var-201405-0236
Vulnerability from variot
WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1. Apple Safari Used in etc. WebKit is prone to multiple unspecified memory-corruption vulnerabilities. An attacker may exploit these issues by enticing victims into viewing a malicious webpage. Successful exploits may allow attackers to execute arbitrary code in the context of the affected browser or cause denial-of-service conditions; other attacks may also be possible. WebKit is a set of open source web browser engines jointly developed by companies such as KDE, Apple (Apple), and Google (Google), and is currently used by browsers such as Apple Safari and Google Chrome. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
APPLE-SA-2014-06-30-3 iOS 7.1.2
iOS 7.1.2 is now available and addresses the following:
Certificate Trust Policy Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Update to the certificate trust policy Description: The certificate trust policy was updated. The complete list of certificates may be viewed at http://support.apple.com/kb/HT5012.
CoreGraphics Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Viewing a maliciously crafted XBM file may lead to an unexpected application termination or arbitrary code execution Description: An unbounded stack allocation issue existed in the handling of XBM files. This issue was addressed through improved bounds checking. CVE-ID CVE-2014-1354 : Dima Kovalenko of codedigging.com
Kernel Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: An application could cause the device to unexpectedly restart Description: A null pointer dereference existed in the handling of IOKit API arguments. This issue was addressed through additional validation of IOKit API arguments. CVE-ID CVE-2014-1355 : cunzhang from Adlab of Venustech
launchd Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A malicious application may be able to execute arbitrary code with system privileges Description: A heap buffer overflow existed in launchd's handling of IPC messages. This issue was addressed through improved bounds checking. CVE-ID CVE-2014-1356 : Ian Beer of Google Project Zero
launchd Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A malicious application may be able to execute arbitrary code with system privileges Description: A heap buffer overflow existed in launchd's handling of log messages. This issue was addressed through improved bounds checking. CVE-ID CVE-2014-1357 : Ian Beer of Google Project Zero
launchd Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A malicious application may be able to execute arbitrary code with system privileges Description: An integer overflow existed in launchd. This issue was addressed through improved bounds checking. CVE-ID CVE-2014-1358 : Ian Beer of Google Project Zero
launchd Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A malicious application may be able to execute arbitrary code with system privileges Description: An integer underflow existed in launchd. This issue was addressed through improved bounds checking. CVE-ID CVE-2014-1359 : Ian Beer of Google Project Zero
Lockdown Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: An attacker possessing an iOS device could potentially bypass Activation Lock Description: Devices were performing incomplete checks during device activation, which made it possible for malicious individuals to partially bypass Activation Lock. This issue was addressed through additional client-side verification of data received from activation servers. CVE-ID CVE-2014-1360
Lock Screen Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: An attacker in possession of a device may exceed the maximum number of failed passcode attempts Description: In some circumstances, the failed passcode attempt limit was not enforced. This issue was addressed through additional enforcement of this limit. CVE-ID CVE-2014-1352 : mblsec
Lock Screen Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A person with physical access to a locked device may be able to access the application that was in the foreground prior to locking Description: A state management issue existed in the handling of the telephony state while in Airplane Mode. This issue was addressed through improved state management while in Airplane Mode. CVE-ID CVE-2014-1353
Mail Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Mail attachments can be extracted from an iPhone 4 Description: Data protection was not enabled for mail attachments, allowing them to be read by an attacker with physical access to the device. This issue was addressed by changing the encryption class of mail attachments. CVE-ID CVE-2014-1348 : Andreas Kurtz of NESO Security Labs
Safari Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution Description: A use after free issue existed in Safari's handling of invalid URLs. This issue was addressed through improved memory handling. CVE-ID CVE-2014-1349 : Reno Robert and Dhanesh Kizhakkinan
Settings Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A person with physical access to the device may be able to disable Find My iPhone without entering an iCloud password Description: A state management issue existed in the handling of the Find My iPhone state. This issue was addressed through improved handling of Find My iPhone state. CVE-ID CVE-2014-1350
Secure Transport Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Two bytes of uninitialized memory could be disclosed to a remote attacker Description: An uninitialized memory access issue existed in the handling of DTLS messages in a TLS connection. This issue was addressed by only accepting DTLS messages in a DTLS connection. CVE-ID CVE-2014-1361 : Thijs Alkemade of The Adium Project
Siri Available for: iPhone 4S and later, iPod touch (5th generation) and later, iPad (3rd generation) and later Impact: A person with physical access to the phone may be able to view all contacts Description: If a Siri request might refer to one of several contacts, Siri displays a list of possible choices and the option 'More...' for a complete contact list. When used at the lock screen, Siri did not require the passcode before viewing the complete contact list. This issue was addressed by requiring the passcode. CVE-ID CVE-2014-1351 : Sherif Hashim
WebKit Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues existed in WebKit. These issues were addressed through improved memory handling. CVE-ID CVE-2013-2875 : miaubiz CVE-2013-2927 : cloudfuzzer CVE-2014-1323 : banty CVE-2014-1325 : Apple CVE-2014-1326 : Apple CVE-2014-1327 : Google Chrome Security Team, Apple CVE-2014-1329 : Google Chrome Security Team CVE-2014-1330 : Google Chrome Security Team CVE-2014-1331 : cloudfuzzer CVE-2014-1333 : Google Chrome Security Team CVE-2014-1334 : Apple CVE-2014-1335 : Google Chrome Security Team CVE-2014-1336 : Apple CVE-2014-1337 : Apple CVE-2014-1338 : Google Chrome Security Team CVE-2014-1339 : Atte Kettunen of OUSPG CVE-2014-1341 : Google Chrome Security Team CVE-2014-1342 : Apple CVE-2014-1343 : Google Chrome Security Team CVE-2014-1362 : Apple, miaubiz CVE-2014-1363 : Apple CVE-2014-1364 : Apple CVE-2014-1365 : Apple, Google Chrome Security Team CVE-2014-1366 : Apple CVE-2014-1367 : Apple CVE-2014-1368 : Wushi of Keen Team (Research Team of Keen Cloud Tech) CVE-2014-1382 : Renata Hodovan of University of Szeged / Samsung Electronics CVE-2014-1731 : an anonymous member of the Blink development community
WebKit Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A malicious site can send messages to a connected frame or window in a way that might circumvent the receiver's origin check Description: An encoding issue existed in the handling of unicode characters in URLs. A maliciously crafted URL could have led to sending an incorrect postMessage origin. This issue was addressed through improved encoding/decoding. CVE-ID CVE-2014-1346 : Erling Ellingsen of Facebook
WebKit Available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A maliciously crafted website may be able to spoof its domain name in the address bar Description: A spoofing issue existed in the handling of URLs. This issue was addressed through improved encoding of URLs. CVE-ID CVE-2014-1345 : Erling Ellingsen of Facebook
Installation note:
This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from www.apple.com/itunes/
iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device.
To check that the iPhone, iPod touch, or iPad has been updated:
- Navigate to Settings
- Select General
- Select About. The version after applying this update will be "7.1.2".
Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222
This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.22 (Darwin) Comment: GPGTools - http://gpgtools.org
iQIcBAEBAgAGBQJTsaK7AAoJEBcWfLTuOo7tfX8QAI3gb917qsoyNIRVPy3hRq3v n6JJM2HBMiFuupE3cbaA0Kx0Gmyxdbdl0EFOjU0uTCqS3kutB/9/nTTZaRtWDS2I pvZnvisGW5NeVD6F+WcRuR1ifLG1fihYWbLfsORV4iLl62FLae5kOWG1Z/RNW6xY uAXEkq5mGRuEkYOD+nmvZoZMZkVcEqXassa+PpZVphkNvAPWE799sIfEeQUB8e3d E4ZRAYBbM3peZHJKRafENhrYS4BFl92lQYfh10o/9eC8HIJ5Qo1JBLkzZi8D+z/2 RaUcGhyzgMCuQZBGdwQ8rAF6dn5A7y4TnRs7EpPp7cNe+OofkOO1Ya0rs3IRx/ds V+vmnZrQw38YIfG45tQpO8MYrRivJNjmrQWHeuKyAfXxtAdTdmnOOVYJZvy5cklX IbwBziUHuiNi666Vqf+Abwl2FUx4ksrxtnvojY5SPOxhyJR34Ex15QVojOTD2pqp qyVNpy3l+5G/6kBPzDKhXJ3kOVjlO9MZerOK9hQekn80A5B0dKbNdCwehXGSkL9d WxrA+CPva3pryc75h1x740w8KiP4pr0p1sZKjZCRIR103A2F8/NFK3M7JgJSbDrR PKoWqou+oPP98gdRHwZxdwLaGSj/fJFBysIlUnVG2Q/UnM5g2MZXCL6JSg+PWETH DpRuZyHlmSF53n37vSR/ =JmVc -----END PGP SIGNATURE-----
. CVE-ID CVE-2014-1346 : Erling Ellingsen of Facebook
For OS X Mavericks and OS X Mountain Lion systems, Safari 7.0.4 and Safari 6.1.4 may be obtained from Mac App Store
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", "affected_products": { "@id": "https://www.variotdbs.pl/ref/affected_products" }, "configurations": { "@id": "https://www.variotdbs.pl/ref/configurations" }, "credits": { "@id": "https://www.variotdbs.pl/ref/credits" }, "cvss": { "@id": "https://www.variotdbs.pl/ref/cvss/" }, "description": { "@id": "https://www.variotdbs.pl/ref/description/" }, "exploit_availability": { "@id": "https://www.variotdbs.pl/ref/exploit_availability/" }, "external_ids": { "@id": "https://www.variotdbs.pl/ref/external_ids/" }, "iot": { "@id": "https://www.variotdbs.pl/ref/iot/" }, "iot_taxonomy": { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/" }, "patch": { "@id": "https://www.variotdbs.pl/ref/patch/" }, "problemtype_data": { "@id": "https://www.variotdbs.pl/ref/problemtype_data/" }, "references": { "@id": "https://www.variotdbs.pl/ref/references/" }, "sources": { "@id": "https://www.variotdbs.pl/ref/sources/" }, "sources_release_date": { "@id": "https://www.variotdbs.pl/ref/sources_release_date/" }, "sources_update_date": { "@id": "https://www.variotdbs.pl/ref/sources_update_date/" }, "threat_type": { "@id": "https://www.variotdbs.pl/ref/threat_type/" }, "title": { "@id": "https://www.variotdbs.pl/ref/title/" }, "type": { "@id": "https://www.variotdbs.pl/ref/type/" } }, "@id": "https://www.variotdbs.pl/vuln/VAR-201405-0236", "affected_products": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "model": "safari", "scope": "eq", "trust": 1.6, "vendor": "apple", "version": "7.0.1" }, { "model": "safari", "scope": "eq", "trust": 1.6, "vendor": "apple", "version": "7.0.2" }, { "model": "safari", "scope": "eq", "trust": 1.6, "vendor": "apple", "version": "6.1" }, { "model": "safari", "scope": "eq", "trust": 1.6, "vendor": "apple", "version": "7.0.3" }, { "model": "safari", "scope": "eq", "trust": 1.6, "vendor": "apple", "version": "7.0" }, { "model": "safari", "scope": "eq", "trust": 1.6, "vendor": "apple", "version": "6.0.2" }, { "model": "safari", "scope": "eq", "trust": 1.6, "vendor": "apple", "version": "6.0.1" }, { "model": "safari", "scope": "eq", "trust": 1.6, "vendor": "apple", "version": "6.0" }, { "model": "safari", "scope": "eq", "trust": 1.6, "vendor": "apple", "version": "6.1.1" }, { "model": "safari", "scope": "eq", "trust": 1.6, "vendor": "apple", "version": "6.1.2" }, { "model": "safari", "scope": "eq", "trust": 1.0, "vendor": "apple", "version": "6.0.4" }, { "model": "safari", "scope": "eq", "trust": 1.0, "vendor": "apple", "version": "6.0.5" }, { "model": "safari", "scope": "lte", "trust": 1.0, "vendor": "apple", "version": "6.1.3" }, { "model": "safari", "scope": "eq", "trust": 1.0, "vendor": "apple", "version": "6.0.3" }, { "model": "itunes", "scope": "lt", "trust": 0.8, "vendor": "apple", "version": "(windows)" }, { "model": "tv", "scope": "lt", "trust": 0.8, "vendor": "apple", "version": "(apple tv first 2 after generation )" }, { "model": "safari", "scope": "eq", "trust": 0.8, "vendor": "apple", "version": "7.0.4" }, { "model": "safari", "scope": "lt", "trust": 0.8, "vendor": "apple", "version": "7.x (os x mavericks v10.9.3)" }, { "model": "ios", "scope": "eq", "trust": 0.8, "vendor": "apple", "version": "7.1.2" }, { "model": "ios", "scope": "lt", "trust": 0.8, "vendor": "apple", "version": "(ipad 2 or later )" }, { "model": "safari", "scope": "eq", "trust": 0.8, "vendor": "apple", "version": "6.1.4" }, { "model": "safari", "scope": "lt", "trust": 0.8, "vendor": "apple", "version": "(os x mountain lion v10.8.5)" }, { "model": "tv", "scope": "eq", "trust": 0.8, "vendor": "apple", "version": "6.2" }, { "model": "safari", "scope": "lt", "trust": 0.8, "vendor": "apple", "version": "7.x (os x lion v10.7.5)" }, { "model": "safari", "scope": "lt", "trust": 0.8, "vendor": "apple", "version": "7.x (os x mountain lion v10.8.5)" }, { "model": "ios", "scope": "lt", "trust": 0.8, "vendor": "apple", "version": "(ipod touch first 5 after generation )" }, { "model": "safari", "scope": "lt", "trust": 0.8, "vendor": "apple", "version": "(os x mavericks v10.9.3)" }, { "model": "safari", "scope": "lt", "trust": 0.8, "vendor": "apple", "version": "7.x (os x lion server v10.7.5)" }, { "model": "safari", "scope": "lt", "trust": 0.8, "vendor": "apple", "version": "(os x lion server v10.7.5)" }, { "model": "ios", "scope": "lt", "trust": 0.8, "vendor": "apple", "version": "(iphone 4 or later )" }, { "model": "safari", "scope": "lt", "trust": 0.8, "vendor": "apple", "version": "(os x lion v10.7.5)" }, { "model": "itunes", "scope": "eq", "trust": 0.8, "vendor": "apple", "version": "12.0.1" }, { "model": "open source project webkit", "scope": "eq", "trust": 0.3, "vendor": "webkit", "version": "1.2.5" }, { "model": "open source project webkit", "scope": "eq", "trust": 0.3, "vendor": "webkit", "version": "1.2.3" }, { "model": "open source project webkit", "scope": "eq", "trust": 0.3, "vendor": "webkit", "version": "1.2.2" }, { "model": "open source project webkit", "scope": "eq", "trust": 0.3, "vendor": "webkit", "version": "2" }, { "model": "open source project webkit", "scope": "eq", "trust": 0.3, "vendor": "webkit", "version": "1.2.2-1" }, { "model": "linux", "scope": null, "trust": 0.3, "vendor": "gentoo", "version": null }, { "model": "esignal", "scope": "eq", "trust": 0.3, "vendor": "esignal", "version": "6.0.2" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "5.0.6" }, { "model": "safari for windows", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.1.2" }, { "model": "safari for windows", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.0.5" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.0.5" }, { "model": "safari for windows", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.0.4" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.0.4" }, { "model": "safari for windows", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.0.3" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.0.3" }, { "model": "safari for windows", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.0.2" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.0.2" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.0.1" }, { "model": "safari for windows", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "5.1.7" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "5.1.7" }, { "model": "safari for windows", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "5.1.5" }, { "model": "safari for windows", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "5.1.4" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "5.1.4" }, { "model": "safari for windows", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "5.1.1" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "5.1.1" }, { "model": "safari for windows", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "5.1" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "5.1" }, { "model": "safari for windows", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "5.0.6" }, { "model": "safari for windows", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "5.0.5" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "5.0.5" }, { "model": "safari for windows", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "5.0.4" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "5.0.4" }, { "model": "safari for windows", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "5.0.3" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "5.0.3" }, { "model": "safari for windows", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "5.0.2" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "5.0.2" }, { "model": "safari for windows", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "5.0.1" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "5.0.1" }, { "model": "safari for windows", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "5.0" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "5.0" }, { "model": "safari for windows", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.1.3" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.1.3" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.1.2" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.1.1" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.1" }, { "model": "safari beta", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.0" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.0" }, { "model": "safari for windows", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4" }, { "model": "safari beta", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4" }, { "model": "mac os server", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.7.4" }, { "model": "mac os server", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.7.3" }, { "model": "mac os server", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.7.2" }, { "model": "mac os server", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.7.1" }, { "model": "mac os", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.7.4" }, { "model": "mac os", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.7.3" }, { "model": "mac os", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.7.2" }, { "model": "mac os", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.7.1" }, { "model": "itunes", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "10.5.1" }, { "model": "itunes", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "9.2.1" }, { "model": "itunes", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "9.0.2" }, { "model": "itunes", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "9.0.1.8" }, { "model": "itunes", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "9.0.1" }, { "model": "itunes", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "9.0" }, { "model": "itunes", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "7.3.2" }, { "model": "itunes", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "7.3.1" }, { "model": "itunes", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "7.3" }, { "model": "itunes", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "7.0.2" }, { "model": "itunes", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "6.0.5" }, { "model": "itunes", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "6.0.4" }, { "model": "itunes", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "6.0.3" }, { "model": "itunes", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "6.0.1" }, { "model": "itunes", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "6.0" }, { "model": "itunes", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "5.0" }, { "model": "itunes", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.8" }, { "model": "itunes", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.7.1" }, { "model": "itunes", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.7" }, { "model": "itunes", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.6" }, { "model": "itunes", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.5" }, { "model": "itunes", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.2.72" }, { "model": "itunes", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "9.2" }, { "model": "itunes", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "9.1" }, { "model": "itunes", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "8.2" }, { "model": "itunes", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "8.1" }, { "model": "itunes", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "8.0.2.20" }, { "model": "itunes", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "8.0" }, { "model": "itunes", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "7.4" }, { "model": "itunes", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "10.6" }, { "model": "itunes", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "10.5" }, { "model": "itunes", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "10.2.2" }, { "model": "itunes", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "10.2" }, { "model": "itunes", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "10.1" }, { "model": "itunes", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "10" }, { "model": "iphone", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.0.1" }, { "model": "iphone", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.3.3" }, { "model": "iphone", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.3.2" }, { "model": "iphone", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.3.1" }, { "model": "iphone", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.3.0" }, { "model": "iphone", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.2.8" }, { "model": "iphone", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.2.5" }, { "model": "iphone", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.2.1" }, { "model": "iphone", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.1" }, { "model": "iphone", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.0.2" }, { "model": "iphone", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.0" }, { "model": "ipad", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "3.2.1" }, { "model": "ipad", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "3.2.2" }, { "model": "ipad", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "3.2" }, { "model": "ios", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.2.1" }, { "model": "ios", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.0.2" }, { "model": "ios", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.0.1" }, { "model": "ios", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "3.2.2" }, { "model": "ios", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "3.2.1" }, { "model": "ios", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "5.1.1" }, { "model": "ios", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "5.1" }, { "model": "ios", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "5.0.1" }, { "model": "ios", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "5" }, { "model": "ios", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.3.5" }, { "model": "ios", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.3.4" }, { "model": "ios", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.3.3" }, { "model": "ios", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.3.2" }, { "model": "ios", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.3.1" }, { "model": "ios", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.3" }, { "model": "ios", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.2.9" }, { "model": "ios", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.2.8" }, { "model": "ios", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.2.7" }, { "model": "ios", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.2.6" }, { "model": "ios", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.2.5" }, { "model": "ios", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.2.10" }, { "model": "ios beta", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.2" }, { "model": "ios", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.2" }, { "model": "ios", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.1" }, { "model": "ios", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4" }, { "model": "ios", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "3.2" }, { "model": "ios", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "3.1" }, { "model": "ios", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "3.0" }, { "model": "ios", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "2.1" }, { "model": "ios", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "2.0" }, { "model": "tv", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "5.0" }, { "model": "tv", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.4" }, { "model": "tv", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.3" }, { "model": "tv", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.2" }, { "model": "tv", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.1" }, { "model": "tv", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.0" }, { "model": "tv", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "2.1" } ], "sources": [ { "db": "BID", "id": "67553" }, { "db": "JVNDB", "id": "JVNDB-2014-002614" }, { "db": "CNNVD", "id": "CNNVD-201405-448" }, { "db": "NVD", "id": "CVE-2014-1342" } ] }, "configurations": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", "children": { "@container": "@list" }, "cpe_match": { "@container": "@list" }, "data": { "@container": "@list" }, "nodes": { "@container": "@list" } }, "data": [ { "CVE_data_version": "4.0", "nodes": [ { "cpe_match": [ { "cpe22Uri": "cpe:/a:apple:apple_tv", "vulnerable": true }, { "cpe22Uri": "cpe:/o:apple:iphone_os", "vulnerable": true }, { "cpe22Uri": "cpe:/a:apple:itunes", "vulnerable": true }, { "cpe22Uri": "cpe:/a:apple:safari", "vulnerable": true } ], "operator": "OR" } ] } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2014-002614" } ] }, "credits": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "banty, Google Chrome Security Team, Apple, cloudfuzzer, Atte Kettunen of OUSPG, and Ian Beer of Google Project Zero", "sources": [ { "db": "BID", "id": "67553" } ], "trust": 0.3 }, "cve": "CVE-2014-1342", "cvss": { "@context": { "cvssV2": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2" }, "cvssV3": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/" }, "severity": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#" }, "@id": "https://www.variotdbs.pl/ref/cvss/severity" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "cvssV2": [ { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "author": "nvd@nist.gov", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "exploitabilityScore": 8.6, "id": "CVE-2014-1342", "impactScore": 6.4, "integrityImpact": "PARTIAL", "severity": "MEDIUM", "trust": 1.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "author": "VULHUB", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "exploitabilityScore": 8.6, "id": "VHN-69281", "impactScore": 6.4, "integrityImpact": "PARTIAL", "severity": "MEDIUM", "trust": 0.1, "vectorString": "AV:N/AC:M/AU:N/C:P/I:P/A:P", "version": "2.0" } ], "cvssV3": [], "severity": [ { "author": "nvd@nist.gov", "id": "CVE-2014-1342", "trust": 1.0, "value": "MEDIUM" }, { "author": "NVD", "id": "CVE-2014-1342", "trust": 0.8, "value": "Medium" }, { "author": "CNNVD", "id": "CNNVD-201405-448", "trust": 0.6, "value": "MEDIUM" }, { "author": "VULHUB", "id": "VHN-69281", "trust": 0.1, "value": "MEDIUM" } ] } ], "sources": [ { "db": "VULHUB", "id": "VHN-69281" }, { "db": "JVNDB", "id": "JVNDB-2014-002614" }, { "db": "CNNVD", "id": "CNNVD-201405-448" }, { "db": "NVD", "id": "CVE-2014-1342" } ] }, "description": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1. Apple Safari Used in etc. WebKit is prone to multiple unspecified memory-corruption vulnerabilities. \nAn attacker may exploit these issues by enticing victims into viewing a malicious webpage. \nSuccessful exploits may allow attackers to execute arbitrary code in the context of the affected browser or cause denial-of-service conditions; other attacks may also be possible. WebKit is a set of open source web browser engines jointly developed by companies such as KDE, Apple (Apple), and Google (Google), and is currently used by browsers such as Apple Safari and Google Chrome. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\nAPPLE-SA-2014-06-30-3 iOS 7.1.2\n\niOS 7.1.2 is now available and addresses the following:\n\nCertificate Trust Policy\nAvailable for: iPhone 4 and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: Update to the certificate trust policy\nDescription: The certificate trust policy was updated. The complete\nlist of certificates may be viewed at\nhttp://support.apple.com/kb/HT5012. \n\nCoreGraphics\nAvailable for: iPhone 4 and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: Viewing a maliciously crafted XBM file may lead to an\nunexpected application termination or arbitrary code execution\nDescription: An unbounded stack allocation issue existed in the\nhandling of XBM files. This issue was addressed through improved\nbounds checking. \nCVE-ID\nCVE-2014-1354 : Dima Kovalenko of codedigging.com\n\nKernel\nAvailable for: iPhone 4 and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: An application could cause the device to unexpectedly\nrestart\nDescription: A null pointer dereference existed in the handling of\nIOKit API arguments. This issue was addressed through additional\nvalidation of IOKit API arguments. \nCVE-ID\nCVE-2014-1355 : cunzhang from Adlab of Venustech\n\nlaunchd\nAvailable for: iPhone 4 and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: A malicious application may be able to execute arbitrary\ncode with system privileges\nDescription: A heap buffer overflow existed in launchd\u0027s handling of\nIPC messages. This issue was addressed through improved bounds\nchecking. \nCVE-ID\nCVE-2014-1356 : Ian Beer of Google Project Zero\n\nlaunchd\nAvailable for: iPhone 4 and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: A malicious application may be able to execute arbitrary\ncode with system privileges\nDescription: A heap buffer overflow existed in launchd\u0027s handling of\nlog messages. This issue was addressed through improved bounds\nchecking. \nCVE-ID\nCVE-2014-1357 : Ian Beer of Google Project Zero\n\nlaunchd\nAvailable for: iPhone 4 and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: A malicious application may be able to execute arbitrary\ncode with system privileges\nDescription: An integer overflow existed in launchd. This issue was\naddressed through improved bounds checking. \nCVE-ID\nCVE-2014-1358 : Ian Beer of Google Project Zero\n\nlaunchd\nAvailable for: iPhone 4 and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: A malicious application may be able to execute arbitrary\ncode with system privileges\nDescription: An integer underflow existed in launchd. This issue was\naddressed through improved bounds checking. \nCVE-ID\nCVE-2014-1359 : Ian Beer of Google Project Zero\n\nLockdown\nAvailable for: iPhone 4 and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: An attacker possessing an iOS device could potentially\nbypass Activation Lock\nDescription: Devices were performing incomplete checks during device\nactivation, which made it possible for malicious individuals to\npartially bypass Activation Lock. This issue was addressed through\nadditional client-side verification of data received from activation\nservers. \nCVE-ID\nCVE-2014-1360\n\nLock Screen\nAvailable for: iPhone 4 and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: An attacker in possession of a device may exceed the maximum\nnumber of failed passcode attempts\nDescription: In some circumstances, the failed passcode attempt\nlimit was not enforced. This issue was addressed through additional\nenforcement of this limit. \nCVE-ID\nCVE-2014-1352 : mblsec\n\nLock Screen\nAvailable for: iPhone 4 and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: A person with physical access to a locked device may be able\nto access the application that was in the foreground prior to locking\nDescription: A state management issue existed in the handling of the\ntelephony state while in Airplane Mode. This issue was addressed\nthrough improved state management while in Airplane Mode. \nCVE-ID\nCVE-2014-1353\n\nMail\nAvailable for: iPhone 4 and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: Mail attachments can be extracted from an iPhone 4\nDescription: Data protection was not enabled for mail attachments,\nallowing them to be read by an attacker with physical access to the\ndevice. This issue was addressed by changing the encryption class of\nmail attachments. \nCVE-ID\nCVE-2014-1348 : Andreas Kurtz of NESO Security Labs\n\nSafari\nAvailable for: iPhone 4 and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: Visiting a maliciously crafted website may lead to an\nunexpected application termination or arbitrary code execution\nDescription: A use after free issue existed in Safari\u0027s handling of\ninvalid URLs. This issue was addressed through improved memory\nhandling. \nCVE-ID\nCVE-2014-1349 : Reno Robert and Dhanesh Kizhakkinan\n\nSettings\nAvailable for: iPhone 4 and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: A person with physical access to the device may be able to\ndisable Find My iPhone without entering an iCloud password\nDescription: A state management issue existed in the handling of the\nFind My iPhone state. This issue was addressed through improved\nhandling of Find My iPhone state. \nCVE-ID\nCVE-2014-1350\n\nSecure Transport\nAvailable for: iPhone 4 and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: Two bytes of uninitialized memory could be disclosed to a\nremote attacker\nDescription: An uninitialized memory access issue existed in the\nhandling of DTLS messages in a TLS connection. This issue was\naddressed by only accepting DTLS messages in a DTLS connection. \nCVE-ID\nCVE-2014-1361 : Thijs Alkemade of The Adium Project\n\nSiri\nAvailable for: iPhone 4S and later,\niPod touch (5th generation) and later,\niPad (3rd generation) and later\nImpact: A person with physical access to the phone may be able to\nview all contacts\nDescription: If a Siri request might refer to one of several\ncontacts, Siri displays a list of possible choices and the option\n\u0027More...\u0027 for a complete contact list. When used at the lock screen,\nSiri did not require the passcode before viewing the complete contact\nlist. This issue was addressed by requiring the passcode. \nCVE-ID\nCVE-2014-1351 : Sherif Hashim\n\nWebKit\nAvailable for: iPhone 4 and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: Visiting a maliciously crafted website may lead to an\nunexpected application termination or arbitrary code execution\nDescription: Multiple memory corruption issues existed in WebKit. \nThese issues were addressed through improved memory handling. \nCVE-ID\nCVE-2013-2875 : miaubiz\nCVE-2013-2927 : cloudfuzzer\nCVE-2014-1323 : banty\nCVE-2014-1325 : Apple\nCVE-2014-1326 : Apple\nCVE-2014-1327 : Google Chrome Security Team, Apple\nCVE-2014-1329 : Google Chrome Security Team\nCVE-2014-1330 : Google Chrome Security Team\nCVE-2014-1331 : cloudfuzzer\nCVE-2014-1333 : Google Chrome Security Team\nCVE-2014-1334 : Apple\nCVE-2014-1335 : Google Chrome Security Team\nCVE-2014-1336 : Apple\nCVE-2014-1337 : Apple\nCVE-2014-1338 : Google Chrome Security Team\nCVE-2014-1339 : Atte Kettunen of OUSPG\nCVE-2014-1341 : Google Chrome Security Team\nCVE-2014-1342 : Apple\nCVE-2014-1343 : Google Chrome Security Team\nCVE-2014-1362 : Apple, miaubiz\nCVE-2014-1363 : Apple\nCVE-2014-1364 : Apple\nCVE-2014-1365 : Apple, Google Chrome Security Team\nCVE-2014-1366 : Apple\nCVE-2014-1367 : Apple\nCVE-2014-1368 : Wushi of Keen Team (Research Team of Keen Cloud Tech)\nCVE-2014-1382 : Renata Hodovan of University of Szeged / Samsung\nElectronics\nCVE-2014-1731 : an anonymous member of the Blink development\ncommunity\n\nWebKit\nAvailable for: iPhone 4 and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: A malicious site can send messages to a connected frame or\nwindow in a way that might circumvent the receiver\u0027s origin check\nDescription: An encoding issue existed in the handling of unicode\ncharacters in URLs. A maliciously crafted URL could have led to\nsending an incorrect postMessage origin. This issue was addressed\nthrough improved encoding/decoding. \nCVE-ID\nCVE-2014-1346 : Erling Ellingsen of Facebook\n\nWebKit\nAvailable for: iPhone 4 and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: A maliciously crafted website may be able to spoof its\ndomain name in the address bar\nDescription: A spoofing issue existed in the handling of URLs. This\nissue was addressed through improved encoding of URLs. \nCVE-ID\nCVE-2014-1345 : Erling Ellingsen of Facebook\n\n\nInstallation note:\n\nThis update is available through iTunes and Software Update on your\niOS device, and will not appear in your computer\u0027s Software Update\napplication, or in the Apple Downloads site. Make sure you have an\nInternet connection and have installed the latest version of iTunes\nfrom www.apple.com/itunes/\n\niTunes and Software Update on the device will automatically check\nApple\u0027s update server on its weekly schedule. When an update is\ndetected, it is downloaded and the option to be installed is\npresented to the user when the iOS device is docked. We recommend\napplying the update immediately if possible. Selecting Don\u0027t Install\nwill present the option the next time you connect your iOS device. \n\nThe automatic update process may take up to a week depending on the\nday that iTunes or the device checks for updates. You may manually\nobtain the update via the Check for Updates button within iTunes, or\nthe Software Update on your device. \n\nTo check that the iPhone, iPod touch, or iPad has been updated:\n\n* Navigate to Settings\n* Select General\n* Select About. The version after applying this update\nwill be \"7.1.2\". \n\nInformation will also be posted to the Apple Security Updates\nweb site: http://support.apple.com/kb/HT1222\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG/MacGPG2 v2.0.22 (Darwin)\nComment: GPGTools - http://gpgtools.org\n\niQIcBAEBAgAGBQJTsaK7AAoJEBcWfLTuOo7tfX8QAI3gb917qsoyNIRVPy3hRq3v\nn6JJM2HBMiFuupE3cbaA0Kx0Gmyxdbdl0EFOjU0uTCqS3kutB/9/nTTZaRtWDS2I\npvZnvisGW5NeVD6F+WcRuR1ifLG1fihYWbLfsORV4iLl62FLae5kOWG1Z/RNW6xY\nuAXEkq5mGRuEkYOD+nmvZoZMZkVcEqXassa+PpZVphkNvAPWE799sIfEeQUB8e3d\nE4ZRAYBbM3peZHJKRafENhrYS4BFl92lQYfh10o/9eC8HIJ5Qo1JBLkzZi8D+z/2\nRaUcGhyzgMCuQZBGdwQ8rAF6dn5A7y4TnRs7EpPp7cNe+OofkOO1Ya0rs3IRx/ds\nV+vmnZrQw38YIfG45tQpO8MYrRivJNjmrQWHeuKyAfXxtAdTdmnOOVYJZvy5cklX\nIbwBziUHuiNi666Vqf+Abwl2FUx4ksrxtnvojY5SPOxhyJR34Ex15QVojOTD2pqp\nqyVNpy3l+5G/6kBPzDKhXJ3kOVjlO9MZerOK9hQekn80A5B0dKbNdCwehXGSkL9d\nWxrA+CPva3pryc75h1x740w8KiP4pr0p1sZKjZCRIR103A2F8/NFK3M7JgJSbDrR\nPKoWqou+oPP98gdRHwZxdwLaGSj/fJFBysIlUnVG2Q/UnM5g2MZXCL6JSg+PWETH\nDpRuZyHlmSF53n37vSR/\n=JmVc\n-----END PGP SIGNATURE-----\n\n. \nCVE-ID\nCVE-2014-1346 : Erling Ellingsen of Facebook\n\n\nFor OS X Mavericks and OS X Mountain Lion systems, Safari 7.0.4\nand Safari 6.1.4 may be obtained from Mac App Store", "sources": [ { "db": "NVD", "id": "CVE-2014-1342" }, { "db": "JVNDB", "id": "JVNDB-2014-002614" }, { "db": "BID", "id": "67553" }, { "db": "VULHUB", "id": "VHN-69281" }, { "db": "PACKETSTORM", "id": "127307" }, { "db": "PACKETSTORM", "id": "127308" }, { "db": "PACKETSTORM", "id": "126780" } ], "trust": 2.25 }, "external_ids": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "db": "NVD", "id": "CVE-2014-1342", "trust": 3.1 }, { "db": "BID", "id": "67553", "trust": 1.4 }, { "db": "JVN", "id": "JVNVU98457223", "trust": 0.8 }, { "db": "JVN", "id": "JVNVU97537282", "trust": 0.8 }, { "db": "JVN", "id": "JVNVU99696049", "trust": 0.8 }, { "db": "JVNDB", "id": "JVNDB-2014-002614", "trust": 0.8 }, { "db": "CNNVD", "id": "CNNVD-201405-448", "trust": 0.7 }, { "db": "APPLE", "id": "APPLE-SA-2014-05-21-1", "trust": 0.6 }, { "db": "VULHUB", "id": "VHN-69281", "trust": 0.1 }, { "db": "PACKETSTORM", "id": "127307", "trust": 0.1 }, { "db": "PACKETSTORM", "id": "127308", "trust": 0.1 }, { "db": "PACKETSTORM", "id": "126780", "trust": 0.1 } ], "sources": [ { "db": "VULHUB", "id": "VHN-69281" }, { "db": "BID", "id": "67553" }, { "db": "JVNDB", "id": "JVNDB-2014-002614" }, { "db": "PACKETSTORM", "id": "127307" }, { "db": "PACKETSTORM", "id": "127308" }, { "db": "PACKETSTORM", "id": "126780" }, { "db": "CNNVD", "id": "CNNVD-201405-448" }, { "db": "NVD", "id": "CVE-2014-1342" } ] }, "id": "VAR-201405-0236", "iot": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": true, "sources": [ { "db": "VULHUB", "id": "VHN-69281" } ], "trust": 0.01 }, "last_update_date": "2024-11-23T19:33:08.866000Z", "patch": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "title": "HT6297", "trust": 0.8, "url": "http://support.apple.com/kb/HT6297" }, { "title": "HT6298", "trust": 0.8, "url": "http://support.apple.com/kb/HT6298" }, { "title": "HT6537", "trust": 0.8, "url": "http://support.apple.com/en-eu/HT6537" }, { "title": "HT6254", "trust": 0.8, "url": "http://support.apple.com/kb/HT6254" }, { "title": "HT6254", "trust": 0.8, "url": "http://support.apple.com/kb/HT6254?viewlocale=ja_JP" }, { "title": "HT6297", "trust": 0.8, "url": "http://support.apple.com/kb/HT6297?viewlocale=ja_JP" }, { "title": "HT6298", "trust": 0.8, "url": "http://support.apple.com/kb/HT6298?viewlocale=ja_JP" }, { "title": "HT6537", "trust": 0.8, "url": "http://support.apple.com/ja-jp/HT6537" }, { "title": "Safari7.0.4Mavericks", "trust": 0.6, "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=50001" }, { "title": "Safari6.1.4MountainLion", "trust": 0.6, "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=50000" } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2014-002614" }, { "db": "CNNVD", "id": "CNNVD-201405-448" } ] }, "problemtype_data": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "problemtype": "CWE-119", "trust": 1.9 } ], "sources": [ { "db": "VULHUB", "id": "VHN-69281" }, { "db": "JVNDB", "id": "JVNDB-2014-002614" }, { "db": "NVD", "id": "CVE-2014-1342" } ] }, "references": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "trust": 2.5, "url": "http://archives.neohapsis.com/archives/bugtraq/2014-05/0128.html" }, { "trust": 1.9, "url": "http://archives.neohapsis.com/archives/bugtraq/2014-06/0174.html" }, { "trust": 1.9, "url": "http://archives.neohapsis.com/archives/bugtraq/2014-06/0175.html" }, { "trust": 1.7, "url": "http://support.apple.com/kb/ht6254" }, { "trust": 1.1, "url": "http://www.securityfocus.com/bid/67553" }, { "trust": 1.1, "url": "https://support.apple.com/kb/ht6537" }, { "trust": 0.8, "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-1342" }, { "trust": 0.8, "url": "http://jvn.jp/vu/jvnvu98457223/" }, { "trust": 0.8, "url": "http://jvn.jp/vu/jvnvu99696049/index.html" }, { "trust": 0.8, "url": "http://jvn.jp/vu/jvnvu97537282/index.html" }, { "trust": 0.8, "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=2014-1342" }, { "trust": 0.3, "url": "http://www.apple.com/safari/download/" }, { "trust": 0.3, "url": "http://www.webkit.org/" }, { "trust": 0.3, "url": "https://nvd.nist.gov/vuln/detail/cve-2014-1334" }, { "trust": 0.3, "url": "https://nvd.nist.gov/vuln/detail/cve-2014-1337" }, { "trust": 0.3, "url": "https://nvd.nist.gov/vuln/detail/cve-2014-1336" }, { "trust": 0.3, "url": "http://support.apple.com/kb/ht1222" }, { "trust": 0.3, "url": "https://nvd.nist.gov/vuln/detail/cve-2014-1326" }, { "trust": 0.3, "url": "https://nvd.nist.gov/vuln/detail/cve-2014-1343" }, { "trust": 0.3, "url": "https://nvd.nist.gov/vuln/detail/cve-2014-1331" }, { "trust": 0.3, "url": "https://nvd.nist.gov/vuln/detail/cve-2014-1338" }, { "trust": 0.3, "url": "https://nvd.nist.gov/vuln/detail/cve-2014-1335" }, { "trust": 0.3, "url": "https://nvd.nist.gov/vuln/detail/cve-2014-1323" }, { "trust": 0.3, "url": "https://nvd.nist.gov/vuln/detail/cve-2013-2927" }, { "trust": 0.3, "url": "https://nvd.nist.gov/vuln/detail/cve-2014-1342" }, { "trust": 0.3, "url": "https://nvd.nist.gov/vuln/detail/cve-2014-1333" }, { "trust": 0.3, "url": "https://nvd.nist.gov/vuln/detail/cve-2014-1339" }, { "trust": 0.3, "url": "https://www.apple.com/support/security/pgp/" }, { "trust": 0.3, "url": "http://gpgtools.org" }, { "trust": 0.3, "url": "https://nvd.nist.gov/vuln/detail/cve-2014-1327" }, { "trust": 0.3, "url": "https://nvd.nist.gov/vuln/detail/cve-2013-2875" }, { "trust": 0.3, "url": "https://nvd.nist.gov/vuln/detail/cve-2014-1329" }, { "trust": 0.3, "url": "https://nvd.nist.gov/vuln/detail/cve-2014-1341" }, { "trust": 0.3, "url": "https://nvd.nist.gov/vuln/detail/cve-2014-1330" }, { "trust": 0.2, "url": "https://nvd.nist.gov/vuln/detail/cve-2014-1325" }, { "trust": 0.2, "url": "https://nvd.nist.gov/vuln/detail/cve-2014-1346" }, { "trust": 0.1, "url": "https://www.apple.com/itunes/" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2014-1352" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2014-1354" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2014-1350" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2014-1351" }, { "trust": 0.1, "url": "http://support.apple.com/kb/ht5012." }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2014-1353" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2014-1348" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2014-1345" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2014-1349" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2014-1363" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2014-1357" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2014-1364" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2014-1356" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2014-1355" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2014-1358" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2014-1361" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2014-1359" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2014-1362" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2014-1731" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2014-1344" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2014-1324" } ], "sources": [ { "db": "VULHUB", "id": "VHN-69281" }, { "db": "BID", "id": "67553" }, { "db": "JVNDB", "id": "JVNDB-2014-002614" }, { "db": "PACKETSTORM", "id": "127307" }, { "db": "PACKETSTORM", "id": "127308" }, { "db": "PACKETSTORM", "id": "126780" }, { "db": "CNNVD", "id": "CNNVD-201405-448" }, { "db": "NVD", "id": "CVE-2014-1342" } ] }, "sources": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", "data": { "@container": "@list" } }, "data": [ { "db": "VULHUB", "id": "VHN-69281" }, { "db": "BID", "id": "67553" }, { "db": "JVNDB", "id": "JVNDB-2014-002614" }, { "db": "PACKETSTORM", "id": "127307" }, { "db": "PACKETSTORM", "id": "127308" }, { "db": "PACKETSTORM", "id": "126780" }, { "db": "CNNVD", "id": "CNNVD-201405-448" }, { "db": "NVD", "id": "CVE-2014-1342" } ] }, "sources_release_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2014-05-22T00:00:00", "db": "VULHUB", "id": "VHN-69281" }, { "date": "2014-05-21T00:00:00", "db": "BID", "id": "67553" }, { "date": "2014-05-26T00:00:00", "db": "JVNDB", "id": "JVNDB-2014-002614" }, { "date": "2014-07-01T01:05:32", "db": "PACKETSTORM", "id": "127307" }, { "date": "2014-07-01T01:07:19", "db": "PACKETSTORM", "id": "127308" }, { "date": "2014-05-22T20:22:22", "db": "PACKETSTORM", "id": "126780" }, { "date": "2014-05-26T00:00:00", "db": "CNNVD", "id": "CNNVD-201405-448" }, { "date": "2014-05-22T19:55:07.843000", "db": "NVD", "id": "CVE-2014-1342" } ] }, "sources_update_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2016-12-08T00:00:00", "db": "VULHUB", "id": "VHN-69281" }, { "date": "2016-02-11T07:46:00", "db": "BID", "id": "67553" }, { "date": "2014-11-20T00:00:00", "db": "JVNDB", "id": "JVNDB-2014-002614" }, { "date": "2014-07-17T00:00:00", "db": "CNNVD", "id": "CNNVD-201405-448" }, { "date": "2024-11-21T02:04:06.487000", "db": "NVD", "id": "CVE-2014-1342" } ] }, "threat_type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "remote", "sources": [ { "db": "CNNVD", "id": "CNNVD-201405-448" } ], "trust": 0.6 }, "title": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Apple Safari Used in etc. WebKit Vulnerable to arbitrary code execution", "sources": [ { "db": "JVNDB", "id": "JVNDB-2014-002614" } ], "trust": 0.8 }, "type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "buffer overflow", "sources": [ { "db": "CNNVD", "id": "CNNVD-201405-448" } ], "trust": 0.6 } }
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.