g",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "cyw20705a1kwfbgt",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "cyw20702b0kwfbgt",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "cyw4343wkwbgt",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "cyw20730a1kml2gt",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "cyw20730a1kmlg",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "cyw20705b0kwfbg",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "cyw20733a2kml1g",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "cyw20734ua1kffb3g",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "cyw20733a3kfb1g",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "cyw20734ua2kffb3g",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "cyw20704ua2kffb1g",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "cyw20704ua2kffb1gt",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "cyw20707va1pkwbgt",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "cyw89335l2cubgt",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "bcm4335c0",
"scope": "eq",
"trust": 1.0,
"vendor": "broadcom",
"version": "2012-12-11"
},
{
"model": "cyw20702a1kwfbgt",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "cyw20704ua1kffb1gt",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "cyw20707ua2kffb4gt",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "cyw20703ua1kffb1gt",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "cyw20707ua1kffb4g",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "cyw20707a2kubgt",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "cyw20733a3kfb1gt",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "cyw20706ua1kffb1gt",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "cyw20730a2kfbg",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "cyw4354xkubgt",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "cyw20730a1kmlgt",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "cyw20733a3kml1gt",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "cyw20702b0kwfbg",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "cyw89072brfb5gt",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "cyw20730a2kfbgt",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "cyw20730a1kml2g",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "cyw20730a1kfbgt",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "cyw20730a2kml2g",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "cyw89071a1cubxgt",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "cyw89335lcubgt",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "cyw20707ua2kffb4g",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "cyw20733a1kfb1gt",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "cyw20730a1kfbg",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "cyw20707ua1kffb4gt",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "cyw20733a3kml1g",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "cyw20702a1kwfbg",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "cyw20703ua1kffb1g",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "cyw4354kkwbgt",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "cyw20730a2kml2gt",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "cyw20733a3kfb2gt",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "cyw20733a2kfb1g",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "cyw20706ua1kffb1g",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "cyw20705b0kwfbgt",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "cyw20707ua1kffb1g",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "cyw20734ua2kffb3gt",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "cyw20706ua2kffb4gt",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "cyw43438kubgt",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "cyw89072brfb5g",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "cyw20706ua2kffb4g",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "cyw4343wkubgt",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "cyw20734ua1kffb3gt",
"scope": "eq",
"trust": 1.0,
"vendor": "cypress",
"version": null
},
{
"model": "bcm43438a1",
"scope": null,
"trust": 0.8,
"vendor": "broadcom",
"version": null
},
{
"model": "bcm4355c0",
"scope": null,
"trust": 0.8,
"vendor": "broadcom",
"version": null
},
{
"model": "cyw20702a1kwfbg",
"scope": null,
"trust": 0.8,
"vendor": "cypress",
"version": null
},
{
"model": "cyw20702a1kwfbgt",
"scope": null,
"trust": 0.8,
"vendor": "cypress",
"version": null
},
{
"model": "cyw20702b0kwfbg",
"scope": null,
"trust": 0.8,
"vendor": "cypress",
"version": null
},
{
"model": "cyw20702b0kwfbgt",
"scope": null,
"trust": 0.8,
"vendor": "cypress",
"version": null
},
{
"model": "cyw20703ua1kffb1g",
"scope": null,
"trust": 0.8,
"vendor": "cypress",
"version": null
},
{
"model": "cyw20703ua1kffb1gt",
"scope": null,
"trust": 0.8,
"vendor": "cypress",
"version": null
},
{
"model": "cyw20704ua1kffb1g",
"scope": null,
"trust": 0.8,
"vendor": "cypress",
"version": null
},
{
"model": "cyw20704ua1kffb1gt",
"scope": null,
"trust": 0.8,
"vendor": "cypress",
"version": null
},
{
"model": "android",
"scope": "eq",
"trust": 0.3,
"vendor": "google",
"version": "0"
}
],
"sources": [
{
"db": "BID",
"id": "108277"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-015613"
},
{
"db": "NVD",
"id": "CVE-2018-19860"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:broadcom:bcm43438a1_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:broadcom:bcm4355c0_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:cypress:cyw20702a1kwfbg_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:cypress:cyw20702a1kwfbgt_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:cypress:cyw20702b0kwfbg_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:cypress:cyw20702b0kwfbgt_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:cypress:cyw20703ua1kffb1g_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:cypress:cyw20703ua1kffb1gt_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:cypress:cyw20704ua1kffb1g_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:cypress:cyw20704ua1kffb1gt_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-015613"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Apple",
"sources": [
{
"db": "PACKETSTORM",
"id": "153723"
},
{
"db": "PACKETSTORM",
"id": "154054"
},
{
"db": "CNNVD",
"id": "CNNVD-201905-176"
}
],
"trust": 0.8
},
"cve": "CVE-2018-19860",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 6.5,
"id": "CVE-2018-19860",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:A/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 6.5,
"id": "VHN-130562",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:A/AC:L/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "ADJACENT",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"id": "CVE-2018-19860",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2018-19860",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2018-19860",
"trust": 0.8,
"value": "High"
},
{
"author": "CNNVD",
"id": "CNNVD-201905-176",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-130562",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-130562"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-015613"
},
{
"db": "CNNVD",
"id": "CNNVD-201905-176"
},
{
"db": "NVD",
"id": "CVE-2018-19860"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Broadcom firmware before summer 2014 on Nexus 5 BCM4335C0 2012-12-11, Raspberry Pi 3 BCM43438A1 2014-06-02, and unspecifed other devices does not properly restrict LMP commnds and executes certain memory contents upon receiving an LMP command, as demonstrated by executing an HCI command. Broadcom BCM4335C0 and BCM43438A1 Firmware contains vulnerabilities related to authorization, permissions, and access control.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Google Android is prone to a remote code execution vulnerability. \nAttackers can exploit this issue to execute arbitrary code within the context of a privileged process. Failed exploits may result in denial-of-service conditions. \nThis issue is being tracked by Android Bug ID A-122249979. Android is a Linux-based open source operating system developed by Google and the Open Handheld Alliance (OHA). -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-2019-8-13-1 Additional information for\nAPPLE-SA-2019-7-22-2 macOS Mojave 10.14.6, Security Update\n2019-004 High Sierra, Security Update 2019-004 Sierra\n\nmacOS Mojave 10.14.6, Security Update 2019-004 High Sierra,\nSecurity Update 2019-004 Sierra address the\nfollowing:\n\nAppleGraphicsControl\nAvailable for: macOS Mojave 10.14.5\nImpact: An application may be able to read restricted memory\nDescription: A validation issue was addressed with improved input\nsanitization. \nCVE-2019-8693: Arash Tohidi of Solita\n\nautofs\nAvailable for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS\nMojave 10.14.5\nImpact: Extracting a zip file containing a symbolic link to an\nendpoint in an NFS mount that is attacker controlled may bypass\nGatekeeper\nDescription: This was addressed with additional checks by Gatekeeper\non files mounted through a network share. \nCVE-2019-8656: Filippo Cavallarin\n\nBluetooth\nAvailable for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS\nMojave 10.14.5\nImpact: A remote attacker may be able to cause arbitrary code\nexecution\nDescription: A memory corruption issue was addressed with improved\ninput validation. \nCVE-2018-19860\n\nBluetooth\nAvailable for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS\nMojave 10.14.5\nImpact: An attacker in a privileged network position may be able to\nintercept Bluetooth traffic (Key Negotiation of Bluetooth - KNOB)\nDescription: An input validation issue existed in Bluetooth. This\nissue was addressed with improved input validation. \nCVE-2019-9506: Daniele Antonioli of SUTD, Singapore, Dr. Nils Ole\nTippenhauer of CISPA, Germany, and Prof. Kasper Rasmussen of\nUniversity of Oxford, England\nEntry added August 13, 2019\n\nCarbon Core\nAvailable for: macOS Mojave 10.14.5\nImpact: A remote attacker may be able to cause arbitrary code\nexecution\nDescription: A use after free issue was addressed with improved\nmemory management. \nCVE-2019-8661: Natalie Silvanovich of Google Project Zero\n\nCore Data\nAvailable for: macOS Mojave 10.14.5\nImpact: A remote attacker may be able to leak memory\nDescription: An out-of-bounds read was addressed with improved input\nvalidation. \nCVE-2019-8646: Natalie Silvanovich of Google Project Zero\n\nCore Data\nAvailable for: macOS Mojave 10.14.5\nImpact: A remote attacker may be able to cause unexpected application\ntermination or arbitrary code execution\nDescription: A memory corruption issue was addressed with improved\ninput validation. \nCVE-2019-8660: Samuel Gro\u00df and Natalie Silvanovich of Google Project\nZero\n\nDisk Management\nAvailable for: macOS Mojave 10.14.5\nImpact: An application may be able to execute arbitrary code with\nsystem privileges\nDescription: A memory corruption issue was addressed with improved\nmemory handling. \nCVE-2019-8697: ccpwd working with Trend Micro\u0027s Zero Day Initiative\n\nFaceTime\nAvailable for: macOS Mojave 10.14.5\nImpact: A remote attacker may be able to cause arbitrary code\nexecution\nDescription: A memory corruption issue was addressed with improved\ninput validation. \nCVE-2019-8648: Tao Huang and Tielei Wang of Team Pangu\n\nFound in Apps\nAvailable for: macOS Mojave 10.14.5\nImpact: A remote attacker may be able to leak memory\nDescription: This issue was addressed with improved checks. \nCVE-2019-8663: Natalie Silvanovich of Google Project Zero\n\nFoundation\nAvailable for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS\nMojave 10.14.5\nImpact: A remote attacker may be able to cause unexpected application\ntermination or arbitrary code execution\nDescription: An out-of-bounds read was addressed with improved input\nvalidation. \nCVE-2019-8641: Samuel Gro\u00df and Natalie Silvanovich of Google Project\nZero\n\nGrapher\nAvailable for: macOS Mojave 10.14.5\nImpact: An application may be able to execute arbitrary code with\nsystem privileges\nDescription: A memory corruption issue was addressed with improved\nmemory handling. \nCVE-2019-8695: riusksk of VulWar Corp working with Trend Micro\u0027s Zero\nDay Initiative\n\nGraphics Drivers\nAvailable for: macOS High Sierra 10.13.6, macOS Mojave 10.14.5\nImpact: An application may be able to read restricted memory\nDescription: A validation issue was addressed with improved input\nsanitization. \nCVE-2019-8691: Aleksandr Tarasikov (@astarasikov), Arash Tohidi of\nSolita, Lilang Wu and Moony Li of Trend Micro\u0027s Mobile Security\nResearch Team working with Trend Micro\u0027s Zero Day Initiative\nCVE-2019-8692: Lilang Wu and Moony Li of Trend Micro Mobile Security\nResearch Team working with Trend Micro\u0027s Zero Day Initiative\n\nHeimdal\nAvailable for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS\nMojave 10.14.5\nImpact: An issue existed in Samba that may allow attackers to perform\nunauthorized actions by intercepting communications between services\nDescription: This issue was addressed with improved checks to prevent\nunauthorized actions. \nCVE-2018-16860: Isaac Boukris and Andrew Bartlett of the Samba Team\nand Catalyst\n\nIOAcceleratorFamily\nAvailable for: macOS Mojave 10.14.5\nImpact: An application may be able to execute arbitrary code with\nkernel privileges\nDescription: A memory corruption issue was addressed with improved\nmemory handling. \nCVE-2019-8694: Arash Tohidi of Solita\n\nlibxslt\nAvailable for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS\nMojave 10.14.5\nImpact: A remote attacker may be able to view sensitive information\nDescription: A stack overflow was addressed with improved input\nvalidation. \nCVE-2019-13118: found by OSS-Fuzz\n\nQuick Look\nAvailable for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS\nMojave 10.14.5\nImpact: An attacker may be able to trigger a use-after-free in an\napplication deserializing an untrusted NSDictionary\nDescription: This issue was addressed with improved checks. \nCVE-2019-8662: Natalie Silvanovich and Samuel Gro\u00df of Google Project\nZero\n\nSecurity\nAvailable for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6\nImpact: An application may be able to execute arbitrary code with\nsystem privileges\nDescription: A memory corruption issue was addressed with improved\nmemory handling. \nCVE-2019-8697: ccpwd working with Trend Micro\u0027s Zero Day Initiative\n\nSiri\nAvailable for: macOS Mojave 10.14.5\nImpact: A remote attacker may be able to leak memory\nDescription: An out-of-bounds read was addressed with improved input\nvalidation. \nCVE-2019-8646: Natalie Silvanovich of Google Project Zero\n\nTime Machine\nAvailable for: macOS Mojave 10.14.5\nImpact: The encryption status of a Time Machine backup may be\nincorrect\nDescription: An inconsistent user interface issue was addressed with\nimproved state management. \nCVE-2019-8667: Roland Kletzing of cyber:con GmbH\n\nUIFoundation\nAvailable for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS\nMojave 10.14.5\nImpact: Parsing a maliciously crafted office document may lead to an\nunexpected application termination or arbitrary code execution\nDescription: An out-of-bounds read was addressed with improved input\nvalidation. \nCVE-2019-8657: riusksk of VulWar Corp working with Trend Micro\u0027s Zero\nDay Initiative\n\nAdditional recognition\n\nClassroom\nWe would like to acknowledge Jeff Johnson of underpassapp.com for\ntheir assistance. \n\nGame Center\nWe would like to acknowledge Min (Spark) Zheng and Xiaolong Bai of\nAlibaba Inc. for their assistance. \n\nInstallation note:\n\nmacOS Mojave 10.14.6, Security Update 2019-004 High Sierra,\nSecurity Update 2019-004 Sierra may be obtained from the\nMac App Store or Apple\u0027s Software Downloads web site:\nhttps://support.apple.com/downloads/\n\nInformation will also be posted to the Apple Security Updates\nweb site: https://support.apple.com/kb/HT201222\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n-----BEGIN PGP SIGNATURE-----\n\niQJdBAEBCABHFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAl1S688pHHByb2R1Y3Qt\nc2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQeC9tht7TK3Hiog/+\nPcWPEhxDpnU1ctoVPhyoqkV1tUs8z3hdNyX/tPtQZIQVFB7No1Md0GX8Zrv2libb\nLwrbU25ewe82XE9Es6ngxTdkRaREn8+hm9gxYPCMDXyKRlv904Q1b4zthYUt7/NO\n7RG6ZRHEINOQORzrDsmgT/X6TukIy73HNob+4xZJTdJe9ZU3/zDCaqUgyUJSodou\nvsVFR3oqkwbVby4eT9+YbxJWMvVoFfB1+Qqo1w9kN7WXcYK3gb7sGtnNQlrE70kR\npLRogcmwTQsi+sTm8bxQsuXXjdtTHeeCf0FRJg8NY5wZmdV9lNOghtmNxfTwIuir\nVeWusIgZWaK7IbgHW3PRYv3Sbrk40zcOraDsPv2rdgjOj4ReVyKHw5/f5Fyhcn+v\nWnIC4iNIBurz0HZU91QqD58Sqp+HtWl8xkM3ZW+Kd9LjnLty3fNw6Au5Aw8DTHzN\n5F+lz7JRVV3+j7AYELog3WV6mdzMKW85gJRJtwXJ8hHSYZnvat06faFlPcDiKjBW\nrW7BehRykZpmZtaSZjL25IeOuXJHHdRfvabuTZ3nk47SSn7EJJ3xFBnvw6TgVFX+\nTvmcUg5FinTSR81NkIY0ux6x1kuV/4vIUGZ4O0Houf/FoUhMQvig9ZkSw2B+Ynbd\nXl3qBT4SVPWQyFAvjHwjCZA+GpNsnEKgZm8SlYVgqog=\n=tCwo\n-----END PGP SIGNATURE-----\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2018-19860"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-015613"
},
{
"db": "BID",
"id": "108277"
},
{
"db": "VULHUB",
"id": "VHN-130562"
},
{
"db": "PACKETSTORM",
"id": "153723"
},
{
"db": "PACKETSTORM",
"id": "154054"
}
],
"trust": 2.16
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2018-19860",
"trust": 3.0
},
{
"db": "BID",
"id": "108277",
"trust": 1.0
},
{
"db": "JVNDB",
"id": "JVNDB-2018-015613",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201905-176",
"trust": 0.7
},
{
"db": "PACKETSTORM",
"id": "153723",
"trust": 0.7
},
{
"db": "AUSCERT",
"id": "ESB-2019.2743",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-130562",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "154054",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-130562"
},
{
"db": "BID",
"id": "108277"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-015613"
},
{
"db": "PACKETSTORM",
"id": "153723"
},
{
"db": "PACKETSTORM",
"id": "154054"
},
{
"db": "CNNVD",
"id": "CNNVD-201905-176"
},
{
"db": "NVD",
"id": "CVE-2018-19860"
}
]
},
"id": "VAR-201906-1114",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-130562"
}
],
"trust": 0.01
},
"last_update_date": "2024-11-23T19:48:35.638000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Product Security Center",
"trust": 0.8,
"url": "https://www.broadcom.com/support/resources/product-security-center"
},
{
"title": "Android Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=92320"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-015613"
},
{
"db": "CNNVD",
"id": "CNNVD-201905-176"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-732",
"trust": 1.1
},
{
"problemtype": "CWE-264",
"trust": 0.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-130562"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-015613"
},
{
"db": "NVD",
"id": "CVE-2018-19860"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.8,
"url": "https://source.android.com/security/bulletin/2019-05-01"
},
{
"trust": 1.7,
"url": "https://seclists.org/bugtraq/2019/aug/21"
},
{
"trust": 1.7,
"url": "https://support.apple.com/kb/ht210348"
},
{
"trust": 1.7,
"url": "http://seclists.org/fulldisclosure/2019/jul/22"
},
{
"trust": 1.7,
"url": "http://seclists.org/fulldisclosure/2019/aug/11"
},
{
"trust": 1.7,
"url": "https://www.broadcom.com/support/resources/product-security-center"
},
{
"trust": 1.6,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-19860"
},
{
"trust": 0.9,
"url": "http://www.android.com/"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-19860"
},
{
"trust": 0.6,
"url": "https://support.apple.com/en-au/ht210348"
},
{
"trust": 0.6,
"url": "https://packetstormsecurity.com/files/153723/apple-security-advisory-2019-7-22-2.html"
},
{
"trust": 0.6,
"url": "https://vigilance.fr/vulnerability/google-android-multiple-vulnerabilities-of-may-2019-29239"
},
{
"trust": 0.6,
"url": "https://www.securityfocus.com/bid/108277"
},
{
"trust": 0.6,
"url": "https://vigilance.fr/vulnerability/apple-macos-multiple-vulnerabilities-29859"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2019.2743/"
},
{
"trust": 0.6,
"url": "https://support.apple.com/en-us/ht210348"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8691"
},
{
"trust": 0.2,
"url": "https://support.apple.com/kb/ht201222"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-16860"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8695"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8692"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8646"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8694"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-13118"
},
{
"trust": 0.2,
"url": "https://support.apple.com/downloads/"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8693"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8663"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8656"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8648"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8641"
},
{
"trust": 0.2,
"url": "https://www.apple.com/support/security/pgp/"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8660"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8657"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8667"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8697"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8662"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8661"
},
{
"trust": 0.1,
"url": "https://www.apple.com/support/security/pgp/\u003e"
},
{
"trust": 0.1,
"url": "https://support.apple.com/downloads/\u003e"
},
{
"trust": 0.1,
"url": "https://support.apple.com/kb/ht201222\u003e"
},
{
"trust": 0.1,
"url": "http://underpassapp.com/\u003e"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8670"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-9506"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-130562"
},
{
"db": "BID",
"id": "108277"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-015613"
},
{
"db": "PACKETSTORM",
"id": "153723"
},
{
"db": "PACKETSTORM",
"id": "154054"
},
{
"db": "CNNVD",
"id": "CNNVD-201905-176"
},
{
"db": "NVD",
"id": "CVE-2018-19860"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-130562"
},
{
"db": "BID",
"id": "108277"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-015613"
},
{
"db": "PACKETSTORM",
"id": "153723"
},
{
"db": "PACKETSTORM",
"id": "154054"
},
{
"db": "CNNVD",
"id": "CNNVD-201905-176"
},
{
"db": "NVD",
"id": "CVE-2018-19860"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-06-07T00:00:00",
"db": "VULHUB",
"id": "VHN-130562"
},
{
"date": "2019-05-06T00:00:00",
"db": "BID",
"id": "108277"
},
{
"date": "2019-06-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-015613"
},
{
"date": "2019-07-23T18:02:22",
"db": "PACKETSTORM",
"id": "153723"
},
{
"date": "2019-08-14T18:32:22",
"db": "PACKETSTORM",
"id": "154054"
},
{
"date": "2019-05-07T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201905-176"
},
{
"date": "2019-06-07T17:29:00.740000",
"db": "NVD",
"id": "CVE-2018-19860"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2020-08-24T00:00:00",
"db": "VULHUB",
"id": "VHN-130562"
},
{
"date": "2019-05-06T00:00:00",
"db": "BID",
"id": "108277"
},
{
"date": "2019-06-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-015613"
},
{
"date": "2021-10-29T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201905-176"
},
{
"date": "2024-11-21T03:58:42.217000",
"db": "NVD",
"id": "CVE-2018-19860"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote or local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201905-176"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Broadcom BCM4335C0 and BCM43438A1 Firmware vulnerabilities related to authorization, authority, and access control",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-015613"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "permissions and access control issues",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201905-176"
}
],
"trust": 0.6
}
}
var-201710-1086
Vulnerability from variot
On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56, an attacker can trigger an information leak due to insufficient length validation, related to ICMPv6 router advertisement offloading. Broadcom BCM4355C0 Wi-Fi chips is a Wi-Fi chip of Broadcom (Broadcom). Wi-Fi firmware is the firmware used in it. There is a security vulnerability in version 9.44.78.27.0.1.56 of the Broadcom BCM4355C0 Wi-Fi chip. The vulnerability is caused by the insufficient calculation length of the program. An attacker could exploit this vulnerability to obtain information. These chips are present in both mobile devices and Wi-Fi routers, and are capable of handling many Wi-Fi related events without delegating to the host OS.
In order to reduce overhead on the host, some Broadcom Wi-Fi chips support offloading of certain ICMPv6 packets, including Router Advertisements, Neighbor Advertisements and Neighbor Solicitations.
On the BCM4355C0 SoC with firmware version 9.44.78.27.0.1.56, the ICMPv6 offloading is performed by ROM function 0x39AF8. This function first inspects the ethertype and ensures that it is an IPv6 packet. Then, it reads the protocol number in the "Next Header" field to verify that this is indeed an ICMPv6 packet (IPv6_ICMP). Lastly, the function reads the ICMPv6 "Type" field, and dispatches the packet to the appropriate handler.
In the case of "Router Advertisment" packets (type 134), ROM function 0x399A0 is called to handle the packet. The function has the following approximate high-level logic:
int function_0x399A0(void ctx, char ipv6_header, ...) { ...
//Reading some IPv6 fields uint16_t payload_length = ntohs(((uint16_t)(ipv6_header + 4))); uint16_t router_lifetime = ntohs(((uint16_t)(ipv6_header + 46)));
//Searching for a matching RA struct ra_context_t ra_array = (struct ra_context_t)(((uint32_t)ctx + 151)); for (int i=0; i<10; i++) { struct ra_context_t* ra = &(ra_array[i]);
if (memcmp(ra->src_addr, ipv6_header + 8, 0x10))
continue;
if (ra->payload_length != payload_length)
continue;
if (memcmp(ra->data, ipv6_header + 40, payload_length))
continue;
if (1000 * router_lifetime <= 180000)
continue;
if (firmware_timestamp() >= ra->timestamp + 60000)
continue;
//Found a match!
return 2; //Indicates that the packet is filtered and not passed
//on to the OS
}
//Find the entry to overwrite uint8_t insertion_idx_ptr = (uint8_t)((void)ra_array + 322); if (insertion_idx_ptr > 9) insertion_idx_ptr = 0; struct ra_context_t ra = &(ra_array[*insertion_idx_ptr]);
//Populate the entry ra->payload_length = payload_length; ra->timestamp = firmware_timestamp(); memcpy(ra->src_addr, ipv6_header + 8, 0x10); char* new_ra_data = malloc(payload_length); memcpy(new_ra_data, ipv6_header + 40, payload_length); if (ra->ra_data) free(ra->ra_data); ra->ra_data = new_ra_data;
(*insertion_idx_ptr)++;
return 0; //Pass the packet on to the OS }
Where "ra_context_t" has the following structure:
struct ra_context_t { char* ra_data; uint32_t payload_length; uint32_t unused; char src_addr[0x10]; uint32_t timestamp; };
As we can see above, the function fails to validate that the IPv6 "Payload Length" field does not exceed the length of the packet. As a result, if the incoming RA fails to match any of the 10 cached RAs, a new entry will be saved, triggering a copy of packet's content into a newly allocated buffer, using the attacker-controlled "payload length" field (thereby triggering an OOB read).
An attacker can use this as an oracle to leak data from the firmware. First, the attacker can send an RA with a payload length field that exceeds the real packet length by a single byte. Then, the attacker may send additional RAs in which the payload length field does indeed match the length of the packet's payload, and is also the same value as the one sent previously. By doing so, the attacker can modify the last byte of the sent RA, iterating over at-most 10 different values. If the attacker guesses the last byte (which was read OOB) correctly, the packet will be filtered. Otherwise, the packet will be forwarded to the host.
In order to distinguish between these two cases, an attacker can craft the ICMPv6 packet so that a "regular" host will send back an ICMPv6 error message. For example, by setting the TTL field to zero, the host would generate a ICMPv6 "Time Exceeded" error message.
This bug is subject to a 90 day disclosure deadline. After 90 days elapse or a patch has been made broadly available, the bug report will become visible to the public.
Found by: laginimaineb
Show details on source website{
"affected_products": {
"_id": null,
"data": [
{
"_id": null,
"model": "tvos",
"scope": "lte",
"trust": 1.0,
"vendor": "apple",
"version": "10.2.2"
},
{
"_id": null,
"model": "bcm4355c0",
"scope": "lte",
"trust": 1.0,
"vendor": "broadcom",
"version": "9.44.78.27.0.1.56"
},
{
"_id": null,
"model": "iphone os",
"scope": "lte",
"trust": 1.0,
"vendor": "apple",
"version": "10.3.3"
},
{
"_id": null,
"model": "bcm4355c0",
"scope": null,
"trust": 0.8,
"vendor": "broadcom",
"version": null
},
{
"_id": null,
"model": "ios",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "11 (ipad air or later )"
},
{
"_id": null,
"model": "ios",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "11 (iphone 5s or later )"
},
{
"_id": null,
"model": "ios",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "11 (ipod touch first 6 generation )"
},
{
"_id": null,
"model": "tvos",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "11 (apple tv first 4 generation )"
},
{
"_id": null,
"model": "tv",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "10.2.2"
},
{
"_id": null,
"model": "iphone os",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "10.3.3"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-009425"
},
{
"db": "CNNVD",
"id": "CNNVD-201707-295"
},
{
"db": "NVD",
"id": "CVE-2017-11122"
}
]
},
"configurations": {
"_id": null,
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:broadcom:bcm4355c0_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:apple:iphone_os",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:apple:apple_tv",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-009425"
}
]
},
"credits": {
"_id": null,
"data": "Google Security Research, laginimaineb",
"sources": [
{
"db": "PACKETSTORM",
"id": "144461"
}
],
"trust": 0.1
},
"cve": "CVE-2017-11122",
"cvss": {
"_id": null,
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2017-11122",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "VHN-101513",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "CVE-2017-11122",
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2017-11122",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2017-11122",
"trust": 0.8,
"value": "High"
},
{
"author": "CNNVD",
"id": "CNNVD-201707-295",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-101513",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-101513"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-009425"
},
{
"db": "CNNVD",
"id": "CNNVD-201707-295"
},
{
"db": "NVD",
"id": "CVE-2017-11122"
}
]
},
"description": {
"_id": null,
"data": "On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56, an attacker can trigger an information leak due to insufficient length validation, related to ICMPv6 router advertisement offloading. Broadcom BCM4355C0 Wi-Fi chips is a Wi-Fi chip of Broadcom (Broadcom). Wi-Fi firmware is the firmware used in it. There is a security vulnerability in version 9.44.78.27.0.1.56 of the Broadcom BCM4355C0 Wi-Fi chip. The vulnerability is caused by the insufficient calculation length of the program. An attacker could exploit this vulnerability to obtain information. These chips are present in both mobile devices and Wi-Fi routers, and are capable of handling many Wi-Fi related events without delegating to the host OS. \n\nIn order to reduce overhead on the host, some Broadcom Wi-Fi chips support offloading of certain ICMPv6 packets, including Router Advertisements, Neighbor Advertisements and Neighbor Solicitations. \n\nOn the BCM4355C0 SoC with firmware version 9.44.78.27.0.1.56, the ICMPv6 offloading is performed by ROM function 0x39AF8. This function first inspects the ethertype and ensures that it is an IPv6 packet. Then, it reads the protocol number in the \"Next Header\" field to verify that this is indeed an ICMPv6 packet (IPv6_ICMP). Lastly, the function reads the ICMPv6 \"Type\" field, and dispatches the packet to the appropriate handler. \n\nIn the case of \"Router Advertisment\" packets (type 134), ROM function 0x399A0 is called to handle the packet. The function has the following approximate high-level logic:\n\nint function_0x399A0(void* ctx, char* ipv6_header, ...) {\n ... \n\n //Reading some IPv6 fields\n uint16_t payload_length = ntohs(*((uint16_t*)(ipv6_header + 4)));\n uint16_t router_lifetime = ntohs(*((uint16_t*)(ipv6_header + 46)));\n\n //Searching for a matching RA\n struct ra_context_t* ra_array = (struct ra_context_t*)(*((uint32_t*)ctx + 151));\n for (int i=0; i\u003c10; i++) {\n struct ra_context_t* ra = \u0026(ra_array[i]);\n \n if (memcmp(ra-\u003esrc_addr, ipv6_header + 8, 0x10))\n continue;\n \n if (ra-\u003epayload_length != payload_length)\n continue;\n\n if (memcmp(ra-\u003edata, ipv6_header + 40, payload_length))\n continue;\n\n if (1000 * router_lifetime \u003c= 180000)\n continue;\n\n if (firmware_timestamp() \u003e= ra-\u003etimestamp + 60000)\n continue;\n\n //Found a match!\n return 2; //Indicates that the packet is filtered and not passed\n //on to the OS \n\n\n }\n\n //Find the entry to overwrite\n uint8_t* insertion_idx_ptr = (uint8_t*)((void*)ra_array + 322);\n if (*insertion_idx_ptr \u003e 9)\n *insertion_idx_ptr = 0;\n struct ra_context_t* ra = \u0026(ra_array[*insertion_idx_ptr]);\n\n //Populate the entry\n ra-\u003epayload_length = payload_length;\n ra-\u003etimestamp = firmware_timestamp();\n memcpy(ra-\u003esrc_addr, ipv6_header + 8, 0x10);\n char* new_ra_data = malloc(payload_length);\n memcpy(new_ra_data, ipv6_header + 40, payload_length);\n if (ra-\u003era_data)\n free(ra-\u003era_data);\n ra-\u003era_data = new_ra_data;\n\n (*insertion_idx_ptr)++;\n\n return 0; //Pass the packet on to the OS\n}\n\nWhere \"ra_context_t\" has the following structure:\n\nstruct ra_context_t {\n char* ra_data;\n uint32_t payload_length;\n uint32_t unused;\n char src_addr[0x10];\n uint32_t timestamp;\n};\n\nAs we can see above, the function fails to validate that the IPv6 \"Payload Length\" field does not exceed the length of the packet. As a result, if the incoming RA fails to match any of the 10 cached RAs, a new entry will be saved, triggering a copy of packet\u0027s content into a newly allocated buffer, using the attacker-controlled \"payload length\" field (thereby triggering an OOB read). \n\nAn attacker can use this as an oracle to leak data from the firmware. First, the attacker can send an RA with a payload length field that exceeds the real packet length by a single byte. Then, the attacker may send additional RAs in which the payload length field does indeed match the length of the packet\u0027s payload, and is also the same value as the one sent previously. By doing so, the attacker can modify the last byte of the sent RA, iterating over at-most 10 different values. If the attacker guesses the last byte (which was read OOB) correctly, the packet will be filtered. Otherwise, the packet will be forwarded to the host. \n\nIn order to distinguish between these two cases, an attacker can craft the ICMPv6 packet so that a \"regular\" host will send back an ICMPv6 error message. For example, by setting the TTL field to zero, the host would generate a ICMPv6 \"Time Exceeded\" error message. \n\nThis bug is subject to a 90 day disclosure deadline. After 90 days elapse\nor a patch has been made broadly available, the bug report will become\nvisible to the public. \n\n\n\n\nFound by: laginimaineb\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-11122"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-009425"
},
{
"db": "VULHUB",
"id": "VHN-101513"
},
{
"db": "PACKETSTORM",
"id": "144461"
}
],
"trust": 1.8
},
"external_ids": {
"_id": null,
"data": [
{
"db": "NVD",
"id": "CVE-2017-11122",
"trust": 2.6
},
{
"db": "PACKETSTORM",
"id": "144461",
"trust": 1.8
},
{
"db": "JVN",
"id": "JVNVU99806334",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2017-009425",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201707-295",
"trust": 0.7
},
{
"db": "VULHUB",
"id": "VHN-101513",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-101513"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-009425"
},
{
"db": "PACKETSTORM",
"id": "144461"
},
{
"db": "CNNVD",
"id": "CNNVD-201707-295"
},
{
"db": "NVD",
"id": "CVE-2017-11122"
}
]
},
"id": "VAR-201710-1086",
"iot": {
"_id": null,
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-101513"
}
],
"trust": 0.01
},
"last_update_date": "2024-11-23T19:27:47.221000Z",
"patch": {
"_id": null,
"data": [
{
"title": "HT208112",
"trust": 0.8,
"url": "https://support.apple.com/en-us/HT208112"
},
{
"title": "HT208113",
"trust": 0.8,
"url": "https://support.apple.com/en-us/HT208113"
},
{
"title": "HT208112",
"trust": 0.8,
"url": "https://support.apple.com/ja-jp/HT208112"
},
{
"title": "HT208113",
"trust": 0.8,
"url": "https://support.apple.com/ja-jp/HT208113"
},
{
"title": "Top Page",
"trust": 0.8,
"url": "https://www.broadcom.com/"
},
{
"title": "Broadcom BCM4355C0 Wi-Fi Fixes for chip security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=90654"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-009425"
},
{
"db": "CNNVD",
"id": "CNNVD-201707-295"
}
]
},
"problemtype_data": {
"_id": null,
"data": [
{
"problemtype": "CWE-200",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-101513"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-009425"
},
{
"db": "NVD",
"id": "CVE-2017-11122"
}
]
},
"references": {
"_id": null,
"data": [
{
"trust": 1.7,
"url": "https://support.apple.com/ht208112"
},
{
"trust": 1.7,
"url": "https://support.apple.com/ht208113"
},
{
"trust": 1.7,
"url": "https://support.apple.com/en-us/ht208112"
},
{
"trust": 1.7,
"url": "https://support.apple.com/en-us/ht208113"
},
{
"trust": 1.7,
"url": "http://packetstormsecurity.com/files/144461/broadcom-icmpv6-information-leak.html"
},
{
"trust": 1.7,
"url": "https://bugs.chromium.org/p/project-zero/issues/detail?id=1300"
},
{
"trust": 0.9,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-11122"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-11122"
},
{
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu99806334/index.html"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-101513"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-009425"
},
{
"db": "PACKETSTORM",
"id": "144461"
},
{
"db": "CNNVD",
"id": "CNNVD-201707-295"
},
{
"db": "NVD",
"id": "CVE-2017-11122"
}
]
},
"sources": {
"_id": null,
"data": [
{
"db": "VULHUB",
"id": "VHN-101513",
"ident": null
},
{
"db": "JVNDB",
"id": "JVNDB-2017-009425",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "144461",
"ident": null
},
{
"db": "CNNVD",
"id": "CNNVD-201707-295",
"ident": null
},
{
"db": "NVD",
"id": "CVE-2017-11122",
"ident": null
}
]
},
"sources_release_date": {
"_id": null,
"data": [
{
"date": "2017-10-04T00:00:00",
"db": "VULHUB",
"id": "VHN-101513",
"ident": null
},
{
"date": "2017-11-10T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-009425",
"ident": null
},
{
"date": "2017-10-02T01:11:11",
"db": "PACKETSTORM",
"id": "144461",
"ident": null
},
{
"date": "2017-07-10T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201707-295",
"ident": null
},
{
"date": "2017-10-04T01:29:02.010000",
"db": "NVD",
"id": "CVE-2017-11122",
"ident": null
}
]
},
"sources_update_date": {
"_id": null,
"data": [
{
"date": "2019-03-08T00:00:00",
"db": "VULHUB",
"id": "VHN-101513",
"ident": null
},
{
"date": "2017-11-10T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-009425",
"ident": null
},
{
"date": "2019-03-13T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201707-295",
"ident": null
},
{
"date": "2024-11-21T03:07:08.997000",
"db": "NVD",
"id": "CVE-2017-11122",
"ident": null
}
]
},
"threat_type": {
"_id": null,
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201707-295"
}
],
"trust": 0.6
},
"title": {
"_id": null,
"data": "Broadcom BCM4355C0 of Wi-Fi Vulnerability that triggers information disclosure on chip",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-009425"
}
],
"trust": 0.8
},
"type": {
"_id": null,
"data": "information disclosure",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201707-295"
}
],
"trust": 0.6
}
}
var-201709-0971
Vulnerability from variot
On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, properly crafted malicious over-the-air Fast Transition frames can potentially trigger internal Wi-Fi firmware heap and/or stack overflows, leading to denial of service or other effects, aka B-V2017061205. Broadcom BCM4355C0 Wi-Fichips is a Wi-Fi chip from Broadcom. Wi-Fifirmware is the firmware used in it. A security vulnerability exists in the 9.44.78.27.0.1.56 version of the Broadcom BCM4355C0 Wi-Fi chip. An attacker could exploit the vulnerability to cause a denial of service (heap or stack overflow). Apple iOS and tvOS are prone to multiple arbitrary code-execution vulnerabilities. An attacker can leverage these issues to execute arbitrary code within the context of the affected application. Failed exploit attempts will likely result in denial-of-service conditions. Versions prior to Apple tvOS 11 and iOS 11 are vulnerable. These issues are being tracked by Android Bud IDs A-62575409 and A-62576413. Broadcom: Multiple overflows when handling 802.11r (FT) Reassociation Response
CVE-2017-11121
Broadcom produces Wi-Fi HardMAC SoCs which are used to handle the PHY and MAC layer processing. These chips are present in both mobile devices and Wi-Fi routers, and are capable of handling many Wi-Fi related events without delegating to the host OS.
In order to allow fast roaming between access points in a wireless network, the Broadcom firmware supports the Fast BSS Transition feature (IEEE 802.11r-2008 FT), allowing a client to roam between APs in the same mobility domain. When a client decides to roam to a different AP in an FT network (in the same mobility domain), it first performs Authentication and then Reassociation.
During the Reassociation process, the client parses the Fast Transition Information Element in order to decrypt and install the embedded GTK. The FT-IE has the following structure:
| Tag (55) | Length | MIC CTRL | MIC | Anonce | Snonce | Sub-Elements |
0 1 2 4 20 52 84 X
Where each sub-element has the following structure:
| Tag | Length | Key Info | Key Length | RSC | Key Data |
0 1 2 4 5 13 X
(See 802.11-2016, 9.4.2.48 for more information).
On the BCM4355C0 SoC with firmware version 9.44.78.27.0.1.56 the Fast Transition Reassociation process is handled by ROM function 0x8462C. This function retrieves the FT-IE from the last association response and parses it in order to extract the GTK. Here is the approximate high-level logic of this function:
int function_8462C(...) { ...
//Getting the FT-IE uint8_t* ft_ie = bcm_parse_tlvs(..., ..., 55); if (!ft_ie) return 0;
//Getting the GTK Sub-Element uint8_t* gtk_subelem = bcm_parse_tlvs(ft_ie + 84, ft_ie[1] - 82, 2); if (!gtk_subelem) return 0; ...
//Decrypting the GTK context_struct->gtk_length = gtk_subelem[4]; if (!function_6D8(16, ..., gtk_subelem[1] - 11, gtk_subelem + 13, &context_struct->decrypted_gtk)) {
//Installing the GTK
function_C9C14(..., context_struct->decrypted_gtk, context_struct->gtk_length, ...);
...
} ... }
function_6D8(unsigned key_length, char key, unsigned input_length, char input, char* output) { ... char buf[0x200]; char buf2[0x8];
//Validating the lengths if ( (key_length - 16) > 16 || ((0x80808000 << (key_length - 16)) & 0x80000000) == 0 || input_length > 0x188 || input_length << 29 ) return 1;
//Copying the input into a local stack buffer memcpy(buf2, input, 8); memcpy(buf + 8, input + 8, input_length - 8);
//Do AES decryption ... }
int function_C9C14(..., char gtk, int gtk_len, ...) { ... char key_buffer = malloc(164); ... memcpy(key_buffer + 8, gtk, gtk_len); ... }
The function above fails to validate all the length fields in the FT-IE and in the embedded subelement. As a result, an attacker can cause multiple overflows by sending crafted information elements. Here are some possible attacks:
-
The attacker sends a valid FT-IE with an embedded subelement containing a valid length field (gtk_subelem[1]), but with a large crafted value in the key length field (gtk_subelem[4]). Supplying such values will cause the decryption function (0x6D8) to succeed. However, after decrypting the key, function 0xC9C14 will be called in order to install the GTK, using the crafted key length field. Supplying a large value such as 255 in this field will cause the function to copy 255 bytes from the context structure into the heap allocated buffer, whose size is only 164 -- causing a heap overflow.
-
The attacker sends a valid FT-IE with an embedded subelement whose length field (gtk_subelem[1]) is exactly 11. As we can see above, "gtk_subelem[1] - 11" is provided to the decryption function as the "input_length" field. Although the decryption function does perform some validations on the input length field, it fails to ensure that the field is larger than 8. After performing the validations, it calls "memcpy(buf + 8, input + 8, input_length - 8)" in order to copy the input into a stack-allocated buffer. If the input length is zero, "input_length - 8" will underflow, resulting in a large length argument in the memcpy. I'm not sure whether this is exploitable -- if timed correctly, it might be possible to corrupt important values after the stack, such as the global PCIE structure located at the end of RAM, which would allow the attacker to trigger writes into arbitrary locations in the host's memory.
This bug can be addressed by validating the GTK subelement length fields.
This bug is subject to a 90 day disclosure deadline. After 90 days elapse or a patch has been made broadly available, the bug report will become visible to the public.
Found by: laginimaineb
. CVE-2016-9840 CVE-2016-9841 CVE-2016-9842 CVE-2016-9843 Entry added September 25, 2017
Additional recognition
Security We would like to acknowledge Abhinav Bansal of Zscaler, Inc. for their assistance.
Webkit We would like to acknowledge xisigr of Tencent's Xuanwu Lab (tencent.com) for their assistance. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512
APPLE-SA-2017-10-31-9 Additional information for APPLE-SA-2017-09-19-1 iOS 11
iOS 11 addresses the following:
802.1X Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An attacker may be able to exploit weaknesses in TLS 1.0 Description: A protocol security issue was addressed by enabling TLS 1.1 and TLS 1.2. CVE-2017-13832: an anonymous researcher Entry added October 31, 2017
Bluetooth Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to access restricted files Description: A privacy issue existed in the handling of Contact cards. This was addressed with improved state management. CVE-2017-7131: Dominik Conrads of Federal Office for Information Security, an anonymous researcher, Elvis (@elvisimprsntr), an anonymous researcher
CFNetwork Proxies Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An attacker in a privileged network position may be able to cause a denial of service Description: Multiple denial of service issues were addressed through improved memory handling. CVE-2017-7083: Abhinav Bansal of Zscaler Inc.
CFString Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2017-13821: Australian Cyber Security Centre a Australian Signals Directorate Entry added October 31, 2017
CoreAudio Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to read restricted memory Description: An out-of-bounds read was addressed by updating to Opus version 1.1.4. CVE-2017-0381: V.E.O (@VYSEa) of Mobile Threat Research Team, Trend Micro
CoreText Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing a maliciously crafted font file may lead to arbitrary code execution Description: A memory consumption issue was addressed through improved memory handling. CVE-2017-13825: Australian Cyber Security Centre a Australian Signals Directorate Entry added October 31, 2017
Exchange ActiveSync Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An attacker in a privileged network position may be able to erase a device during Exchange account setup Description: A validation issue existed in AutoDiscover V1. This was addressed by requiring TLS for AutoDiscover V1. AutoDiscover V2 is now supported. CVE-2017-7088: Ilya Nesterov, Maxim Goncharov
file Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Multiple issues in file Description: Multiple issues were addressed by updating to version 5.31. CVE-2017-13815 Entry added October 31, 2017
Fonts Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Rendering untrusted text may lead to spoofing Description: An inconsistent user interface issue was addressed with improved state management. CVE-2017-13828: an anonymous researcher Entry added October 31, 2017
Heimdal Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An attacker in a privileged network position may be able to impersonate a service Description: A validation issue existed in the handling of the KDC-REP service name. This issue was addressed through improved validation. CVE-2017-11103: Jeffrey Altman, Viktor Duchovni, and Nico Williams
HFS Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2017-13830: Sergej Schumilo of Ruhr-University Bochum Entry added October 31, 2017
iBooks Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Parsing a maliciously crafted iBooks file may lead to a persistent denial-of-service Description: Multiple denial of service issues were addressed through improved memory handling. CVE-2017-7072: JAdrzej Krysztofiak
ImageIO Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: A memory corruption issue was addressed through improved input validation. CVE-2017-13814: Australian Cyber Security Centre a Australian Signals Directorate Entry added October 31, 2017
ImageIO Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing a maliciously crafted image may lead to a denial of service Description: An information disclosure issue existed in the processing of disk images. This issue was addressed through improved memory management. CVE-2017-13831: an anonymous researcher Entry added October 31, 2017
Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2017-7114: Alex Plaskett of MWR InfoSecurity
Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A local user may be able to read kernel memory Description: An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed through improved input validation. CVE-2017-13817: Maxime Villard (m00nbsd) Entry added October 31, 2017
Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2017-13818: The UK's National Cyber Security Centre (NCSC) CVE-2017-13836: an anonymous researcher, an anonymous researcher CVE-2017-13841: an anonymous researcher CVE-2017-13840: an anonymous researcher CVE-2017-13842: an anonymous researcher CVE-2017-13782: Kevin Backhouse of Semmle Ltd. Entry added October 31, 2017
Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2017-13843: an anonymous researcher Entry added October 31, 2017
Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing a malformed mach binary may lead to arbitrary code execution Description: A memory corruption issue was addressed through improved validation. CVE-2017-13834: Maxime Villard (m00nbsd) Entry added October 31, 2017
Keyboard Suggestions Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Keyboard autocorrect suggestions may reveal sensitive information Description: The iOS keyboard was inadvertently caching sensitive information. This issue was addressed with improved heuristics. CVE-2017-7140: an anonymous researcher
libarchive Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Unpacking a maliciously crafted archive may lead to arbitrary code execution Description: A buffer overflow issue was addressed through improved memory handling. CVE-2017-13813: found by OSS-Fuzz CVE-2017-13816: found by OSS-Fuzz Entry added October 31, 2017
libarchive Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Unpacking a maliciously crafted archive may lead to arbitrary code execution Description: Multiple memory corruption issues existed in libarchive. These issues were addressed through improved input validation. CVE-2017-13812: found by OSS-Fuzz Entry added October 31, 2017
libc Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A remote attacker may be able to cause a denial-of-service Description: A resource exhaustion issue in glob() was addressed through an improved algorithm. CVE-2017-7086: Russ Cox of Google
libc Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to cause a denial of service Description: A memory consumption issue was addressed through improved memory handling. CVE-2017-1000373
libexpat Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Multiple issues in expat Description: Multiple issues were addressed by updating to version 2.2.1 CVE-2016-9063 CVE-2017-9233
Location Framework Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to read sensitive location information Description: A permissions issue existed in the handling of the location variable. This was addressed with additional ownership checks. CVE-2017-7148: an anonymous researcher, an anonymous researcher
Mail Drafts Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An attacker with a privileged network position may be able to intercept mail contents Description: An encryption issue existed in the handling of mail drafts. This issue was addressed with improved handling of mail drafts meant to be sent encrypted. CVE-2017-7078: an anonymous researcher, an anonymous researcher, an anonymous researcher
Mail MessageUI Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing a maliciously crafted image may lead to a denial of service Description: A memory corruption issue was addressed with improved validation. CVE-2017-7097: Xinshu Dong and Jun Hao Tan of Anquan Capital
Messages Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing a maliciously crafted image may lead to a denial of service Description: A denial of service issue was addressed through improved validation. CVE-2017-7118: Kiki Jiang and Jason Tokoph
MobileBackup Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Backup may perform an unencrypted backup despite a requirement to perform only encrypted backups Description: A permissions issue existed. This issue was addressed with improved permission validation. CVE-2017-7133: Don Sparks of HackediOS.com
Phone Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A screenshot of secure content may be taken when locking an iOS device Description: A timing issue existed in the handling of locking. This issue was addressed by disabling screenshots while locking. CVE-2017-7139: an anonymous researcher
Quick Look Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2017-13822: Australian Cyber Security Centre a Australian Signals Directorate Entry added October 31, 2017
Quick Look Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Parsing a maliciously crafted office document may lead to an unexpected application termination or arbitrary code execution Description: A memory consumption issue was addressed through improved memory handling. CVE-2017-7132: Australian Cyber Security Centre a Australian Signals Directorate Entry added October 31, 2017
Safari Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Visiting a malicious website may lead to address bar spoofing Description: An inconsistent user interface issue was addressed with improved state management. CVE-2017-7085: xisigr of Tencent's Xuanwu Lab (tencent.com)
Security Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A revoked certificate may be trusted Description: A certificate validation issue existed in the handling of revocation data. This issue was addressed through improved validation. CVE-2017-7080: an anonymous researcher, an anonymous researcher, Sven Driemecker of adesso mobile solutions gmbh, Rune Darrud (@theflyingcorpse) of BA|rum kommune
Security Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious app may be able to track users between installs Description: A permission checking issue existed in the handling of an app's Keychain data. This issue was addressed with improved permission checking. CVE-2017-7146: an anonymous researcher
SQLite Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Multiple issues in SQLite Description: Multiple issues were addressed by updating to version 3.19.3. CVE-2017-10989: found by OSS-Fuzz CVE-2017-7128: found by OSS-Fuzz CVE-2017-7129: found by OSS-Fuzz CVE-2017-7130: found by OSS-Fuzz
SQLite Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2017-7127: an anonymous researcher
Time Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: "Setting Time Zone" may incorrectly indicate that it is using location Description: A permissions issue existed in the process that handles time zone information. The issue was resolved by modifying permissions. CVE-2017-7145: an anonymous researcher
WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A memory corruption issue was addressed through improved input validation. CVE-2017-7081: Apple
WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: Multiple memory corruption issues were addressed with improved memory handling. CVE-2017-7087: Apple CVE-2017-7091: Wei Yuan of Baidu Security Lab working with Trend Micro's Zero Day Initiative CVE-2017-7092: Samuel Gro and Niklas Baumstark working with Trend Micro's Zero Day Initiative, Qixun Zhao (@S0rryMybad) of Qihoo 360 Vulcan Team CVE-2017-7093: Samuel Gro and Niklas Baumstark working with Trend Micro's Zero Day Initiative CVE-2017-7094: Tim Michaud (@TimGMichaud) of Leviathan Security Group CVE-2017-7095: Wang Junjie, Wei Lei, and Liu Yang of Nanyang Technological University working with Trend Micro's Zero Day Initiative CVE-2017-7096: Wei Yuan of Baidu Security Lab CVE-2017-7098: Felipe Freitas of Instituto TecnolA3gico de AeronA!utica CVE-2017-7099: Apple CVE-2017-7100: Masato Kinugawa and Mario Heiderich of Cure53 CVE-2017-7102: Wang Junjie, Wei Lei, and Liu Yang of Nanyang Technological University CVE-2017-7104: likemeng of Baidu Secutity Lab CVE-2017-7107: Wang Junjie, Wei Lei, and Liu Yang of Nanyang Technological University CVE-2017-7111: likemeng of Baidu Security Lab (xlab.baidu.com) working with Trend Micro's Zero Day Initiative CVE-2017-7117: lokihardt of Google Project Zero CVE-2017-7120: chenqin (ee|) of Ant-financial Light-Year Security Lab
WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to universal cross site scripting Description: A logic issue existed in the handling of the parent-tab. This issue was addressed with improved state management. CVE-2017-7089: Anton Lopanitsyn of ONSEC, Frans RosA(c)n of Detectify
WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Cookies belonging to one origin may be sent to another origin Description: A permissions issue existed in the handling of web browser cookies. This issue was addressed by no longer returning cookies for custom URL schemes. CVE-2017-7090: Apple
WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Visiting a malicious website may lead to address bar spoofing Description: An inconsistent user interface issue was addressed with improved state management. CVE-2017-7106: Oliver Paukstadt of Thinking Objects GmbH (to.com)
WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to a cross site scripting attack Description: Application Cache policy may be unexpectedly applied. CVE-2017-7109: avlidienbrunn
WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious website may be able to track users in Safari private browsing mode Description: A permissions issue existed in the handling of web browser cookies. This issue was addressed with improved restrictions. CVE-2017-7144: an anonymous researcher
Wi-Fi Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An attacker within range may be able to execute arbitrary code on the Wi-Fi chip Description: A memory corruption issue was addressed with improved memory handling. CVE-2017-11120: Gal Beniamini of Google Project Zero CVE-2017-11121: Gal Beniamini of Google Project Zero
Wi-Fi Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Malicious code executing on the Wi-Fi chip may be able to execute arbitrary code with kernel privileges on the application processor Description: A memory corruption issue was addressed with improved memory handling. CVE-2017-7103: Gal Beniamini of Google Project Zero CVE-2017-7105: Gal Beniamini of Google Project Zero CVE-2017-7108: Gal Beniamini of Google Project Zero CVE-2017-7110: Gal Beniamini of Google Project Zero CVE-2017-7112: Gal Beniamini of Google Project Zero
Wi-Fi Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Malicious code executing on the Wi-Fi chip may be able to execute arbitrary code with kernel privileges on the application processor Description: Multiple race conditions were addressed through improved validation. CVE-2017-7115: Gal Beniamini of Google Project Zero
Wi-Fi Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Malicious code executing on the Wi-Fi chip may be able to read restricted kernel memory Description: A validation issue was addressed with improved input sanitization. CVE-2017-7116: Gal Beniamini of Google Project Zero
zlib Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Multiple issues in zlib Description: Multiple issues were addressed by updating to version 1.2.11. CVE-2016-9840 CVE-2016-9841 CVE-2016-9842 CVE-2016-9843
Installation note:
This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/
iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device.
To check that the iPhone, iPod touch, or iPad has been updated:
- Navigate to Settings
- Select General
- Select About. The version after applying this update will be "11".
Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE-----
iQJdBAEBCgBHFiEEcuX4rtoRe4X62yWlg6PvjDRstEYFAln4u8QpHHByb2R1Y3Qt c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQg6PvjDRstEb3gRAA mkMtw5g6ZpDFNK4MpKwfTbwIK7rNjxEh2VGvv+1VNTJJRewGiXcbl/cf5EefPJFR RpH+8u2jjl7rgEDwRPLYY4EixRTwvOVs46MS5lzkNKjwaIhBswH6ubFIkw2MRgn9 zBbAmixTDb2HVaG2vMtmDm1PmXMq7QMau4W+G0m40bwiNBAyrqcttiiJ1NxdZsBl LouPNKhaOCLPuDeHG6oJmPRcZCyIvNpXJGE9UA/LMKL5yPbZQpqJvYBznof/SVXq QxvLw1D60Ki+2L2ItXEVAaAfkKh50+cn34m7rhb4ZIv3/hE86BpoFRGaAhni+QGJ ugJ2FYciTPnbLttpZlBYfj29BMqqkYQ1HJ+xEQf3krKiQmGKWcRV4858h2GZRGkW wwd9l1Ym4vDTNK+0yVnN58XTyOjJh/dH8t+Bzp63OUFTLiab6/3kfccozlobbivF pZWt6fFqbn/e6Re62Xj0VfxlST5TjGqxZq0qgNJiWG9s5z0To3YcDXhJSsTyjtIj cLM13UTPFAPj+ReTaA0wczvjoq4J6EyVD2bDOHv/iKY+7xOO9+5vTYGD3nhKjdAo GFBCbpCtBrrrlAd6TtW1D15QBJ+/e/5uJYd9r2BIR/w3l5I7IAnNHtYV9zu/wvuM odr7Q4DNa5UQq0VMLbsd2avIoYX+xxKQg4WUv8BbkZI= =NYhG -----END PGP SIGNATURE-----
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201709-0971",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "bcm4355c0",
"scope": "eq",
"trust": 2.4,
"vendor": "broadcom",
"version": "9.44.78.27.0.1.56"
},
{
"model": "tvos",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "11.0"
},
{
"model": "iphone os",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "11.0"
},
{
"model": "ios",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "11 (ipad air or later )"
},
{
"model": "ios",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "11 (iphone 5s or later )"
},
{
"model": "ios",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "11 (ipod touch first 6 generation )"
},
{
"model": "tvos",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "11 (apple tv first 4 generation )"
},
{
"model": "bcm4355c0 wi-fi chips",
"scope": "eq",
"trust": 0.6,
"vendor": "broadcom",
"version": "9.44.78.27.0.1.56"
},
{
"model": "galaxy s7 edge",
"scope": "eq",
"trust": 0.3,
"vendor": "samsung",
"version": "0"
},
{
"model": "android",
"scope": "eq",
"trust": 0.3,
"vendor": "google",
"version": "0"
},
{
"model": "bcm4355c0 soc",
"scope": "eq",
"trust": 0.3,
"vendor": "broadcom",
"version": "9.44.78.27.0.1.56"
},
{
"model": "tvos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.1.1"
},
{
"model": "tvos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.0.1"
},
{
"model": "tvos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.2.2"
},
{
"model": "tvos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.2.1"
},
{
"model": "tvos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.1.1"
},
{
"model": "tvos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.2"
},
{
"model": "tvos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.1"
},
{
"model": "tvos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.0"
},
{
"model": "tvos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.2.2"
},
{
"model": "tvos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.2.1"
},
{
"model": "tvos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.2"
},
{
"model": "tvos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.1"
},
{
"model": "tvos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10"
},
{
"model": "tv",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "0"
},
{
"model": "ipod touch",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "0"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "0"
},
{
"model": "ipad air",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "0"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "50"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "40"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "30"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.2.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.0.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.3.4"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.3.3"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.3.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.3.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.2.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.0.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.0.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "8.4.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.0.6"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.0.5"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.0.3"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.0.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.0.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "6.3.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "6.1.6"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "6.1.4"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "6.1.3"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.0.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.0.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.2.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.2.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.3.5"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.3"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "8.4"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "8.3"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "8.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "8.1.3"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "8.1.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "8.1.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "8.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "8"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.1.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.1.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.0.4"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "6.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "6.0.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "6.0.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "6"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5.1.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5.0.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3.5"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3.4"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3.3"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.9"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.8"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.7"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.6"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.5"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.10"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.0"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.0"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.3.3"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.3.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.3.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.3"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10"
},
{
"model": "tvos",
"scope": "ne",
"trust": 0.3,
"vendor": "apple",
"version": "11"
},
{
"model": "ios",
"scope": "ne",
"trust": 0.3,
"vendor": "apple",
"version": "11"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-03143"
},
{
"db": "BID",
"id": "100984"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008567"
},
{
"db": "CNNVD",
"id": "CNNVD-201707-296"
},
{
"db": "NVD",
"id": "CVE-2017-11121"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:broadcom:bcm4355c0_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:apple:iphone_os",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:apple:apple_tv",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-008567"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Apple",
"sources": [
{
"db": "PACKETSTORM",
"id": "144371"
},
{
"db": "PACKETSTORM",
"id": "144369"
},
{
"db": "PACKETSTORM",
"id": "144837"
},
{
"db": "PACKETSTORM",
"id": "144832"
}
],
"trust": 0.4
},
"cve": "CVE-2017-11121",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CVE-2017-11121",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.9,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CNVD-2018-03143",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "VHN-101512",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "CVE-2017-11121",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2017-11121",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "NVD",
"id": "CVE-2017-11121",
"trust": 0.8,
"value": "Critical"
},
{
"author": "CNVD",
"id": "CNVD-2018-03143",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201707-296",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-101512",
"trust": 0.1,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2017-11121",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-03143"
},
{
"db": "VULHUB",
"id": "VHN-101512"
},
{
"db": "VULMON",
"id": "CVE-2017-11121"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008567"
},
{
"db": "CNNVD",
"id": "CNNVD-201707-296"
},
{
"db": "NVD",
"id": "CVE-2017-11121"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, properly crafted malicious over-the-air Fast Transition frames can potentially trigger internal Wi-Fi firmware heap and/or stack overflows, leading to denial of service or other effects, aka B-V2017061205. Broadcom BCM4355C0 Wi-Fichips is a Wi-Fi chip from Broadcom. Wi-Fifirmware is the firmware used in it. A security vulnerability exists in the 9.44.78.27.0.1.56 version of the Broadcom BCM4355C0 Wi-Fi chip. An attacker could exploit the vulnerability to cause a denial of service (heap or stack overflow). Apple iOS and tvOS are prone to multiple arbitrary code-execution vulnerabilities. \nAn attacker can leverage these issues to execute arbitrary code within the context of the affected application. Failed exploit attempts will likely result in denial-of-service conditions. \nVersions prior to Apple tvOS 11 and iOS 11 are vulnerable. \nThese issues are being tracked by Android Bud IDs A-62575409 and A-62576413. Broadcom: Multiple overflows when handling 802.11r (FT) Reassociation Response \n\nCVE-2017-11121\n\n\nBroadcom produces Wi-Fi HardMAC SoCs which are used to handle the PHY and MAC layer processing. These chips are present in both mobile devices and Wi-Fi routers, and are capable of handling many Wi-Fi related events without delegating to the host OS. \n\nIn order to allow fast roaming between access points in a wireless network, the Broadcom firmware supports the Fast BSS Transition feature (IEEE 802.11r-2008 FT), allowing a client to roam between APs in the same mobility domain. When a client decides to roam to a different AP in an FT network (in the same mobility domain), it first performs Authentication and then Reassociation. \n\nDuring the Reassociation process, the client parses the Fast Transition Information Element in order to decrypt and install the embedded GTK. The FT-IE has the following structure:\n\n -----------------------------------------------------------------------\n | Tag (55) | Length | MIC CTRL | MIC | Anonce | Snonce | Sub-Elements |\n -----------------------------------------------------------------------\n 0 1 2 4 20 52 84 X\n\nWhere each sub-element has the following structure:\n\n ---------------------------------------------------------\n | Tag | Length | Key Info | Key Length | RSC | Key Data |\n ---------------------------------------------------------\n 0 1 2 4 5 13 X\n\n\n(See 802.11-2016, 9.4.2.48 for more information). \n\nOn the BCM4355C0 SoC with firmware version 9.44.78.27.0.1.56 the Fast Transition Reassociation process is handled by ROM function 0x8462C. This function retrieves the FT-IE from the last association response and parses it in order to extract the GTK. Here is the approximate high-level logic \nof this function:\n\nint function_8462C(...) {\n ... \n\n //Getting the FT-IE\n uint8_t* ft_ie = bcm_parse_tlvs(..., ..., 55); \n if (!ft_ie) \n return 0;\n\n //Getting the GTK Sub-Element\n uint8_t* gtk_subelem = bcm_parse_tlvs(ft_ie + 84, ft_ie[1] - 82, 2);\n if (!gtk_subelem)\n return 0;\n ... \n\n //Decrypting the GTK\n context_struct-\u003egtk_length = gtk_subelem[4];\n if (!function_6D8(16, ..., gtk_subelem[1] - 11, gtk_subelem + 13, \u0026context_struct-\u003edecrypted_gtk)) {\n\n //Installing the GTK\n function_C9C14(..., context_struct-\u003edecrypted_gtk, context_struct-\u003egtk_length, ...);\n ... \n }\n ... \n}\n\nfunction_6D8(unsigned key_length, char* key, unsigned input_length, char* input, char* output) {\n ... \n char buf[0x200];\n char buf2[0x8];\n\n //Validating the lengths\n if ( (key_length - 16) \u003e 16 ||\n ((0x80808000 \u003c\u003c (key_length - 16)) \u0026 0x80000000) == 0 ||\n input_length \u003e 0x188 ||\n input_length \u003c\u003c 29 )\n return 1;\n\n //Copying the input into a local stack buffer\n memcpy(buf2, input, 8);\n memcpy(buf + 8, input + 8, input_length - 8);\n\n //Do AES decryption\n ... \n}\n\nint function_C9C14(..., char* gtk, int gtk_len, ...) {\n ... \n char* key_buffer = malloc(164);\n ... \n memcpy(key_buffer + 8, gtk, gtk_len);\n ... \n}\n\nThe function above fails to validate all the length fields in the FT-IE and in the embedded subelement. As a result, an attacker can cause multiple overflows by sending crafted information elements. Here are some possible attacks:\n\n 1. The attacker sends a valid FT-IE with an embedded subelement containing a valid length field (gtk_subelem[1]), but with a large crafted value in the key length field (gtk_subelem[4]). Supplying such values will cause the decryption function (0x6D8) to succeed. However, after decrypting the key, function 0xC9C14 will be called in order to install the GTK, using the crafted key length field. Supplying a large value such as 255 in this field will cause the function to copy 255 bytes from the context structure into the heap allocated buffer, whose size is only 164 -- causing a heap overflow. \n\n 2. The attacker sends a valid FT-IE with an embedded subelement whose length field (gtk_subelem[1]) is exactly 11. As we can see above, \"gtk_subelem[1] - 11\" is provided to the decryption function as the \"input_length\" field. Although the decryption function does perform some validations on the input length field, it fails to ensure that the field is larger than 8. After performing the validations, it calls \"memcpy(buf + 8, input + 8, input_length - 8)\" in order to copy the input into a stack-allocated buffer. If the input length is zero, \"input_length - 8\" will underflow, resulting in a large length argument in the memcpy. I\u0027m not sure whether this is exploitable -- if timed correctly, it might be possible to corrupt important values after the stack, such as the global PCIE structure located at the end of RAM, which would allow the attacker to trigger writes into arbitrary locations in the host\u0027s memory. \n\nThis bug can be addressed by validating the GTK subelement length fields. \n\nThis bug is subject to a 90 day disclosure deadline. After 90 days elapse\nor a patch has been made broadly available, the bug report will become\nvisible to the public. \n\n\n\n\nFound by: laginimaineb\n\n. \nCVE-2016-9840\nCVE-2016-9841\nCVE-2016-9842\nCVE-2016-9843\nEntry added September 25, 2017\n\nAdditional recognition\n\nSecurity\nWe would like to acknowledge Abhinav Bansal of Zscaler, Inc. \nfor their assistance. \n\nWebkit\nWe would like to acknowledge xisigr of Tencent\u0027s Xuanwu Lab\n(tencent.com) for their assistance. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA512\n\nAPPLE-SA-2017-10-31-9\nAdditional information for APPLE-SA-2017-09-19-1 iOS 11\n\niOS 11 addresses the following:\n\n802.1X\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: An attacker may be able to exploit weaknesses in TLS 1.0\nDescription: A protocol security issue was addressed by enabling TLS\n1.1 and TLS 1.2. \nCVE-2017-13832: an anonymous researcher\nEntry added October 31, 2017\n\nBluetooth\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: An application may be able to access restricted files\nDescription: A privacy issue existed in the handling of Contact\ncards. This was addressed with improved state management. \nCVE-2017-7131: Dominik Conrads of Federal Office for Information\nSecurity, an anonymous researcher, Elvis (@elvisimprsntr), an\nanonymous researcher\n\nCFNetwork Proxies\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: An attacker in a privileged network position may be able to\ncause a denial of service\nDescription: Multiple denial of service issues were addressed through\nimproved memory handling. \nCVE-2017-7083: Abhinav Bansal of Zscaler Inc. \n\nCFString\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: An application may be able to read restricted memory\nDescription: A validation issue was addressed with improved input\nsanitization. \nCVE-2017-13821: Australian Cyber Security Centre a Australian Signals\nDirectorate\nEntry added October 31, 2017\n\nCoreAudio\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: An application may be able to read restricted memory\nDescription: An out-of-bounds read was addressed by updating to Opus\nversion 1.1.4. \nCVE-2017-0381: V.E.O (@VYSEa) of Mobile Threat Research Team, Trend\nMicro\n\nCoreText\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: Processing a maliciously crafted font file may lead to\narbitrary code execution\nDescription: A memory consumption issue was addressed through\nimproved memory handling. \nCVE-2017-13825: Australian Cyber Security Centre a Australian Signals\nDirectorate\nEntry added October 31, 2017\n\nExchange ActiveSync\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: An attacker in a privileged network position may be able to\nerase a device during Exchange account setup\nDescription: A validation issue existed in AutoDiscover V1. This was\naddressed by requiring TLS for AutoDiscover V1. AutoDiscover V2 is\nnow supported. \nCVE-2017-7088: Ilya Nesterov, Maxim Goncharov\n\nfile\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: Multiple issues in file\nDescription: Multiple issues were addressed by updating to version\n5.31. \nCVE-2017-13815\nEntry added October 31, 2017\n\nFonts\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: Rendering untrusted text may lead to spoofing\nDescription: An inconsistent user interface issue was addressed with\nimproved state management. \nCVE-2017-13828: an anonymous researcher\nEntry added October 31, 2017\n\nHeimdal\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: An attacker in a privileged network position may be able\nto impersonate a service\nDescription: A validation issue existed in the handling of\nthe KDC-REP service name. This issue was addressed through improved\nvalidation. \nCVE-2017-11103: Jeffrey Altman, Viktor Duchovni, and Nico Williams\n\nHFS\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: An application may be able to execute arbitrary code with\nsystem privileges\nDescription: A memory corruption issue was addressed with improved\nmemory handling. \nCVE-2017-13830: Sergej Schumilo of Ruhr-University Bochum\nEntry added October 31, 2017\n\niBooks\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: Parsing a maliciously crafted iBooks file may lead to a\npersistent denial-of-service\nDescription: Multiple denial of service issues were addressed through\nimproved memory handling. \nCVE-2017-7072: JAdrzej Krysztofiak\n\nImageIO\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: Processing a maliciously crafted image may lead to arbitrary\ncode execution\nDescription: A memory corruption issue was addressed through improved\ninput validation. \nCVE-2017-13814: Australian Cyber Security Centre a Australian Signals\nDirectorate\nEntry added October 31, 2017\n\nImageIO\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: Processing a maliciously crafted image may lead to a denial\nof service\nDescription: An information disclosure issue existed in the\nprocessing of disk images. This issue was addressed through improved\nmemory management. \nCVE-2017-13831: an anonymous researcher\nEntry added October 31, 2017\n\nKernel\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: An application may be able to execute arbitrary code with\nkernel privileges\nDescription: A memory corruption issue was addressed with improved\nmemory handling. \nCVE-2017-7114: Alex Plaskett of MWR InfoSecurity\n\nKernel\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: A local user may be able to read kernel memory\nDescription: An out-of-bounds read issue existed that led to the\ndisclosure of kernel memory. This was addressed through improved\ninput validation. \nCVE-2017-13817: Maxime Villard (m00nbsd)\nEntry added October 31, 2017\n\nKernel\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: An application may be able to read restricted memory\nDescription: A validation issue was addressed with improved input\nsanitization. \nCVE-2017-13818: The UK\u0027s National Cyber Security Centre (NCSC)\nCVE-2017-13836: an anonymous researcher, an anonymous researcher\nCVE-2017-13841: an anonymous researcher\nCVE-2017-13840: an anonymous researcher\nCVE-2017-13842: an anonymous researcher\nCVE-2017-13782: Kevin Backhouse of Semmle Ltd. \nEntry added October 31, 2017\n\nKernel\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: An application may be able to execute arbitrary code with\nkernel privileges\nDescription: A memory corruption issue was addressed with improved\nmemory handling. \nCVE-2017-13843: an anonymous researcher\nEntry added October 31, 2017\n\nKernel\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: Processing a malformed mach binary may lead to arbitrary code\nexecution\nDescription: A memory corruption issue was addressed through improved\nvalidation. \nCVE-2017-13834: Maxime Villard (m00nbsd)\nEntry added October 31, 2017\n\nKeyboard Suggestions\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: Keyboard autocorrect suggestions may reveal sensitive\ninformation\nDescription: The iOS keyboard was inadvertently caching sensitive\ninformation. This issue was addressed with improved heuristics. \nCVE-2017-7140: an anonymous researcher\n\nlibarchive\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: Unpacking a maliciously crafted archive may lead to arbitrary\ncode execution\nDescription: A buffer overflow issue was addressed through improved\nmemory handling. \nCVE-2017-13813: found by OSS-Fuzz\nCVE-2017-13816: found by OSS-Fuzz\nEntry added October 31, 2017\n\nlibarchive\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: Unpacking a maliciously crafted archive may lead to arbitrary\ncode execution\nDescription: Multiple memory corruption issues existed in libarchive. \nThese issues were addressed through improved input validation. \nCVE-2017-13812: found by OSS-Fuzz\nEntry added October 31, 2017\n\nlibc\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: A remote attacker may be able to cause a denial-of-service\nDescription: A resource exhaustion issue in glob() was addressed\nthrough an improved algorithm. \nCVE-2017-7086: Russ Cox of Google\n\nlibc\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: An application may be able to cause a denial of service\nDescription: A memory consumption issue was addressed through\nimproved memory handling. \nCVE-2017-1000373\n\nlibexpat\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: Multiple issues in expat\nDescription: Multiple issues were addressed by updating to version\n2.2.1\nCVE-2016-9063\nCVE-2017-9233\n\nLocation Framework\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: An application may be able to read sensitive location\ninformation\nDescription: A permissions issue existed in the handling of the\nlocation variable. This was addressed with additional ownership\nchecks. \nCVE-2017-7148: an anonymous researcher, an anonymous researcher\n\nMail Drafts\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: An attacker with a privileged network position may be able to\nintercept mail contents\nDescription: An encryption issue existed in the handling of mail\ndrafts. This issue was addressed with improved handling of mail\ndrafts meant to be sent encrypted. \nCVE-2017-7078: an anonymous researcher, an anonymous researcher, an\nanonymous researcher\n\nMail MessageUI\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: Processing a maliciously crafted image may lead to a denial\nof service\nDescription: A memory corruption issue was addressed with improved\nvalidation. \nCVE-2017-7097: Xinshu Dong and Jun Hao Tan of Anquan Capital\n\nMessages\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: Processing a maliciously crafted image may lead to a denial\nof service\nDescription: A denial of service issue was addressed through improved\nvalidation. \nCVE-2017-7118: Kiki Jiang and Jason Tokoph\n\nMobileBackup\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: Backup may perform an unencrypted backup despite a\nrequirement to perform only encrypted backups\nDescription: A permissions issue existed. This issue was addressed\nwith improved permission validation. \nCVE-2017-7133: Don Sparks of HackediOS.com\n\nPhone\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: A screenshot of secure content may be taken when locking an\niOS device\nDescription: A timing issue existed in the handling of locking. This\nissue was addressed by disabling screenshots while locking. \nCVE-2017-7139: an anonymous researcher\n\nQuick Look\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: An application may be able to read restricted memory\nDescription: A validation issue was addressed with improved input\nsanitization. \nCVE-2017-13822: Australian Cyber Security Centre a Australian Signals\nDirectorate\nEntry added October 31, 2017\n\nQuick Look\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: Parsing a maliciously crafted office document may lead to an\nunexpected application termination or arbitrary code execution\nDescription: A memory consumption issue was addressed through\nimproved memory handling. \nCVE-2017-7132: Australian Cyber Security Centre a Australian Signals\nDirectorate\nEntry added October 31, 2017\n\nSafari\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: Visiting a malicious website may lead to address bar spoofing\nDescription: An inconsistent user interface issue was addressed with\nimproved state management. \nCVE-2017-7085: xisigr of Tencent\u0027s Xuanwu Lab (tencent.com)\n\nSecurity\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: A revoked certificate may be trusted\nDescription: A certificate validation issue existed in the handling\nof revocation data. This issue was addressed through improved\nvalidation. \nCVE-2017-7080: an anonymous researcher, an anonymous researcher,\nSven Driemecker of adesso mobile solutions gmbh,\nRune Darrud (@theflyingcorpse) of BA|rum kommune\n\nSecurity\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: A malicious app may be able to track users between installs\nDescription: A permission checking issue existed in the handling of\nan app\u0027s Keychain data. This issue was addressed with improved\npermission checking. \nCVE-2017-7146: an anonymous researcher\n\nSQLite\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: Multiple issues in SQLite\nDescription: Multiple issues were addressed by updating to\nversion 3.19.3. \nCVE-2017-10989: found by OSS-Fuzz\nCVE-2017-7128: found by OSS-Fuzz\nCVE-2017-7129: found by OSS-Fuzz\nCVE-2017-7130: found by OSS-Fuzz\n\nSQLite\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: An application may be able to execute arbitrary code with\nsystem privileges\nDescription: A memory corruption issue was addressed with improved\nmemory handling. \nCVE-2017-7127: an anonymous researcher\n\nTime\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: \"Setting Time Zone\" may incorrectly indicate that it is using\nlocation\nDescription: A permissions issue existed in the process that handles\ntime zone information. The issue was resolved by modifying\npermissions. \nCVE-2017-7145: an anonymous researcher\n\nWebKit\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: Processing maliciously crafted web content may lead to\narbitrary code execution\nDescription: A memory corruption issue was addressed through improved\ninput validation. \nCVE-2017-7081: Apple\n\nWebKit\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: Processing maliciously crafted web content may lead to\narbitrary code execution\nDescription: Multiple memory corruption issues were addressed with\nimproved memory handling. \nCVE-2017-7087: Apple\nCVE-2017-7091: Wei Yuan of Baidu Security Lab working with Trend\nMicro\u0027s Zero Day Initiative\nCVE-2017-7092: Samuel Gro and Niklas Baumstark working with Trend\nMicro\u0027s Zero Day Initiative, Qixun Zhao (@S0rryMybad) of Qihoo 360\nVulcan Team\nCVE-2017-7093: Samuel Gro and Niklas Baumstark working with Trend\nMicro\u0027s Zero Day Initiative\nCVE-2017-7094: Tim Michaud (@TimGMichaud) of Leviathan Security Group\nCVE-2017-7095: Wang Junjie, Wei Lei, and Liu Yang of Nanyang\nTechnological University working with Trend Micro\u0027s Zero Day\nInitiative\nCVE-2017-7096: Wei Yuan of Baidu Security Lab\nCVE-2017-7098: Felipe Freitas of Instituto TecnolA3gico de AeronA!utica\nCVE-2017-7099: Apple\nCVE-2017-7100: Masato Kinugawa and Mario Heiderich of Cure53\nCVE-2017-7102: Wang Junjie, Wei Lei, and Liu Yang of Nanyang\nTechnological University\nCVE-2017-7104: likemeng of Baidu Secutity Lab\nCVE-2017-7107: Wang Junjie, Wei Lei, and Liu Yang of Nanyang\nTechnological University\nCVE-2017-7111: likemeng of Baidu Security Lab (xlab.baidu.com)\nworking with Trend Micro\u0027s Zero Day Initiative\nCVE-2017-7117: lokihardt of Google Project Zero\nCVE-2017-7120: chenqin (ee|) of Ant-financial Light-Year Security\nLab\n\nWebKit\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: Processing maliciously crafted web content may lead to\nuniversal cross site scripting\nDescription: A logic issue existed in the handling of the parent-tab. \nThis issue was addressed with improved state management. \nCVE-2017-7089: Anton Lopanitsyn of ONSEC, Frans RosA(c)n of Detectify\n\nWebKit\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: Cookies belonging to one origin may be sent to another origin\nDescription: A permissions issue existed in the handling of web\nbrowser cookies. This issue was addressed by no longer returning\ncookies for custom URL schemes. \nCVE-2017-7090: Apple\n\nWebKit\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: Visiting a malicious website may lead to address bar spoofing\nDescription: An inconsistent user interface issue was addressed with\nimproved state management. \nCVE-2017-7106: Oliver Paukstadt of Thinking Objects GmbH (to.com)\n\nWebKit\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: Processing maliciously crafted web content may lead to a\ncross site scripting attack\nDescription: Application Cache policy may be unexpectedly applied. \nCVE-2017-7109: avlidienbrunn\n\nWebKit\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: A malicious website may be able to track users in Safari\nprivate browsing mode\nDescription: A permissions issue existed in the handling of web\nbrowser cookies. This issue was addressed with improved restrictions. \nCVE-2017-7144: an anonymous researcher\n\nWi-Fi\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: An attacker within range may be able to execute arbitrary\ncode on the Wi-Fi chip\nDescription: A memory corruption issue was addressed with improved\nmemory handling. \nCVE-2017-11120: Gal Beniamini of Google Project Zero\nCVE-2017-11121: Gal Beniamini of Google Project Zero\n\nWi-Fi\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: Malicious code executing on the Wi-Fi chip may be able to\nexecute arbitrary code with kernel privileges on the application\nprocessor\nDescription: A memory corruption issue was addressed with improved\nmemory handling. \nCVE-2017-7103: Gal Beniamini of Google Project Zero\nCVE-2017-7105: Gal Beniamini of Google Project Zero\nCVE-2017-7108: Gal Beniamini of Google Project Zero\nCVE-2017-7110: Gal Beniamini of Google Project Zero\nCVE-2017-7112: Gal Beniamini of Google Project Zero\n\nWi-Fi\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: Malicious code executing on the Wi-Fi chip may be able to\nexecute arbitrary code with kernel privileges on the application\nprocessor\nDescription: Multiple race conditions were addressed through improved\nvalidation. \nCVE-2017-7115: Gal Beniamini of Google Project Zero\n\nWi-Fi\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: Malicious code executing on the Wi-Fi chip may be able to\nread restricted kernel memory\nDescription: A validation issue was addressed with improved input\nsanitization. \nCVE-2017-7116: Gal Beniamini of Google Project Zero\n\nzlib\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: Multiple issues in zlib\nDescription: Multiple issues were addressed by updating to version\n1.2.11. \nCVE-2016-9840\nCVE-2016-9841\nCVE-2016-9842\nCVE-2016-9843\n\nInstallation note:\n\nThis update is available through iTunes and Software Update on your\niOS device, and will not appear in your computer\u0027s Software Update\napplication, or in the Apple Downloads site. Make sure you have an\nInternet connection and have installed the latest version of iTunes\nfrom https://www.apple.com/itunes/\n\niTunes and Software Update on the device will automatically check\nApple\u0027s update server on its weekly schedule. When an update is\ndetected, it is downloaded and the option to be installed is\npresented to the user when the iOS device is docked. We recommend\napplying the update immediately if possible. Selecting Don\u0027t Install\nwill present the option the next time you connect your iOS device. \n\nThe automatic update process may take up to a week depending on the\nday that iTunes or the device checks for updates. You may manually\nobtain the update via the Check for Updates button within iTunes, or\nthe Software Update on your device. \n\nTo check that the iPhone, iPod touch, or iPad has been updated:\n\n* Navigate to Settings\n* Select General\n* Select About. The version after applying this update\nwill be \"11\". \n\nInformation will also be posted to the Apple Security Updates\nweb site: https://support.apple.com/kb/HT201222\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n-----BEGIN PGP SIGNATURE-----\n\niQJdBAEBCgBHFiEEcuX4rtoRe4X62yWlg6PvjDRstEYFAln4u8QpHHByb2R1Y3Qt\nc2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQg6PvjDRstEb3gRAA\nmkMtw5g6ZpDFNK4MpKwfTbwIK7rNjxEh2VGvv+1VNTJJRewGiXcbl/cf5EefPJFR\nRpH+8u2jjl7rgEDwRPLYY4EixRTwvOVs46MS5lzkNKjwaIhBswH6ubFIkw2MRgn9\nzBbAmixTDb2HVaG2vMtmDm1PmXMq7QMau4W+G0m40bwiNBAyrqcttiiJ1NxdZsBl\nLouPNKhaOCLPuDeHG6oJmPRcZCyIvNpXJGE9UA/LMKL5yPbZQpqJvYBznof/SVXq\nQxvLw1D60Ki+2L2ItXEVAaAfkKh50+cn34m7rhb4ZIv3/hE86BpoFRGaAhni+QGJ\nugJ2FYciTPnbLttpZlBYfj29BMqqkYQ1HJ+xEQf3krKiQmGKWcRV4858h2GZRGkW\nwwd9l1Ym4vDTNK+0yVnN58XTyOjJh/dH8t+Bzp63OUFTLiab6/3kfccozlobbivF\npZWt6fFqbn/e6Re62Xj0VfxlST5TjGqxZq0qgNJiWG9s5z0To3YcDXhJSsTyjtIj\ncLM13UTPFAPj+ReTaA0wczvjoq4J6EyVD2bDOHv/iKY+7xOO9+5vTYGD3nhKjdAo\nGFBCbpCtBrrrlAd6TtW1D15QBJ+/e/5uJYd9r2BIR/w3l5I7IAnNHtYV9zu/wvuM\nodr7Q4DNa5UQq0VMLbsd2avIoYX+xxKQg4WUv8BbkZI=\n=NYhG\n-----END PGP SIGNATURE-----\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-11121"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008567"
},
{
"db": "CNVD",
"id": "CNVD-2018-03143"
},
{
"db": "BID",
"id": "100984"
},
{
"db": "VULHUB",
"id": "VHN-101512"
},
{
"db": "VULMON",
"id": "CVE-2017-11121"
},
{
"db": "PACKETSTORM",
"id": "144329"
},
{
"db": "PACKETSTORM",
"id": "144371"
},
{
"db": "PACKETSTORM",
"id": "144369"
},
{
"db": "PACKETSTORM",
"id": "144837"
},
{
"db": "PACKETSTORM",
"id": "144832"
}
],
"trust": 3.06
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-101512",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-101512"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-11121",
"trust": 4.0
},
{
"db": "BID",
"id": "100984",
"trust": 2.7
},
{
"db": "PACKETSTORM",
"id": "144329",
"trust": 1.9
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008567",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201707-296",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2018-03143",
"trust": 0.6
},
{
"db": "SEEBUG",
"id": "SSVID-96606",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-101512",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2017-11121",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "144371",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "144369",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "144837",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "144832",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-03143"
},
{
"db": "VULHUB",
"id": "VHN-101512"
},
{
"db": "VULMON",
"id": "CVE-2017-11121"
},
{
"db": "BID",
"id": "100984"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008567"
},
{
"db": "PACKETSTORM",
"id": "144329"
},
{
"db": "PACKETSTORM",
"id": "144371"
},
{
"db": "PACKETSTORM",
"id": "144369"
},
{
"db": "PACKETSTORM",
"id": "144837"
},
{
"db": "PACKETSTORM",
"id": "144832"
},
{
"db": "CNNVD",
"id": "CNNVD-201707-296"
},
{
"db": "NVD",
"id": "CVE-2017-11121"
}
]
},
"id": "VAR-201709-0971",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-03143"
},
{
"db": "VULHUB",
"id": "VHN-101512"
}
],
"trust": 1.46969698
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-03143"
}
]
},
"last_update_date": "2024-11-23T20:59:08.710000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Android Security Bulletin-September 2017",
"trust": 0.8,
"url": "https://source.android.com/security/bulletin/2017-09-01"
},
{
"title": "HT208113",
"trust": 0.8,
"url": "https://support.apple.com/en-us/HT208113"
},
{
"title": "HT208112",
"trust": 0.8,
"url": "https://support.apple.com/en-us/HT208112"
},
{
"title": "HT208112",
"trust": 0.8,
"url": "https://support.apple.com/ja-jp/HT208112"
},
{
"title": "HT208113",
"trust": 0.8,
"url": "https://support.apple.com/ja-jp/HT208113"
},
{
"title": "Top Page",
"trust": 0.8,
"url": "https://www.broadcom.com/"
},
{
"title": "BroadcomBCM4355C0 Wi-Fi chip into a patch for denial of service vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/116279"
},
{
"title": "Broadcom BCM4355C0 Wi-Fi Fixes for chip security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=90655"
},
{
"title": "Apple: tvOS 11",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories\u0026qid=74de8bbddd443742d386dabda32dc2ae"
},
{
"title": "Apple: iOS 11",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories\u0026qid=041cce4eee20b18dc79e9460a53e8400"
},
{
"title": "Android Security Bulletins: Android Security Bulletin\u2014September 2017",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=android_security_bulletins\u0026qid=45d9f825c1db6d21aee6f02c00c607a0"
},
{
"title": "Threatpost",
"trust": 0.1,
"url": "https://threatpost.com/lenovo-warns-critical-wifi-vulnerability-impacts-dozens-of-thinkpad-models/129860/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-03143"
},
{
"db": "VULMON",
"id": "CVE-2017-11121"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008567"
},
{
"db": "CNNVD",
"id": "CNNVD-201707-296"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-119",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-101512"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008567"
},
{
"db": "NVD",
"id": "CVE-2017-11121"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "http://www.securityfocus.com/bid/100984"
},
{
"trust": 2.1,
"url": "https://lists.apple.com/archives/security-announce/2017/sep/msg00009.html"
},
{
"trust": 2.1,
"url": "https://lists.apple.com/archives/security-announce/2017/sep/msg00007.html"
},
{
"trust": 2.1,
"url": "https://source.android.com/security/bulletin/2017-09-01"
},
{
"trust": 2.1,
"url": "https://bugs.chromium.org/p/project-zero/issues/detail?id=1291"
},
{
"trust": 1.9,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-11121"
},
{
"trust": 1.8,
"url": "https://support.apple.com/ht208112"
},
{
"trust": 1.8,
"url": "https://support.apple.com/ht208113"
},
{
"trust": 1.8,
"url": "https://support.apple.com/en-us/ht208112"
},
{
"trust": 1.8,
"url": "https://support.apple.com/en-us/ht208113"
},
{
"trust": 1.8,
"url": "http://packetstormsecurity.com/files/144329/broadcom-802.11r-ft-reassociation-response-overflows.html"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-11121"
},
{
"trust": 0.4,
"url": "https://support.apple.com/kb/ht201222"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-10989"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-0381"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-9842"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-11120"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-1000373"
},
{
"trust": 0.4,
"url": "https://www.apple.com/support/security/pgp/"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-9840"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-9063"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-9841"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-9843"
},
{
"trust": 0.3,
"url": "https://www.apple.com/"
},
{
"trust": 0.3,
"url": "http://www.apple.com/ios/"
},
{
"trust": 0.3,
"url": "http://www.apple.com/accessibility/tvos/"
},
{
"trust": 0.3,
"url": "https://bugs.chromium.org/p/project-zero/issues/detail?id=1289"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-7091"
},
{
"trust": 0.2,
"url": "https://gpgtools.org"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-7080"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-7094"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-7083"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-7093"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-7090"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-7087"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-7092"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-7081"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-7096"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-7086"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-7095"
},
{
"trust": 0.2,
"url": "https://www.apple.com/itunes/"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-11103"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-13782"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-13817"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-13831"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-13832"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-13830"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-13828"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-13814"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-13822"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-13825"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-13816"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-13834"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-13818"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-13813"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-13812"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-13815"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/119.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://threatpost.com/lenovo-warns-critical-wifi-vulnerability-impacts-dozens-of-thinkpad-models/129860/"
},
{
"trust": 0.1,
"url": "https://support.apple.com/kb/ht208113"
},
{
"trust": 0.1,
"url": "https://source.android.com/security/bulletin/2017-09-01.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-7104"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-7098"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-7103"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-7100"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-7102"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-7099"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-7072"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-7078"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-7085"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-7089"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-7088"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-13836"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-13840"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-13821"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-03143"
},
{
"db": "VULHUB",
"id": "VHN-101512"
},
{
"db": "VULMON",
"id": "CVE-2017-11121"
},
{
"db": "BID",
"id": "100984"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008567"
},
{
"db": "PACKETSTORM",
"id": "144329"
},
{
"db": "PACKETSTORM",
"id": "144371"
},
{
"db": "PACKETSTORM",
"id": "144369"
},
{
"db": "PACKETSTORM",
"id": "144837"
},
{
"db": "PACKETSTORM",
"id": "144832"
},
{
"db": "CNNVD",
"id": "CNNVD-201707-296"
},
{
"db": "NVD",
"id": "CVE-2017-11121"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2018-03143"
},
{
"db": "VULHUB",
"id": "VHN-101512"
},
{
"db": "VULMON",
"id": "CVE-2017-11121"
},
{
"db": "BID",
"id": "100984"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008567"
},
{
"db": "PACKETSTORM",
"id": "144329"
},
{
"db": "PACKETSTORM",
"id": "144371"
},
{
"db": "PACKETSTORM",
"id": "144369"
},
{
"db": "PACKETSTORM",
"id": "144837"
},
{
"db": "PACKETSTORM",
"id": "144832"
},
{
"db": "CNNVD",
"id": "CNNVD-201707-296"
},
{
"db": "NVD",
"id": "CVE-2017-11121"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-02-11T00:00:00",
"db": "CNVD",
"id": "CNVD-2018-03143"
},
{
"date": "2017-09-28T00:00:00",
"db": "VULHUB",
"id": "VHN-101512"
},
{
"date": "2017-09-28T00:00:00",
"db": "VULMON",
"id": "CVE-2017-11121"
},
{
"date": "2017-09-25T00:00:00",
"db": "BID",
"id": "100984"
},
{
"date": "2017-10-24T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-008567"
},
{
"date": "2017-09-26T00:07:47",
"db": "PACKETSTORM",
"id": "144329"
},
{
"date": "2017-09-28T00:23:30",
"db": "PACKETSTORM",
"id": "144371"
},
{
"date": "2017-09-28T00:19:32",
"db": "PACKETSTORM",
"id": "144369"
},
{
"date": "2017-11-01T16:15:56",
"db": "PACKETSTORM",
"id": "144837"
},
{
"date": "2017-11-01T15:51:56",
"db": "PACKETSTORM",
"id": "144832"
},
{
"date": "2017-07-10T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201707-296"
},
{
"date": "2017-09-28T01:29:01.090000",
"db": "NVD",
"id": "CVE-2017-11121"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-02-11T00:00:00",
"db": "CNVD",
"id": "CNVD-2018-03143"
},
{
"date": "2019-03-13T00:00:00",
"db": "VULHUB",
"id": "VHN-101512"
},
{
"date": "2019-03-13T00:00:00",
"db": "VULMON",
"id": "CVE-2017-11121"
},
{
"date": "2017-09-27T08:00:00",
"db": "BID",
"id": "100984"
},
{
"date": "2017-10-24T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-008567"
},
{
"date": "2019-03-13T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201707-296"
},
{
"date": "2024-11-21T03:07:08.827000",
"db": "NVD",
"id": "CVE-2017-11121"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201707-296"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Broadcom BCM4355C0 Wi-Fi Inside the chip such as Wi-Fi Firmware heap overflow vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-008567"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201707-296"
}
],
"trust": 0.6
}
}
var-201709-0970
Vulnerability from variot
On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor report frame to trigger an internal buffer overflow in the Wi-Fi firmware, aka B-V2017061204. Broadcom BCM4355C0 Wi-Fichips is a Wi-Fi chip from Broadcom. Wi-Fifirmware is the firmware used in it. A remote attacker could exploit the vulnerability to execute arbitrary code or cause a denial of service. Apple iOS and tvOS are prone to multiple arbitrary code-execution vulnerabilities. Failed exploit attempts will likely result in denial-of-service conditions. Versions prior to Apple tvOS 11 and iOS 11 are vulnerable. These issues are being tracked by Android Bud IDs A-62575409 and A-62576413. CVE-2016-9840 CVE-2016-9841 CVE-2016-9842 CVE-2016-9843 Entry added September 25, 2017
Additional recognition
Security We would like to acknowledge Abhinav Bansal of Zscaler, Inc. for their assistance.
Webkit We would like to acknowledge xisigr of Tencent's Xuanwu Lab (tencent.com) for their assistance. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512
APPLE-SA-2017-10-31-9 Additional information for APPLE-SA-2017-09-19-1 iOS 11
iOS 11 addresses the following:
802.1X Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An attacker may be able to exploit weaknesses in TLS 1.0 Description: A protocol security issue was addressed by enabling TLS 1.1 and TLS 1.2. CVE-2017-13832: an anonymous researcher Entry added October 31, 2017
Bluetooth Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to access restricted files Description: A privacy issue existed in the handling of Contact cards. This was addressed with improved state management. CVE-2017-7131: Dominik Conrads of Federal Office for Information Security, an anonymous researcher, Elvis (@elvisimprsntr), an anonymous researcher
CFNetwork Proxies Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An attacker in a privileged network position may be able to cause a denial of service Description: Multiple denial of service issues were addressed through improved memory handling. CVE-2017-7083: Abhinav Bansal of Zscaler Inc.
CFString Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2017-13821: Australian Cyber Security Centre a Australian Signals Directorate Entry added October 31, 2017
CoreAudio Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to read restricted memory Description: An out-of-bounds read was addressed by updating to Opus version 1.1.4. CVE-2017-0381: V.E.O (@VYSEa) of Mobile Threat Research Team, Trend Micro
CoreText Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing a maliciously crafted font file may lead to arbitrary code execution Description: A memory consumption issue was addressed through improved memory handling. CVE-2017-13825: Australian Cyber Security Centre a Australian Signals Directorate Entry added October 31, 2017
Exchange ActiveSync Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An attacker in a privileged network position may be able to erase a device during Exchange account setup Description: A validation issue existed in AutoDiscover V1. This was addressed by requiring TLS for AutoDiscover V1. AutoDiscover V2 is now supported. CVE-2017-7088: Ilya Nesterov, Maxim Goncharov
file Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Multiple issues in file Description: Multiple issues were addressed by updating to version 5.31. CVE-2017-13815 Entry added October 31, 2017
Fonts Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Rendering untrusted text may lead to spoofing Description: An inconsistent user interface issue was addressed with improved state management. CVE-2017-13828: an anonymous researcher Entry added October 31, 2017
Heimdal Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An attacker in a privileged network position may be able to impersonate a service Description: A validation issue existed in the handling of the KDC-REP service name. This issue was addressed through improved validation. CVE-2017-11103: Jeffrey Altman, Viktor Duchovni, and Nico Williams
HFS Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2017-13830: Sergej Schumilo of Ruhr-University Bochum Entry added October 31, 2017
iBooks Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Parsing a maliciously crafted iBooks file may lead to a persistent denial-of-service Description: Multiple denial of service issues were addressed through improved memory handling. CVE-2017-7072: JAdrzej Krysztofiak
ImageIO Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: A memory corruption issue was addressed through improved input validation. CVE-2017-13814: Australian Cyber Security Centre a Australian Signals Directorate Entry added October 31, 2017
ImageIO Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing a maliciously crafted image may lead to a denial of service Description: An information disclosure issue existed in the processing of disk images. This issue was addressed through improved memory management. CVE-2017-13831: an anonymous researcher Entry added October 31, 2017
Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2017-7114: Alex Plaskett of MWR InfoSecurity
Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A local user may be able to read kernel memory Description: An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed through improved input validation. CVE-2017-13817: Maxime Villard (m00nbsd) Entry added October 31, 2017
Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2017-13818: The UK's National Cyber Security Centre (NCSC) CVE-2017-13836: an anonymous researcher, an anonymous researcher CVE-2017-13841: an anonymous researcher CVE-2017-13840: an anonymous researcher CVE-2017-13842: an anonymous researcher CVE-2017-13782: Kevin Backhouse of Semmle Ltd. Entry added October 31, 2017
Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2017-13843: an anonymous researcher Entry added October 31, 2017
Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing a malformed mach binary may lead to arbitrary code execution Description: A memory corruption issue was addressed through improved validation. CVE-2017-13834: Maxime Villard (m00nbsd) Entry added October 31, 2017
Keyboard Suggestions Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Keyboard autocorrect suggestions may reveal sensitive information Description: The iOS keyboard was inadvertently caching sensitive information. This issue was addressed with improved heuristics. CVE-2017-7140: an anonymous researcher
libarchive Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Unpacking a maliciously crafted archive may lead to arbitrary code execution Description: A buffer overflow issue was addressed through improved memory handling. CVE-2017-13813: found by OSS-Fuzz CVE-2017-13816: found by OSS-Fuzz Entry added October 31, 2017
libarchive Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Unpacking a maliciously crafted archive may lead to arbitrary code execution Description: Multiple memory corruption issues existed in libarchive. These issues were addressed through improved input validation. CVE-2017-13812: found by OSS-Fuzz Entry added October 31, 2017
libc Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A remote attacker may be able to cause a denial-of-service Description: A resource exhaustion issue in glob() was addressed through an improved algorithm. CVE-2017-7086: Russ Cox of Google
libc Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to cause a denial of service Description: A memory consumption issue was addressed through improved memory handling. CVE-2017-1000373
libexpat Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Multiple issues in expat Description: Multiple issues were addressed by updating to version 2.2.1 CVE-2016-9063 CVE-2017-9233
Location Framework Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to read sensitive location information Description: A permissions issue existed in the handling of the location variable. This was addressed with additional ownership checks. CVE-2017-7148: an anonymous researcher, an anonymous researcher
Mail Drafts Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An attacker with a privileged network position may be able to intercept mail contents Description: An encryption issue existed in the handling of mail drafts. This issue was addressed with improved handling of mail drafts meant to be sent encrypted. CVE-2017-7078: an anonymous researcher, an anonymous researcher, an anonymous researcher
Mail MessageUI Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing a maliciously crafted image may lead to a denial of service Description: A memory corruption issue was addressed with improved validation. CVE-2017-7097: Xinshu Dong and Jun Hao Tan of Anquan Capital
Messages Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing a maliciously crafted image may lead to a denial of service Description: A denial of service issue was addressed through improved validation. CVE-2017-7118: Kiki Jiang and Jason Tokoph
MobileBackup Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Backup may perform an unencrypted backup despite a requirement to perform only encrypted backups Description: A permissions issue existed. This issue was addressed with improved permission validation. CVE-2017-7133: Don Sparks of HackediOS.com
Phone Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A screenshot of secure content may be taken when locking an iOS device Description: A timing issue existed in the handling of locking. This issue was addressed by disabling screenshots while locking. CVE-2017-7139: an anonymous researcher
Quick Look Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2017-13822: Australian Cyber Security Centre a Australian Signals Directorate Entry added October 31, 2017
Quick Look Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Parsing a maliciously crafted office document may lead to an unexpected application termination or arbitrary code execution Description: A memory consumption issue was addressed through improved memory handling. CVE-2017-7132: Australian Cyber Security Centre a Australian Signals Directorate Entry added October 31, 2017
Safari Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Visiting a malicious website may lead to address bar spoofing Description: An inconsistent user interface issue was addressed with improved state management. CVE-2017-7085: xisigr of Tencent's Xuanwu Lab (tencent.com)
Security Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A revoked certificate may be trusted Description: A certificate validation issue existed in the handling of revocation data. This issue was addressed through improved validation. CVE-2017-7080: an anonymous researcher, an anonymous researcher, Sven Driemecker of adesso mobile solutions gmbh, Rune Darrud (@theflyingcorpse) of BA|rum kommune
Security Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious app may be able to track users between installs Description: A permission checking issue existed in the handling of an app's Keychain data. This issue was addressed with improved permission checking. CVE-2017-7146: an anonymous researcher
SQLite Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Multiple issues in SQLite Description: Multiple issues were addressed by updating to version 3.19.3. CVE-2017-10989: found by OSS-Fuzz CVE-2017-7128: found by OSS-Fuzz CVE-2017-7129: found by OSS-Fuzz CVE-2017-7130: found by OSS-Fuzz
SQLite Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2017-7127: an anonymous researcher
Time Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: "Setting Time Zone" may incorrectly indicate that it is using location Description: A permissions issue existed in the process that handles time zone information. The issue was resolved by modifying permissions. CVE-2017-7145: an anonymous researcher
WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A memory corruption issue was addressed through improved input validation. CVE-2017-7081: Apple
WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: Multiple memory corruption issues were addressed with improved memory handling. CVE-2017-7087: Apple CVE-2017-7091: Wei Yuan of Baidu Security Lab working with Trend Micro's Zero Day Initiative CVE-2017-7092: Samuel Gro and Niklas Baumstark working with Trend Micro's Zero Day Initiative, Qixun Zhao (@S0rryMybad) of Qihoo 360 Vulcan Team CVE-2017-7093: Samuel Gro and Niklas Baumstark working with Trend Micro's Zero Day Initiative CVE-2017-7094: Tim Michaud (@TimGMichaud) of Leviathan Security Group CVE-2017-7095: Wang Junjie, Wei Lei, and Liu Yang of Nanyang Technological University working with Trend Micro's Zero Day Initiative CVE-2017-7096: Wei Yuan of Baidu Security Lab CVE-2017-7098: Felipe Freitas of Instituto TecnolA3gico de AeronA!utica CVE-2017-7099: Apple CVE-2017-7100: Masato Kinugawa and Mario Heiderich of Cure53 CVE-2017-7102: Wang Junjie, Wei Lei, and Liu Yang of Nanyang Technological University CVE-2017-7104: likemeng of Baidu Secutity Lab CVE-2017-7107: Wang Junjie, Wei Lei, and Liu Yang of Nanyang Technological University CVE-2017-7111: likemeng of Baidu Security Lab (xlab.baidu.com) working with Trend Micro's Zero Day Initiative CVE-2017-7117: lokihardt of Google Project Zero CVE-2017-7120: chenqin (ee|) of Ant-financial Light-Year Security Lab
WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to universal cross site scripting Description: A logic issue existed in the handling of the parent-tab. This issue was addressed with improved state management. CVE-2017-7089: Anton Lopanitsyn of ONSEC, Frans RosA(c)n of Detectify
WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Cookies belonging to one origin may be sent to another origin Description: A permissions issue existed in the handling of web browser cookies. This issue was addressed by no longer returning cookies for custom URL schemes. CVE-2017-7090: Apple
WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Visiting a malicious website may lead to address bar spoofing Description: An inconsistent user interface issue was addressed with improved state management. CVE-2017-7106: Oliver Paukstadt of Thinking Objects GmbH (to.com)
WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to a cross site scripting attack Description: Application Cache policy may be unexpectedly applied. CVE-2017-7109: avlidienbrunn
WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious website may be able to track users in Safari private browsing mode Description: A permissions issue existed in the handling of web browser cookies. This issue was addressed with improved restrictions. CVE-2017-7144: an anonymous researcher
Wi-Fi Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An attacker within range may be able to execute arbitrary code on the Wi-Fi chip Description: A memory corruption issue was addressed with improved memory handling. CVE-2017-11120: Gal Beniamini of Google Project Zero CVE-2017-11121: Gal Beniamini of Google Project Zero
Wi-Fi Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Malicious code executing on the Wi-Fi chip may be able to execute arbitrary code with kernel privileges on the application processor Description: A memory corruption issue was addressed with improved memory handling. CVE-2017-7103: Gal Beniamini of Google Project Zero CVE-2017-7105: Gal Beniamini of Google Project Zero CVE-2017-7108: Gal Beniamini of Google Project Zero CVE-2017-7110: Gal Beniamini of Google Project Zero CVE-2017-7112: Gal Beniamini of Google Project Zero
Wi-Fi Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Malicious code executing on the Wi-Fi chip may be able to execute arbitrary code with kernel privileges on the application processor Description: Multiple race conditions were addressed through improved validation. CVE-2017-7115: Gal Beniamini of Google Project Zero
Wi-Fi Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Malicious code executing on the Wi-Fi chip may be able to read restricted kernel memory Description: A validation issue was addressed with improved input sanitization. CVE-2017-7116: Gal Beniamini of Google Project Zero
zlib Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Multiple issues in zlib Description: Multiple issues were addressed by updating to version 1.2.11. CVE-2016-9840 CVE-2016-9841 CVE-2016-9842 CVE-2016-9843
Installation note:
This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/
iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device.
To check that the iPhone, iPod touch, or iPad has been updated:
- Navigate to Settings
- Select General
- Select About. The version after applying this update will be "11".
Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE-----
iQJdBAEBCgBHFiEEcuX4rtoRe4X62yWlg6PvjDRstEYFAln4u8QpHHByb2R1Y3Qt c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQg6PvjDRstEb3gRAA mkMtw5g6ZpDFNK4MpKwfTbwIK7rNjxEh2VGvv+1VNTJJRewGiXcbl/cf5EefPJFR RpH+8u2jjl7rgEDwRPLYY4EixRTwvOVs46MS5lzkNKjwaIhBswH6ubFIkw2MRgn9 zBbAmixTDb2HVaG2vMtmDm1PmXMq7QMau4W+G0m40bwiNBAyrqcttiiJ1NxdZsBl LouPNKhaOCLPuDeHG6oJmPRcZCyIvNpXJGE9UA/LMKL5yPbZQpqJvYBznof/SVXq QxvLw1D60Ki+2L2ItXEVAaAfkKh50+cn34m7rhb4ZIv3/hE86BpoFRGaAhni+QGJ ugJ2FYciTPnbLttpZlBYfj29BMqqkYQ1HJ+xEQf3krKiQmGKWcRV4858h2GZRGkW wwd9l1Ym4vDTNK+0yVnN58XTyOjJh/dH8t+Bzp63OUFTLiab6/3kfccozlobbivF pZWt6fFqbn/e6Re62Xj0VfxlST5TjGqxZq0qgNJiWG9s5z0To3YcDXhJSsTyjtIj cLM13UTPFAPj+ReTaA0wczvjoq4J6EyVD2bDOHv/iKY+7xOO9+5vTYGD3nhKjdAo GFBCbpCtBrrrlAd6TtW1D15QBJ+/e/5uJYd9r2BIR/w3l5I7IAnNHtYV9zu/wvuM odr7Q4DNa5UQq0VMLbsd2avIoYX+xxKQg4WUv8BbkZI= =NYhG -----END PGP SIGNATURE-----
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201709-0970",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "bcm4355c0",
"scope": "eq",
"trust": 1.8,
"vendor": "broadcom",
"version": "9.44.78.27.0.1.56"
},
{
"model": "tvos",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "11.0"
},
{
"model": "iphone os",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "11.0"
},
{
"model": "ios",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "11 (ipad air or later )"
},
{
"model": "ios",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "11 (iphone 5s or later )"
},
{
"model": "ios",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "11 (ipod touch first 6 generation )"
},
{
"model": "tvos",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "11 (apple tv first 4 generation )"
},
{
"model": "bcm4355c0 wi-fi chips",
"scope": "eq",
"trust": 0.6,
"vendor": "broadcom",
"version": "9.44.78.27.0.1.56"
},
{
"model": "tv",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "10.2.2"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "10.3.3"
},
{
"model": "galaxy s7 edge",
"scope": "eq",
"trust": 0.3,
"vendor": "samsung",
"version": "0"
},
{
"model": "android",
"scope": "eq",
"trust": 0.3,
"vendor": "google",
"version": "0"
},
{
"model": "bcm4355c0 soc",
"scope": "eq",
"trust": 0.3,
"vendor": "broadcom",
"version": "9.44.78.27.0.1.56"
},
{
"model": "tvos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.1.1"
},
{
"model": "tvos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.0.1"
},
{
"model": "tvos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.2.2"
},
{
"model": "tvos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.2.1"
},
{
"model": "tvos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.1.1"
},
{
"model": "tvos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.2"
},
{
"model": "tvos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.1"
},
{
"model": "tvos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.0"
},
{
"model": "tvos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.2.2"
},
{
"model": "tvos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.2.1"
},
{
"model": "tvos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.2"
},
{
"model": "tvos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.1"
},
{
"model": "tvos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10"
},
{
"model": "tv",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "0"
},
{
"model": "ipod touch",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "0"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "0"
},
{
"model": "ipad air",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "0"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "50"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "40"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "30"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.2.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.0.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.3.4"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.3.3"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.3.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.3.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.2.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.0.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.0.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "8.4.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.0.6"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.0.5"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.0.3"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.0.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.0.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "6.3.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "6.1.6"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "6.1.4"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "6.1.3"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.0.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.0.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.2.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.2.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.3.5"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.3"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "8.4"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "8.3"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "8.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "8.1.3"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "8.1.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "8.1.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "8.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "8"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.1.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.1.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.0.4"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "6.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "6.0.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "6.0.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "6"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5.1.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5.0.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3.5"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3.4"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3.3"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.9"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.8"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.7"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.6"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.5"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.10"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.0"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.0"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.3.3"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.3.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.3.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.3"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10"
},
{
"model": "tvos",
"scope": "ne",
"trust": 0.3,
"vendor": "apple",
"version": "11"
},
{
"model": "ios",
"scope": "ne",
"trust": 0.3,
"vendor": "apple",
"version": "11"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-03142"
},
{
"db": "BID",
"id": "100984"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008566"
},
{
"db": "CNNVD",
"id": "CNNVD-201707-297"
},
{
"db": "NVD",
"id": "CVE-2017-11120"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:broadcom:bcm4355c0_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:apple:iphone_os",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:apple:apple_tv",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-008566"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Apple",
"sources": [
{
"db": "PACKETSTORM",
"id": "144371"
},
{
"db": "PACKETSTORM",
"id": "144369"
},
{
"db": "PACKETSTORM",
"id": "144837"
},
{
"db": "PACKETSTORM",
"id": "144832"
}
],
"trust": 0.4
},
"cve": "CVE-2017-11120",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CVE-2017-11120",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.9,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CNVD-2018-03142",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "VHN-101511",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "CVE-2017-11120",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2017-11120",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "NVD",
"id": "CVE-2017-11120",
"trust": 0.8,
"value": "Critical"
},
{
"author": "CNVD",
"id": "CNVD-2018-03142",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201707-297",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-101511",
"trust": 0.1,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2017-11120",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-03142"
},
{
"db": "VULHUB",
"id": "VHN-101511"
},
{
"db": "VULMON",
"id": "CVE-2017-11120"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008566"
},
{
"db": "CNNVD",
"id": "CNNVD-201707-297"
},
{
"db": "NVD",
"id": "CVE-2017-11120"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor report frame to trigger an internal buffer overflow in the Wi-Fi firmware, aka B-V2017061204. Broadcom BCM4355C0 Wi-Fichips is a Wi-Fi chip from Broadcom. Wi-Fifirmware is the firmware used in it. A remote attacker could exploit the vulnerability to execute arbitrary code or cause a denial of service. Apple iOS and tvOS are prone to multiple arbitrary code-execution vulnerabilities. Failed exploit attempts will likely result in denial-of-service conditions. \nVersions prior to Apple tvOS 11 and iOS 11 are vulnerable. \nThese issues are being tracked by Android Bud IDs A-62575409 and A-62576413. \nCVE-2016-9840\nCVE-2016-9841\nCVE-2016-9842\nCVE-2016-9843\nEntry added September 25, 2017\n\nAdditional recognition\n\nSecurity\nWe would like to acknowledge Abhinav Bansal of Zscaler, Inc. \nfor their assistance. \n\nWebkit\nWe would like to acknowledge xisigr of Tencent\u0027s Xuanwu Lab\n(tencent.com) for their assistance. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA512\n\nAPPLE-SA-2017-10-31-9\nAdditional information for APPLE-SA-2017-09-19-1 iOS 11\n\niOS 11 addresses the following:\n\n802.1X\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: An attacker may be able to exploit weaknesses in TLS 1.0\nDescription: A protocol security issue was addressed by enabling TLS\n1.1 and TLS 1.2. \nCVE-2017-13832: an anonymous researcher\nEntry added October 31, 2017\n\nBluetooth\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: An application may be able to access restricted files\nDescription: A privacy issue existed in the handling of Contact\ncards. This was addressed with improved state management. \nCVE-2017-7131: Dominik Conrads of Federal Office for Information\nSecurity, an anonymous researcher, Elvis (@elvisimprsntr), an\nanonymous researcher\n\nCFNetwork Proxies\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: An attacker in a privileged network position may be able to\ncause a denial of service\nDescription: Multiple denial of service issues were addressed through\nimproved memory handling. \nCVE-2017-7083: Abhinav Bansal of Zscaler Inc. \n\nCFString\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: An application may be able to read restricted memory\nDescription: A validation issue was addressed with improved input\nsanitization. \nCVE-2017-13821: Australian Cyber Security Centre a Australian Signals\nDirectorate\nEntry added October 31, 2017\n\nCoreAudio\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: An application may be able to read restricted memory\nDescription: An out-of-bounds read was addressed by updating to Opus\nversion 1.1.4. \nCVE-2017-0381: V.E.O (@VYSEa) of Mobile Threat Research Team, Trend\nMicro\n\nCoreText\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: Processing a maliciously crafted font file may lead to\narbitrary code execution\nDescription: A memory consumption issue was addressed through\nimproved memory handling. \nCVE-2017-13825: Australian Cyber Security Centre a Australian Signals\nDirectorate\nEntry added October 31, 2017\n\nExchange ActiveSync\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: An attacker in a privileged network position may be able to\nerase a device during Exchange account setup\nDescription: A validation issue existed in AutoDiscover V1. This was\naddressed by requiring TLS for AutoDiscover V1. AutoDiscover V2 is\nnow supported. \nCVE-2017-7088: Ilya Nesterov, Maxim Goncharov\n\nfile\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: Multiple issues in file\nDescription: Multiple issues were addressed by updating to version\n5.31. \nCVE-2017-13815\nEntry added October 31, 2017\n\nFonts\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: Rendering untrusted text may lead to spoofing\nDescription: An inconsistent user interface issue was addressed with\nimproved state management. \nCVE-2017-13828: an anonymous researcher\nEntry added October 31, 2017\n\nHeimdal\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: An attacker in a privileged network position may be able\nto impersonate a service\nDescription: A validation issue existed in the handling of\nthe KDC-REP service name. This issue was addressed through improved\nvalidation. \nCVE-2017-11103: Jeffrey Altman, Viktor Duchovni, and Nico Williams\n\nHFS\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: An application may be able to execute arbitrary code with\nsystem privileges\nDescription: A memory corruption issue was addressed with improved\nmemory handling. \nCVE-2017-13830: Sergej Schumilo of Ruhr-University Bochum\nEntry added October 31, 2017\n\niBooks\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: Parsing a maliciously crafted iBooks file may lead to a\npersistent denial-of-service\nDescription: Multiple denial of service issues were addressed through\nimproved memory handling. \nCVE-2017-7072: JAdrzej Krysztofiak\n\nImageIO\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: Processing a maliciously crafted image may lead to arbitrary\ncode execution\nDescription: A memory corruption issue was addressed through improved\ninput validation. \nCVE-2017-13814: Australian Cyber Security Centre a Australian Signals\nDirectorate\nEntry added October 31, 2017\n\nImageIO\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: Processing a maliciously crafted image may lead to a denial\nof service\nDescription: An information disclosure issue existed in the\nprocessing of disk images. This issue was addressed through improved\nmemory management. \nCVE-2017-13831: an anonymous researcher\nEntry added October 31, 2017\n\nKernel\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: An application may be able to execute arbitrary code with\nkernel privileges\nDescription: A memory corruption issue was addressed with improved\nmemory handling. \nCVE-2017-7114: Alex Plaskett of MWR InfoSecurity\n\nKernel\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: A local user may be able to read kernel memory\nDescription: An out-of-bounds read issue existed that led to the\ndisclosure of kernel memory. This was addressed through improved\ninput validation. \nCVE-2017-13817: Maxime Villard (m00nbsd)\nEntry added October 31, 2017\n\nKernel\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: An application may be able to read restricted memory\nDescription: A validation issue was addressed with improved input\nsanitization. \nCVE-2017-13818: The UK\u0027s National Cyber Security Centre (NCSC)\nCVE-2017-13836: an anonymous researcher, an anonymous researcher\nCVE-2017-13841: an anonymous researcher\nCVE-2017-13840: an anonymous researcher\nCVE-2017-13842: an anonymous researcher\nCVE-2017-13782: Kevin Backhouse of Semmle Ltd. \nEntry added October 31, 2017\n\nKernel\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: An application may be able to execute arbitrary code with\nkernel privileges\nDescription: A memory corruption issue was addressed with improved\nmemory handling. \nCVE-2017-13843: an anonymous researcher\nEntry added October 31, 2017\n\nKernel\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: Processing a malformed mach binary may lead to arbitrary code\nexecution\nDescription: A memory corruption issue was addressed through improved\nvalidation. \nCVE-2017-13834: Maxime Villard (m00nbsd)\nEntry added October 31, 2017\n\nKeyboard Suggestions\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: Keyboard autocorrect suggestions may reveal sensitive\ninformation\nDescription: The iOS keyboard was inadvertently caching sensitive\ninformation. This issue was addressed with improved heuristics. \nCVE-2017-7140: an anonymous researcher\n\nlibarchive\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: Unpacking a maliciously crafted archive may lead to arbitrary\ncode execution\nDescription: A buffer overflow issue was addressed through improved\nmemory handling. \nCVE-2017-13813: found by OSS-Fuzz\nCVE-2017-13816: found by OSS-Fuzz\nEntry added October 31, 2017\n\nlibarchive\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: Unpacking a maliciously crafted archive may lead to arbitrary\ncode execution\nDescription: Multiple memory corruption issues existed in libarchive. \nThese issues were addressed through improved input validation. \nCVE-2017-13812: found by OSS-Fuzz\nEntry added October 31, 2017\n\nlibc\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: A remote attacker may be able to cause a denial-of-service\nDescription: A resource exhaustion issue in glob() was addressed\nthrough an improved algorithm. \nCVE-2017-7086: Russ Cox of Google\n\nlibc\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: An application may be able to cause a denial of service\nDescription: A memory consumption issue was addressed through\nimproved memory handling. \nCVE-2017-1000373\n\nlibexpat\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: Multiple issues in expat\nDescription: Multiple issues were addressed by updating to version\n2.2.1\nCVE-2016-9063\nCVE-2017-9233\n\nLocation Framework\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: An application may be able to read sensitive location\ninformation\nDescription: A permissions issue existed in the handling of the\nlocation variable. This was addressed with additional ownership\nchecks. \nCVE-2017-7148: an anonymous researcher, an anonymous researcher\n\nMail Drafts\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: An attacker with a privileged network position may be able to\nintercept mail contents\nDescription: An encryption issue existed in the handling of mail\ndrafts. This issue was addressed with improved handling of mail\ndrafts meant to be sent encrypted. \nCVE-2017-7078: an anonymous researcher, an anonymous researcher, an\nanonymous researcher\n\nMail MessageUI\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: Processing a maliciously crafted image may lead to a denial\nof service\nDescription: A memory corruption issue was addressed with improved\nvalidation. \nCVE-2017-7097: Xinshu Dong and Jun Hao Tan of Anquan Capital\n\nMessages\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: Processing a maliciously crafted image may lead to a denial\nof service\nDescription: A denial of service issue was addressed through improved\nvalidation. \nCVE-2017-7118: Kiki Jiang and Jason Tokoph\n\nMobileBackup\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: Backup may perform an unencrypted backup despite a\nrequirement to perform only encrypted backups\nDescription: A permissions issue existed. This issue was addressed\nwith improved permission validation. \nCVE-2017-7133: Don Sparks of HackediOS.com\n\nPhone\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: A screenshot of secure content may be taken when locking an\niOS device\nDescription: A timing issue existed in the handling of locking. This\nissue was addressed by disabling screenshots while locking. \nCVE-2017-7139: an anonymous researcher\n\nQuick Look\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: An application may be able to read restricted memory\nDescription: A validation issue was addressed with improved input\nsanitization. \nCVE-2017-13822: Australian Cyber Security Centre a Australian Signals\nDirectorate\nEntry added October 31, 2017\n\nQuick Look\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: Parsing a maliciously crafted office document may lead to an\nunexpected application termination or arbitrary code execution\nDescription: A memory consumption issue was addressed through\nimproved memory handling. \nCVE-2017-7132: Australian Cyber Security Centre a Australian Signals\nDirectorate\nEntry added October 31, 2017\n\nSafari\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: Visiting a malicious website may lead to address bar spoofing\nDescription: An inconsistent user interface issue was addressed with\nimproved state management. \nCVE-2017-7085: xisigr of Tencent\u0027s Xuanwu Lab (tencent.com)\n\nSecurity\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: A revoked certificate may be trusted\nDescription: A certificate validation issue existed in the handling\nof revocation data. This issue was addressed through improved\nvalidation. \nCVE-2017-7080: an anonymous researcher, an anonymous researcher,\nSven Driemecker of adesso mobile solutions gmbh,\nRune Darrud (@theflyingcorpse) of BA|rum kommune\n\nSecurity\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: A malicious app may be able to track users between installs\nDescription: A permission checking issue existed in the handling of\nan app\u0027s Keychain data. This issue was addressed with improved\npermission checking. \nCVE-2017-7146: an anonymous researcher\n\nSQLite\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: Multiple issues in SQLite\nDescription: Multiple issues were addressed by updating to\nversion 3.19.3. \nCVE-2017-10989: found by OSS-Fuzz\nCVE-2017-7128: found by OSS-Fuzz\nCVE-2017-7129: found by OSS-Fuzz\nCVE-2017-7130: found by OSS-Fuzz\n\nSQLite\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: An application may be able to execute arbitrary code with\nsystem privileges\nDescription: A memory corruption issue was addressed with improved\nmemory handling. \nCVE-2017-7127: an anonymous researcher\n\nTime\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: \"Setting Time Zone\" may incorrectly indicate that it is using\nlocation\nDescription: A permissions issue existed in the process that handles\ntime zone information. The issue was resolved by modifying\npermissions. \nCVE-2017-7145: an anonymous researcher\n\nWebKit\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: Processing maliciously crafted web content may lead to\narbitrary code execution\nDescription: A memory corruption issue was addressed through improved\ninput validation. \nCVE-2017-7081: Apple\n\nWebKit\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: Processing maliciously crafted web content may lead to\narbitrary code execution\nDescription: Multiple memory corruption issues were addressed with\nimproved memory handling. \nCVE-2017-7087: Apple\nCVE-2017-7091: Wei Yuan of Baidu Security Lab working with Trend\nMicro\u0027s Zero Day Initiative\nCVE-2017-7092: Samuel Gro and Niklas Baumstark working with Trend\nMicro\u0027s Zero Day Initiative, Qixun Zhao (@S0rryMybad) of Qihoo 360\nVulcan Team\nCVE-2017-7093: Samuel Gro and Niklas Baumstark working with Trend\nMicro\u0027s Zero Day Initiative\nCVE-2017-7094: Tim Michaud (@TimGMichaud) of Leviathan Security Group\nCVE-2017-7095: Wang Junjie, Wei Lei, and Liu Yang of Nanyang\nTechnological University working with Trend Micro\u0027s Zero Day\nInitiative\nCVE-2017-7096: Wei Yuan of Baidu Security Lab\nCVE-2017-7098: Felipe Freitas of Instituto TecnolA3gico de AeronA!utica\nCVE-2017-7099: Apple\nCVE-2017-7100: Masato Kinugawa and Mario Heiderich of Cure53\nCVE-2017-7102: Wang Junjie, Wei Lei, and Liu Yang of Nanyang\nTechnological University\nCVE-2017-7104: likemeng of Baidu Secutity Lab\nCVE-2017-7107: Wang Junjie, Wei Lei, and Liu Yang of Nanyang\nTechnological University\nCVE-2017-7111: likemeng of Baidu Security Lab (xlab.baidu.com)\nworking with Trend Micro\u0027s Zero Day Initiative\nCVE-2017-7117: lokihardt of Google Project Zero\nCVE-2017-7120: chenqin (ee|) of Ant-financial Light-Year Security\nLab\n\nWebKit\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: Processing maliciously crafted web content may lead to\nuniversal cross site scripting\nDescription: A logic issue existed in the handling of the parent-tab. \nThis issue was addressed with improved state management. \nCVE-2017-7089: Anton Lopanitsyn of ONSEC, Frans RosA(c)n of Detectify\n\nWebKit\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: Cookies belonging to one origin may be sent to another origin\nDescription: A permissions issue existed in the handling of web\nbrowser cookies. This issue was addressed by no longer returning\ncookies for custom URL schemes. \nCVE-2017-7090: Apple\n\nWebKit\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: Visiting a malicious website may lead to address bar spoofing\nDescription: An inconsistent user interface issue was addressed with\nimproved state management. \nCVE-2017-7106: Oliver Paukstadt of Thinking Objects GmbH (to.com)\n\nWebKit\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: Processing maliciously crafted web content may lead to a\ncross site scripting attack\nDescription: Application Cache policy may be unexpectedly applied. \nCVE-2017-7109: avlidienbrunn\n\nWebKit\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: A malicious website may be able to track users in Safari\nprivate browsing mode\nDescription: A permissions issue existed in the handling of web\nbrowser cookies. This issue was addressed with improved restrictions. \nCVE-2017-7144: an anonymous researcher\n\nWi-Fi\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: An attacker within range may be able to execute arbitrary\ncode on the Wi-Fi chip\nDescription: A memory corruption issue was addressed with improved\nmemory handling. \nCVE-2017-11120: Gal Beniamini of Google Project Zero\nCVE-2017-11121: Gal Beniamini of Google Project Zero\n\nWi-Fi\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: Malicious code executing on the Wi-Fi chip may be able to\nexecute arbitrary code with kernel privileges on the application\nprocessor\nDescription: A memory corruption issue was addressed with improved\nmemory handling. \nCVE-2017-7103: Gal Beniamini of Google Project Zero\nCVE-2017-7105: Gal Beniamini of Google Project Zero\nCVE-2017-7108: Gal Beniamini of Google Project Zero\nCVE-2017-7110: Gal Beniamini of Google Project Zero\nCVE-2017-7112: Gal Beniamini of Google Project Zero\n\nWi-Fi\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: Malicious code executing on the Wi-Fi chip may be able to\nexecute arbitrary code with kernel privileges on the application\nprocessor\nDescription: Multiple race conditions were addressed through improved\nvalidation. \nCVE-2017-7115: Gal Beniamini of Google Project Zero\n\nWi-Fi\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: Malicious code executing on the Wi-Fi chip may be able to\nread restricted kernel memory\nDescription: A validation issue was addressed with improved input\nsanitization. \nCVE-2017-7116: Gal Beniamini of Google Project Zero\n\nzlib\nAvailable for: iPhone 5s and later, iPad Air and later,\nand iPod touch 6th generation\nImpact: Multiple issues in zlib\nDescription: Multiple issues were addressed by updating to version\n1.2.11. \nCVE-2016-9840\nCVE-2016-9841\nCVE-2016-9842\nCVE-2016-9843\n\nInstallation note:\n\nThis update is available through iTunes and Software Update on your\niOS device, and will not appear in your computer\u0027s Software Update\napplication, or in the Apple Downloads site. Make sure you have an\nInternet connection and have installed the latest version of iTunes\nfrom https://www.apple.com/itunes/\n\niTunes and Software Update on the device will automatically check\nApple\u0027s update server on its weekly schedule. When an update is\ndetected, it is downloaded and the option to be installed is\npresented to the user when the iOS device is docked. We recommend\napplying the update immediately if possible. Selecting Don\u0027t Install\nwill present the option the next time you connect your iOS device. \n\nThe automatic update process may take up to a week depending on the\nday that iTunes or the device checks for updates. You may manually\nobtain the update via the Check for Updates button within iTunes, or\nthe Software Update on your device. \n\nTo check that the iPhone, iPod touch, or iPad has been updated:\n\n* Navigate to Settings\n* Select General\n* Select About. The version after applying this update\nwill be \"11\". \n\nInformation will also be posted to the Apple Security Updates\nweb site: https://support.apple.com/kb/HT201222\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n-----BEGIN PGP SIGNATURE-----\n\niQJdBAEBCgBHFiEEcuX4rtoRe4X62yWlg6PvjDRstEYFAln4u8QpHHByb2R1Y3Qt\nc2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQg6PvjDRstEb3gRAA\nmkMtw5g6ZpDFNK4MpKwfTbwIK7rNjxEh2VGvv+1VNTJJRewGiXcbl/cf5EefPJFR\nRpH+8u2jjl7rgEDwRPLYY4EixRTwvOVs46MS5lzkNKjwaIhBswH6ubFIkw2MRgn9\nzBbAmixTDb2HVaG2vMtmDm1PmXMq7QMau4W+G0m40bwiNBAyrqcttiiJ1NxdZsBl\nLouPNKhaOCLPuDeHG6oJmPRcZCyIvNpXJGE9UA/LMKL5yPbZQpqJvYBznof/SVXq\nQxvLw1D60Ki+2L2ItXEVAaAfkKh50+cn34m7rhb4ZIv3/hE86BpoFRGaAhni+QGJ\nugJ2FYciTPnbLttpZlBYfj29BMqqkYQ1HJ+xEQf3krKiQmGKWcRV4858h2GZRGkW\nwwd9l1Ym4vDTNK+0yVnN58XTyOjJh/dH8t+Bzp63OUFTLiab6/3kfccozlobbivF\npZWt6fFqbn/e6Re62Xj0VfxlST5TjGqxZq0qgNJiWG9s5z0To3YcDXhJSsTyjtIj\ncLM13UTPFAPj+ReTaA0wczvjoq4J6EyVD2bDOHv/iKY+7xOO9+5vTYGD3nhKjdAo\nGFBCbpCtBrrrlAd6TtW1D15QBJ+/e/5uJYd9r2BIR/w3l5I7IAnNHtYV9zu/wvuM\nodr7Q4DNa5UQq0VMLbsd2avIoYX+xxKQg4WUv8BbkZI=\n=NYhG\n-----END PGP SIGNATURE-----\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-11120"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008566"
},
{
"db": "CNVD",
"id": "CNVD-2018-03142"
},
{
"db": "BID",
"id": "100984"
},
{
"db": "VULHUB",
"id": "VHN-101511"
},
{
"db": "VULMON",
"id": "CVE-2017-11120"
},
{
"db": "PACKETSTORM",
"id": "144371"
},
{
"db": "PACKETSTORM",
"id": "144369"
},
{
"db": "PACKETSTORM",
"id": "144837"
},
{
"db": "PACKETSTORM",
"id": "144832"
}
],
"trust": 2.97
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-101511",
"trust": 0.1,
"type": "unknown"
},
{
"reference": "https://vulmon.com/exploitdetails?qidtp=exploitdb\u0026qid=42784",
"trust": 0.1,
"type": "exploit"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-101511"
},
{
"db": "VULMON",
"id": "CVE-2017-11120"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-11120",
"trust": 3.9
},
{
"db": "BID",
"id": "100984",
"trust": 2.7
},
{
"db": "PACKETSTORM",
"id": "144328",
"trust": 1.8
},
{
"db": "EXPLOIT-DB",
"id": "42784",
"trust": 1.8
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008566",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201707-297",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2018-03142",
"trust": 0.6
},
{
"db": "SEEBUG",
"id": "SSVID-96597",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-101511",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2017-11120",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "144371",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "144369",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "144837",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "144832",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-03142"
},
{
"db": "VULHUB",
"id": "VHN-101511"
},
{
"db": "VULMON",
"id": "CVE-2017-11120"
},
{
"db": "BID",
"id": "100984"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008566"
},
{
"db": "PACKETSTORM",
"id": "144371"
},
{
"db": "PACKETSTORM",
"id": "144369"
},
{
"db": "PACKETSTORM",
"id": "144837"
},
{
"db": "PACKETSTORM",
"id": "144832"
},
{
"db": "CNNVD",
"id": "CNNVD-201707-297"
},
{
"db": "NVD",
"id": "CVE-2017-11120"
}
]
},
"id": "VAR-201709-0970",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-03142"
},
{
"db": "VULHUB",
"id": "VHN-101511"
}
],
"trust": 1.46969698
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-03142"
}
]
},
"last_update_date": "2024-11-23T20:01:29.534000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Android Security Bulletin-September 2017",
"trust": 0.8,
"url": "https://source.android.com/security/bulletin/2017-09-01"
},
{
"title": "HT208112",
"trust": 0.8,
"url": "https://support.apple.com/en-us/HT208112"
},
{
"title": "HT208113",
"trust": 0.8,
"url": "https://support.apple.com/en-us/HT208113"
},
{
"title": "HT208112",
"trust": 0.8,
"url": "https://support.apple.com/ja-jp/HT208112"
},
{
"title": "HT208113",
"trust": 0.8,
"url": "https://support.apple.com/ja-jp/HT208113"
},
{
"title": "Top Page",
"trust": 0.8,
"url": "https://www.broadcom.com/"
},
{
"title": "BroadcomBCM4355C0 Wi-Fi Chip Wi-Fi Firmware Buffer Overflow Vulnerability Patch",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/116281"
},
{
"title": "Broadcom BCM4355C0 Wi-Fi chip Wi-Fi Fixes for firmware buffer error vulnerability",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=90656"
},
{
"title": "Apple: tvOS 11",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories\u0026qid=74de8bbddd443742d386dabda32dc2ae"
},
{
"title": "Apple: iOS 11",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories\u0026qid=041cce4eee20b18dc79e9460a53e8400"
},
{
"title": "Android Security Bulletins: Android Security Bulletin\u2014September 2017",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=android_security_bulletins\u0026qid=45d9f825c1db6d21aee6f02c00c607a0"
},
{
"title": "Exp101tsArchiv30thers",
"trust": 0.1,
"url": "https://github.com/nu11secur1ty/Exp101tsArchiv30thers "
},
{
"title": "awesome-cve-poc_qazbnm456",
"trust": 0.1,
"url": "https://github.com/xbl3/awesome-cve-poc_qazbnm456 "
},
{
"title": "Threatpost",
"trust": 0.1,
"url": "https://threatpost.com/lenovo-warns-critical-wifi-vulnerability-impacts-dozens-of-thinkpad-models/129860/"
},
{
"title": "Threatpost",
"trust": 0.1,
"url": "https://threatpost.com/remote-wi-fi-attack-backdoors-iphone-7/128163/"
},
{
"title": "BleepingComputer",
"trust": 0.1,
"url": "https://www.bleepingcomputer.com/news/security/proof-of-concept-exploit-code-published-for-remote-iphone-7-wifi-hack/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-03142"
},
{
"db": "VULMON",
"id": "CVE-2017-11120"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008566"
},
{
"db": "CNNVD",
"id": "CNNVD-201707-297"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-119",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-101511"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008566"
},
{
"db": "NVD",
"id": "CVE-2017-11120"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "http://www.securityfocus.com/bid/100984"
},
{
"trust": 2.1,
"url": "https://lists.apple.com/archives/security-announce/2017/sep/msg00009.html"
},
{
"trust": 2.1,
"url": "https://lists.apple.com/archives/security-announce/2017/sep/msg00007.html"
},
{
"trust": 2.1,
"url": "https://source.android.com/security/bulletin/2017-09-01"
},
{
"trust": 2.1,
"url": "https://bugs.chromium.org/p/project-zero/issues/detail?id=1289"
},
{
"trust": 1.9,
"url": "https://www.exploit-db.com/exploits/42784/"
},
{
"trust": 1.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-11120"
},
{
"trust": 1.8,
"url": "https://support.apple.com/ht208112"
},
{
"trust": 1.8,
"url": "https://support.apple.com/ht208113"
},
{
"trust": 1.8,
"url": "https://support.apple.com/en-us/ht208112"
},
{
"trust": 1.8,
"url": "https://support.apple.com/en-us/ht208113"
},
{
"trust": 1.8,
"url": "http://packetstormsecurity.com/files/144328/broadcom-802.11k-neighbor-report-response-out-of-bounds-write.html"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-11120"
},
{
"trust": 0.4,
"url": "https://support.apple.com/kb/ht201222"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-10989"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-0381"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-9842"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-1000373"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-11121"
},
{
"trust": 0.4,
"url": "https://www.apple.com/support/security/pgp/"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-9840"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-9063"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-9841"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-9843"
},
{
"trust": 0.3,
"url": "https://www.apple.com/"
},
{
"trust": 0.3,
"url": "http://www.apple.com/ios/"
},
{
"trust": 0.3,
"url": "http://www.apple.com/accessibility/tvos/"
},
{
"trust": 0.3,
"url": "https://bugs.chromium.org/p/project-zero/issues/detail?id=1291"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-7091"
},
{
"trust": 0.2,
"url": "https://gpgtools.org"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-7080"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-7094"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-7083"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-7093"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-7090"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-7087"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-7092"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-7081"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-7096"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-7086"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-7095"
},
{
"trust": 0.2,
"url": "https://www.apple.com/itunes/"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-11103"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-13782"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-13817"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-13831"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-13832"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-13830"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-13828"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-13814"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-13822"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-13825"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-13816"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-13834"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-13818"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-13813"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-13812"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-13815"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/119.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://threatpost.com/remote-wi-fi-attack-backdoors-iphone-7/128163/"
},
{
"trust": 0.1,
"url": "https://support.apple.com/kb/ht208113"
},
{
"trust": 0.1,
"url": "https://source.android.com/security/bulletin/2017-09-01.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-7104"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-7098"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-7103"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-7100"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-7102"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-7099"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-7072"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-7078"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-7085"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-7089"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-7088"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-13836"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-13840"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-13821"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-03142"
},
{
"db": "VULHUB",
"id": "VHN-101511"
},
{
"db": "VULMON",
"id": "CVE-2017-11120"
},
{
"db": "BID",
"id": "100984"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008566"
},
{
"db": "PACKETSTORM",
"id": "144371"
},
{
"db": "PACKETSTORM",
"id": "144369"
},
{
"db": "PACKETSTORM",
"id": "144837"
},
{
"db": "PACKETSTORM",
"id": "144832"
},
{
"db": "CNNVD",
"id": "CNNVD-201707-297"
},
{
"db": "NVD",
"id": "CVE-2017-11120"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2018-03142"
},
{
"db": "VULHUB",
"id": "VHN-101511"
},
{
"db": "VULMON",
"id": "CVE-2017-11120"
},
{
"db": "BID",
"id": "100984"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-008566"
},
{
"db": "PACKETSTORM",
"id": "144371"
},
{
"db": "PACKETSTORM",
"id": "144369"
},
{
"db": "PACKETSTORM",
"id": "144837"
},
{
"db": "PACKETSTORM",
"id": "144832"
},
{
"db": "CNNVD",
"id": "CNNVD-201707-297"
},
{
"db": "NVD",
"id": "CVE-2017-11120"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-02-11T00:00:00",
"db": "CNVD",
"id": "CNVD-2018-03142"
},
{
"date": "2017-09-28T00:00:00",
"db": "VULHUB",
"id": "VHN-101511"
},
{
"date": "2017-09-28T00:00:00",
"db": "VULMON",
"id": "CVE-2017-11120"
},
{
"date": "2017-09-25T00:00:00",
"db": "BID",
"id": "100984"
},
{
"date": "2017-10-24T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-008566"
},
{
"date": "2017-09-28T00:23:30",
"db": "PACKETSTORM",
"id": "144371"
},
{
"date": "2017-09-28T00:19:32",
"db": "PACKETSTORM",
"id": "144369"
},
{
"date": "2017-11-01T16:15:56",
"db": "PACKETSTORM",
"id": "144837"
},
{
"date": "2017-11-01T15:51:56",
"db": "PACKETSTORM",
"id": "144832"
},
{
"date": "2017-07-10T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201707-297"
},
{
"date": "2017-09-28T01:29:01.043000",
"db": "NVD",
"id": "CVE-2017-11120"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-02-11T00:00:00",
"db": "CNVD",
"id": "CNVD-2018-03142"
},
{
"date": "2019-03-13T00:00:00",
"db": "VULHUB",
"id": "VHN-101511"
},
{
"date": "2019-03-13T00:00:00",
"db": "VULMON",
"id": "CVE-2017-11120"
},
{
"date": "2017-09-27T08:00:00",
"db": "BID",
"id": "100984"
},
{
"date": "2017-10-24T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-008566"
},
{
"date": "2019-03-13T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201707-297"
},
{
"date": "2024-11-21T03:07:08.643000",
"db": "NVD",
"id": "CVE-2017-11120"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201707-297"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Broadcom BCM4355C0 Wi-Fi Such as chips Wi-Fi Internal buffer error vulnerability in firmware",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-008566"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201707-297"
}
],
"trust": 0.6
}
}
CVE-2017-11122 (GCVE-0-2017-11122)
Vulnerability from cvelistv5
- n/a
| ▼ | URL | Tags |
|---|---|---|
| http://packetstormsecurity.com/files/144461/Broadcom-ICMPv6-Information-Leak.html | x_refsource_MISC | |
| https://support.apple.com/en-us/HT208113 | x_refsource_CONFIRM | |
| https://support.apple.com/en-us/HT208112 | x_refsource_CONFIRM | |
| https://bugs.chromium.org/p/project-zero/issues/detail?id=1300 | x_refsource_MISC | |
| https://support.apple.com/HT208113 | x_refsource_CONFIRM | |
| https://support.apple.com/HT208112 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T17:57:57.974Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/144461/Broadcom-ICMPv6-Information-Leak.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://support.apple.com/en-us/HT208113"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://support.apple.com/en-us/HT208112"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://bugs.chromium.org/p/project-zero/issues/detail?id=1300"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://support.apple.com/HT208113"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://support.apple.com/HT208112"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2017-10-02T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56, an attacker can trigger an information leak due to insufficient length validation, related to ICMPv6 router advertisement offloading."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-10-23T00:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/144461/Broadcom-ICMPv6-Information-Leak.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://support.apple.com/en-us/HT208113"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://support.apple.com/en-us/HT208112"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://bugs.chromium.org/p/project-zero/issues/detail?id=1300"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://support.apple.com/HT208113"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://support.apple.com/HT208112"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-11122",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56, an attacker can trigger an information leak due to insufficient length validation, related to ICMPv6 router advertisement offloading."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://packetstormsecurity.com/files/144461/Broadcom-ICMPv6-Information-Leak.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/144461/Broadcom-ICMPv6-Information-Leak.html"
},
{
"name": "https://support.apple.com/en-us/HT208113",
"refsource": "CONFIRM",
"url": "https://support.apple.com/en-us/HT208113"
},
{
"name": "https://support.apple.com/en-us/HT208112",
"refsource": "CONFIRM",
"url": "https://support.apple.com/en-us/HT208112"
},
{
"name": "https://bugs.chromium.org/p/project-zero/issues/detail?id=1300",
"refsource": "MISC",
"url": "https://bugs.chromium.org/p/project-zero/issues/detail?id=1300"
},
{
"name": "https://support.apple.com/HT208113",
"refsource": "CONFIRM",
"url": "https://support.apple.com/HT208113"
},
{
"name": "https://support.apple.com/HT208112",
"refsource": "CONFIRM",
"url": "https://support.apple.com/HT208112"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-11122",
"datePublished": "2017-10-04T00:00:00",
"dateReserved": "2017-07-09T00:00:00",
"dateUpdated": "2024-08-05T17:57:57.974Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-11121 (GCVE-0-2017-11121)
Vulnerability from cvelistv5
- n/a
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/100984 | vdb-entry, x_refsource_BID | |
| https://source.android.com/security/bulletin/2017-09-01 | x_refsource_CONFIRM | |
| https://lists.apple.com/archives/security-announce/2017/Sep/msg00009.html | vendor-advisory, x_refsource_APPLE | |
| https://lists.apple.com/archives/security-announce/2017/Sep/msg00007.html | vendor-advisory, x_refsource_APPLE | |
| http://packetstormsecurity.com/files/144329/Broadcom-802.11r-FT-Reassociation-Response-Overflows.html | x_refsource_MISC | |
| https://support.apple.com/en-us/HT208113 | x_refsource_CONFIRM | |
| https://bugs.chromium.org/p/project-zero/issues/detail?id=1291 | x_refsource_MISC | |
| https://support.apple.com/en-us/HT208112 | x_refsource_CONFIRM | |
| https://support.apple.com/HT208113 | x_refsource_CONFIRM | |
| https://support.apple.com/HT208112 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T17:57:57.981Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "100984",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/100984"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://source.android.com/security/bulletin/2017-09-01"
},
{
"name": "APPLE-SA-2017-09-25-4",
"tags": [
"vendor-advisory",
"x_refsource_APPLE",
"x_transferred"
],
"url": "https://lists.apple.com/archives/security-announce/2017/Sep/msg00009.html"
},
{
"name": "APPLE-SA-2017-09-25-6",
"tags": [
"vendor-advisory",
"x_refsource_APPLE",
"x_transferred"
],
"url": "https://lists.apple.com/archives/security-announce/2017/Sep/msg00007.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/144329/Broadcom-802.11r-FT-Reassociation-Response-Overflows.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://support.apple.com/en-us/HT208113"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://bugs.chromium.org/p/project-zero/issues/detail?id=1291"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://support.apple.com/en-us/HT208112"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://support.apple.com/HT208113"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://support.apple.com/HT208112"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2017-09-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, properly crafted malicious over-the-air Fast Transition frames can potentially trigger internal Wi-Fi firmware heap and/or stack overflows, leading to denial of service or other effects, aka B-V2017061205."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-10-23T00:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "100984",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/100984"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://source.android.com/security/bulletin/2017-09-01"
},
{
"name": "APPLE-SA-2017-09-25-4",
"tags": [
"vendor-advisory",
"x_refsource_APPLE"
],
"url": "https://lists.apple.com/archives/security-announce/2017/Sep/msg00009.html"
},
{
"name": "APPLE-SA-2017-09-25-6",
"tags": [
"vendor-advisory",
"x_refsource_APPLE"
],
"url": "https://lists.apple.com/archives/security-announce/2017/Sep/msg00007.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/144329/Broadcom-802.11r-FT-Reassociation-Response-Overflows.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://support.apple.com/en-us/HT208113"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://bugs.chromium.org/p/project-zero/issues/detail?id=1291"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://support.apple.com/en-us/HT208112"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://support.apple.com/HT208113"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://support.apple.com/HT208112"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-11121",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, properly crafted malicious over-the-air Fast Transition frames can potentially trigger internal Wi-Fi firmware heap and/or stack overflows, leading to denial of service or other effects, aka B-V2017061205."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "100984",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/100984"
},
{
"name": "https://source.android.com/security/bulletin/2017-09-01",
"refsource": "CONFIRM",
"url": "https://source.android.com/security/bulletin/2017-09-01"
},
{
"name": "APPLE-SA-2017-09-25-4",
"refsource": "APPLE",
"url": "https://lists.apple.com/archives/security-announce/2017/Sep/msg00009.html"
},
{
"name": "APPLE-SA-2017-09-25-6",
"refsource": "APPLE",
"url": "https://lists.apple.com/archives/security-announce/2017/Sep/msg00007.html"
},
{
"name": "http://packetstormsecurity.com/files/144329/Broadcom-802.11r-FT-Reassociation-Response-Overflows.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/144329/Broadcom-802.11r-FT-Reassociation-Response-Overflows.html"
},
{
"name": "https://support.apple.com/en-us/HT208113",
"refsource": "CONFIRM",
"url": "https://support.apple.com/en-us/HT208113"
},
{
"name": "https://bugs.chromium.org/p/project-zero/issues/detail?id=1291",
"refsource": "MISC",
"url": "https://bugs.chromium.org/p/project-zero/issues/detail?id=1291"
},
{
"name": "https://support.apple.com/en-us/HT208112",
"refsource": "CONFIRM",
"url": "https://support.apple.com/en-us/HT208112"
},
{
"name": "https://support.apple.com/HT208113",
"refsource": "CONFIRM",
"url": "https://support.apple.com/HT208113"
},
{
"name": "https://support.apple.com/HT208112",
"refsource": "CONFIRM",
"url": "https://support.apple.com/HT208112"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-11121",
"datePublished": "2017-09-27T17:00:00",
"dateReserved": "2017-07-09T00:00:00",
"dateUpdated": "2024-08-05T17:57:57.981Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-11120 (GCVE-0-2017-11120)
Vulnerability from cvelistv5
- n/a
| ▼ | URL | Tags |
|---|---|---|
| http://packetstormsecurity.com/files/144328/Broadcom-802.11k-Neighbor-Report-Response-Out-Of-Bounds-Write.html | x_refsource_MISC | |
| http://www.securityfocus.com/bid/100984 | vdb-entry, x_refsource_BID | |
| https://source.android.com/security/bulletin/2017-09-01 | x_refsource_CONFIRM | |
| https://lists.apple.com/archives/security-announce/2017/Sep/msg00009.html | vendor-advisory, x_refsource_APPLE | |
| https://www.exploit-db.com/exploits/42784/ | exploit, x_refsource_EXPLOIT-DB | |
| https://lists.apple.com/archives/security-announce/2017/Sep/msg00007.html | vendor-advisory, x_refsource_APPLE | |
| https://bugs.chromium.org/p/project-zero/issues/detail?id=1289 | x_refsource_MISC | |
| https://support.apple.com/en-us/HT208113 | x_refsource_CONFIRM | |
| https://support.apple.com/en-us/HT208112 | x_refsource_CONFIRM | |
| https://support.apple.com/HT208113 | x_refsource_CONFIRM | |
| https://support.apple.com/HT208112 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T17:57:58.033Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/144328/Broadcom-802.11k-Neighbor-Report-Response-Out-Of-Bounds-Write.html"
},
{
"name": "100984",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/100984"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://source.android.com/security/bulletin/2017-09-01"
},
{
"name": "APPLE-SA-2017-09-25-4",
"tags": [
"vendor-advisory",
"x_refsource_APPLE",
"x_transferred"
],
"url": "https://lists.apple.com/archives/security-announce/2017/Sep/msg00009.html"
},
{
"name": "42784",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/42784/"
},
{
"name": "APPLE-SA-2017-09-25-6",
"tags": [
"vendor-advisory",
"x_refsource_APPLE",
"x_transferred"
],
"url": "https://lists.apple.com/archives/security-announce/2017/Sep/msg00007.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://bugs.chromium.org/p/project-zero/issues/detail?id=1289"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://support.apple.com/en-us/HT208113"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://support.apple.com/en-us/HT208112"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://support.apple.com/HT208113"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://support.apple.com/HT208112"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2017-09-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor report frame to trigger an internal buffer overflow in the Wi-Fi firmware, aka B-V2017061204."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-10-23T00:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/144328/Broadcom-802.11k-Neighbor-Report-Response-Out-Of-Bounds-Write.html"
},
{
"name": "100984",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/100984"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://source.android.com/security/bulletin/2017-09-01"
},
{
"name": "APPLE-SA-2017-09-25-4",
"tags": [
"vendor-advisory",
"x_refsource_APPLE"
],
"url": "https://lists.apple.com/archives/security-announce/2017/Sep/msg00009.html"
},
{
"name": "42784",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/42784/"
},
{
"name": "APPLE-SA-2017-09-25-6",
"tags": [
"vendor-advisory",
"x_refsource_APPLE"
],
"url": "https://lists.apple.com/archives/security-announce/2017/Sep/msg00007.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://bugs.chromium.org/p/project-zero/issues/detail?id=1289"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://support.apple.com/en-us/HT208113"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://support.apple.com/en-us/HT208112"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://support.apple.com/HT208113"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://support.apple.com/HT208112"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-11120",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor report frame to trigger an internal buffer overflow in the Wi-Fi firmware, aka B-V2017061204."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://packetstormsecurity.com/files/144328/Broadcom-802.11k-Neighbor-Report-Response-Out-Of-Bounds-Write.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/144328/Broadcom-802.11k-Neighbor-Report-Response-Out-Of-Bounds-Write.html"
},
{
"name": "100984",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/100984"
},
{
"name": "https://source.android.com/security/bulletin/2017-09-01",
"refsource": "CONFIRM",
"url": "https://source.android.com/security/bulletin/2017-09-01"
},
{
"name": "APPLE-SA-2017-09-25-4",
"refsource": "APPLE",
"url": "https://lists.apple.com/archives/security-announce/2017/Sep/msg00009.html"
},
{
"name": "42784",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/42784/"
},
{
"name": "APPLE-SA-2017-09-25-6",
"refsource": "APPLE",
"url": "https://lists.apple.com/archives/security-announce/2017/Sep/msg00007.html"
},
{
"name": "https://bugs.chromium.org/p/project-zero/issues/detail?id=1289",
"refsource": "MISC",
"url": "https://bugs.chromium.org/p/project-zero/issues/detail?id=1289"
},
{
"name": "https://support.apple.com/en-us/HT208113",
"refsource": "CONFIRM",
"url": "https://support.apple.com/en-us/HT208113"
},
{
"name": "https://support.apple.com/en-us/HT208112",
"refsource": "CONFIRM",
"url": "https://support.apple.com/en-us/HT208112"
},
{
"name": "https://support.apple.com/HT208113",
"refsource": "CONFIRM",
"url": "https://support.apple.com/HT208113"
},
{
"name": "https://support.apple.com/HT208112",
"refsource": "CONFIRM",
"url": "https://support.apple.com/HT208112"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-11120",
"datePublished": "2017-09-27T17:00:00",
"dateReserved": "2017-07-09T00:00:00",
"dateUpdated": "2024-08-05T17:57:58.033Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}