var-201411-0493
Vulnerability from variot
WebKit, as used in Apple iOS before 8.1.1 and Apple TV before 7.0.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-4452. Apple iOS and Apple TV Used in etc. WebKit is prone to an unspecified memory-corruption vulnerability. An attacker may exploit this issue by enticing victims into viewing a malicious webpage. Successful exploits may allow attackers to execute arbitrary code in the context of the affected browser or cause denial-of-service conditions; other attacks may also be possible. WebKit is a set of open source web browser engines jointly developed by companies such as KDE, Apple (Apple), and Google (Google), and is currently used by browsers such as Apple Safari and Google Chrome. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
APPLE-SA-2014-11-17-1 iOS 8.1.1
iOS 8.1.1 is now available and addresses the following:
CFNetwork Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Website cache may not be fully cleared after leaving private browsing Description: A privacy issue existed where browsing data could remain in the cache after leaving private browsing. This issue was addressed through a change in caching behavior. CVE-ID CVE-2014-4460
dyld Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A local user may be able to execute unsigned code Description: A state management issue existed in the handling of Mach-O executable files with overlapping segments. This issue was addressed through improved validation of segment sizes. CVE-ID CVE-2014-4455 : @PanguTeam
Kernel Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A malicious application may be able to execute arbitrary code with system privileges Description: A validation issue existed in the handling of certain metadata fields of IOSharedDataQueue objects. This issue was addressed through relocation of the metadata. CVE-ID CVE-2014-4461 : @PanguTeam
Lock Screen Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: An attacker in possession of a device may exceed the maximum number of failed passcode attempts Description: In some circumstances, the failed passcode attempt limit was not enforced. This issue was addressed through additional enforcement of this limit. CVE-ID CVE-2014-4451 : Stuart Ryan of University of Technology, Sydney
Lock Screen Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A person with physical access to the phone may be able to access photos in the Photo Library Description: The Leave a Message option in FaceTime may have allowed viewing and sending photos from the device. This issue was addressed through improved state management. CVE-ID CVE-2014-4463
Sandbox Profiles Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A malicious application may be able to launch arbitrary binaries on a trusted device Description: A permissions issue existed with the debugging functionality for iOS that allowed the spawning of applications on trusted devices that were not being debugged. This was addressed by changes to debugserver's sandbox. CVE-ID CVE-2014-4457 : @PanguTeam
Spotlight Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Unnecessary information is included as part of the initial connection between Spotlight or Safari and the Spotlight Suggestions servers Description: The initial connection made by Spotlight or Safari to the Spotlight Suggestions servers included a user's approximate location before a user entered a query. This issue was addressed by removing this information from the initial connection and only sending the user's approximate location as part of queries. CVE-ID CVE-2014-4453 : Ashkan Soltani
WebKit Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues existed in WebKit. These issues were addressed through improved memory handling. CVE-ID CVE-2014-4452 CVE-2014-4462
Installation note:
This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from www.apple.com/itunes/
iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device.
To check that the iPhone, iPod touch, or iPad has been updated:
- Navigate to Settings
- Select General
- Select About. The version after applying this update will be "8.1.1".
Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222
This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.22 (Darwin) Comment: GPGTools - http://gpgtools.org
iQIcBAEBAgAGBQJUajYFAAoJEBcWfLTuOo7tGxsP/RccLDIt/LMluE7bcG9NSz4w tw8AHhkfiDZ+T/nnhqAiS2RQ2cgSfMg8KVzCtbrtXrEgebFTUVlos1vIjMSEkqgp GmSDFn64vZIExVo8w9iTLG/AdW0sERz3h2xVSEr/154AG2SHnL1+nY5abHHycTIG Uuo60+t2OVPtREIcrffmwj6hsYAX1dLAI0QV7PdvjpCc82Snf+yJZCFyjQ23AkQn P9NElRnK+pbhqqnfZXKO3Hbgf5IkuzeSl4Rwrj8nehu+hcEp32a8zH2wbbzDsFTO AyM02SAGLmBM30QcoJYK/s0lCGJBbr9rM5+9dUH6KXc8q/OTLJ0YETdHqwsO29cf XEl5uQT4IHGjlij2f/xYsa0OXbLfyXNeaT5YGlUSIUKNFXRhD6rPccL5V5Ktjnac JxOv0og5L4OBtPykc0XhmRqTIkEC4Cf3RmewA+b8ivsp/LuPjYsdfN1tZ8MXa1a8 C7hhUQSSSTtA3v7oO/LpU8Qw7kV79SkeQcYYTP07QI87cU2HHDejBHCfGjK9cz65 Uf4Sa/leCT0JyQYnx0XOafFTzxIJ2641HtTjuQ3sTKungkE5CR/KyVk2Wul3YqcA Meo//heYRLNa1XANfzV70TcsnQ2lcirzOqiufC+jljsfkQtlAXWim9H9BCc4102b ugp50lE7/p+CbwYvqaZg =x/RM -----END PGP SIGNATURE-----
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201411-0493",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "iphone os",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "8.0"
},
{
"model": "tvos",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "6.0"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "8.0.2"
},
{
"model": "tvos",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "6.0.2"
},
{
"model": "tvos",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "6.1"
},
{
"model": "tvos",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "7.0"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "8.0.1"
},
{
"model": "tvos",
"scope": "lte",
"trust": 1.0,
"vendor": "apple",
"version": "7.0.1"
},
{
"model": "tvos",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "6.0.1"
},
{
"model": "tvos",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "6.1.1"
},
{
"model": "tvos",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "6.2.1"
},
{
"model": "tvos",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "6.2"
},
{
"model": "iphone os",
"scope": "lte",
"trust": 1.0,
"vendor": "apple",
"version": "8.1"
},
{
"model": "tvos",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "6.1.2"
},
{
"model": "tv",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "7.0.2 (apple tv first 3 after generation )"
},
{
"model": "ios",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "8.1.1 (ipad 2 or later )"
},
{
"model": "ios",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "8.1.1 (iphone 4s or later )"
},
{
"model": "ios",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "8.1.1 (ipod touch first 5 after generation )"
},
{
"model": "tv",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "6.0.1"
},
{
"model": "tv",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "7.0"
},
{
"model": "tv",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "6.0.2"
},
{
"model": "tv",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "6.0"
},
{
"model": "tv",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "6.2"
},
{
"model": "tv",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "6.1.1"
},
{
"model": "tv",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "6.1.2"
},
{
"model": "tv",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "6.1"
},
{
"model": "tv",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "6.2.1"
},
{
"model": "tv",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "7.0.1"
},
{
"model": "open source project webkit",
"scope": "eq",
"trust": 0.3,
"vendor": "webkit",
"version": "0"
},
{
"model": "ipod touch",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "0"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "0"
},
{
"model": "ipad",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "0"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.0.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.0.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.2.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.2.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5.1.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5.0.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3.5"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3.4"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3.3"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.9"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.8"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.7"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.6"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.5"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.10"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.0"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.0"
},
{
"model": "tv",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5.0"
},
{
"model": "tv",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.4"
},
{
"model": "tv",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3"
},
{
"model": "tv",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2"
},
{
"model": "tv",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.1"
},
{
"model": "tv",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.0"
},
{
"model": "tv",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.1"
},
{
"model": "tv",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.0"
}
],
"sources": [
{
"db": "BID",
"id": "71142"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-005518"
},
{
"db": "CNNVD",
"id": "CNNVD-201411-315"
},
{
"db": "NVD",
"id": "CVE-2014-4462"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:apple:apple_tv",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:apple:iphone_os",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-005518"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Apple",
"sources": [
{
"db": "BID",
"id": "71142"
},
{
"db": "PACKETSTORM",
"id": "129158"
},
{
"db": "PACKETSTORM",
"id": "129163"
}
],
"trust": 0.5
},
"cve": "CVE-2014-4462",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 6.5,
"id": "CVE-2014-4462",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:A/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 6.5,
"id": "VHN-72402",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:A/AC:L/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2014-4462",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2014-4462",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-201411-315",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-72402",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-72402"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-005518"
},
{
"db": "CNNVD",
"id": "CNNVD-201411-315"
},
{
"db": "NVD",
"id": "CVE-2014-4462"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "WebKit, as used in Apple iOS before 8.1.1 and Apple TV before 7.0.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-4452. Apple iOS and Apple TV Used in etc. WebKit is prone to an unspecified memory-corruption vulnerability. \nAn attacker may exploit this issue by enticing victims into viewing a malicious webpage. \nSuccessful exploits may allow attackers to execute arbitrary code in the context of the affected browser or cause denial-of-service conditions; other attacks may also be possible. WebKit is a set of open source web browser engines jointly developed by companies such as KDE, Apple (Apple), and Google (Google), and is currently used by browsers such as Apple Safari and Google Chrome. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\nAPPLE-SA-2014-11-17-1 iOS 8.1.1\n\niOS 8.1.1 is now available and addresses the following:\n\nCFNetwork\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: Website cache may not be fully cleared after leaving private\nbrowsing\nDescription: A privacy issue existed where browsing data could\nremain in the cache after leaving private browsing. This issue was\naddressed through a change in caching behavior. \nCVE-ID\nCVE-2014-4460\n\ndyld\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: A local user may be able to execute unsigned code\nDescription: A state management issue existed in the handling of\nMach-O executable files with overlapping segments. This issue was\naddressed through improved validation of segment sizes. \nCVE-ID\nCVE-2014-4455 : @PanguTeam\n\nKernel\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: A malicious application may be able to execute arbitrary\ncode with system privileges\nDescription: A validation issue existed in the handling of certain\nmetadata fields of IOSharedDataQueue objects. This issue was\naddressed through relocation of the metadata. \nCVE-ID\nCVE-2014-4461 : @PanguTeam\n\nLock Screen\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: An attacker in possession of a device may exceed the maximum\nnumber of failed passcode attempts\nDescription: In some circumstances, the failed passcode attempt\nlimit was not enforced. This issue was addressed through additional\nenforcement of this limit. \nCVE-ID\nCVE-2014-4451 : Stuart Ryan of University of Technology, Sydney\n\nLock Screen\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: A person with physical access to the phone may be able to\naccess photos in the Photo Library\nDescription: The Leave a Message option in FaceTime may have allowed\nviewing and sending photos from the device. This issue was addressed\nthrough improved state management. \nCVE-ID\nCVE-2014-4463\n\nSandbox Profiles\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: A malicious application may be able to launch arbitrary\nbinaries on a trusted device\nDescription: A permissions issue existed with the debugging\nfunctionality for iOS that allowed the spawning of applications on\ntrusted devices that were not being debugged. This was addressed by\nchanges to debugserver\u0027s sandbox. \nCVE-ID\nCVE-2014-4457 : @PanguTeam\n\nSpotlight\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: Unnecessary information is included as part of the initial\nconnection between Spotlight or Safari and the Spotlight Suggestions\nservers\nDescription: The initial connection made by Spotlight or Safari to\nthe Spotlight Suggestions servers included a user\u0027s approximate\nlocation before a user entered a query. This issue was addressed by\nremoving this information from the initial connection and only\nsending the user\u0027s approximate location as part of queries. \nCVE-ID\nCVE-2014-4453 : Ashkan Soltani\n\nWebKit\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: Visiting a maliciously crafted website may lead to an\nunexpected application termination or arbitrary code execution\nDescription: Multiple memory corruption issues existed in WebKit. \nThese issues were addressed through improved memory handling. \nCVE-ID\nCVE-2014-4452\nCVE-2014-4462\n\n\nInstallation note:\n\nThis update is available through iTunes and Software Update on your\niOS device, and will not appear in your computer\u0027s Software Update\napplication, or in the Apple Downloads site. Make sure you have an\nInternet connection and have installed the latest version of iTunes\nfrom www.apple.com/itunes/\n\niTunes and Software Update on the device will automatically check\nApple\u0027s update server on its weekly schedule. When an update is\ndetected, it is downloaded and the option to be installed is\npresented to the user when the iOS device is docked. We recommend\napplying the update immediately if possible. Selecting Don\u0027t Install\nwill present the option the next time you connect your iOS device. \n\nThe automatic update process may take up to a week depending on the\nday that iTunes or the device checks for updates. You may manually\nobtain the update via the Check for Updates button within iTunes, or\nthe Software Update on your device. \n\nTo check that the iPhone, iPod touch, or iPad has been updated:\n\n* Navigate to Settings\n* Select General\n* Select About. The version after applying this update\nwill be \"8.1.1\". \n\nInformation will also be posted to the Apple Security Updates\nweb site: http://support.apple.com/kb/HT1222\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG/MacGPG2 v2.0.22 (Darwin)\nComment: GPGTools - http://gpgtools.org\n\niQIcBAEBAgAGBQJUajYFAAoJEBcWfLTuOo7tGxsP/RccLDIt/LMluE7bcG9NSz4w\ntw8AHhkfiDZ+T/nnhqAiS2RQ2cgSfMg8KVzCtbrtXrEgebFTUVlos1vIjMSEkqgp\nGmSDFn64vZIExVo8w9iTLG/AdW0sERz3h2xVSEr/154AG2SHnL1+nY5abHHycTIG\nUuo60+t2OVPtREIcrffmwj6hsYAX1dLAI0QV7PdvjpCc82Snf+yJZCFyjQ23AkQn\nP9NElRnK+pbhqqnfZXKO3Hbgf5IkuzeSl4Rwrj8nehu+hcEp32a8zH2wbbzDsFTO\nAyM02SAGLmBM30QcoJYK/s0lCGJBbr9rM5+9dUH6KXc8q/OTLJ0YETdHqwsO29cf\nXEl5uQT4IHGjlij2f/xYsa0OXbLfyXNeaT5YGlUSIUKNFXRhD6rPccL5V5Ktjnac\nJxOv0og5L4OBtPykc0XhmRqTIkEC4Cf3RmewA+b8ivsp/LuPjYsdfN1tZ8MXa1a8\nC7hhUQSSSTtA3v7oO/LpU8Qw7kV79SkeQcYYTP07QI87cU2HHDejBHCfGjK9cz65\nUf4Sa/leCT0JyQYnx0XOafFTzxIJ2641HtTjuQ3sTKungkE5CR/KyVk2Wul3YqcA\nMeo//heYRLNa1XANfzV70TcsnQ2lcirzOqiufC+jljsfkQtlAXWim9H9BCc4102b\nugp50lE7/p+CbwYvqaZg\n=x/RM\n-----END PGP SIGNATURE-----\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2014-4462"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-005518"
},
{
"db": "BID",
"id": "71142"
},
{
"db": "VULHUB",
"id": "VHN-72402"
},
{
"db": "PACKETSTORM",
"id": "129158"
},
{
"db": "PACKETSTORM",
"id": "129163"
}
],
"trust": 2.16
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2014-4462",
"trust": 3.0
},
{
"db": "BID",
"id": "71142",
"trust": 2.0
},
{
"db": "SECUNIA",
"id": "62505",
"trust": 1.7
},
{
"db": "SECUNIA",
"id": "62504",
"trust": 1.7
},
{
"db": "SECTRACK",
"id": "1031231",
"trust": 1.7
},
{
"db": "JVNDB",
"id": "JVNDB-2014-005518",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201411-315",
"trust": 0.7
},
{
"db": "VULHUB",
"id": "VHN-72402",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "129158",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "129163",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-72402"
},
{
"db": "BID",
"id": "71142"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-005518"
},
{
"db": "PACKETSTORM",
"id": "129158"
},
{
"db": "PACKETSTORM",
"id": "129163"
},
{
"db": "CNNVD",
"id": "CNNVD-201411-315"
},
{
"db": "NVD",
"id": "CVE-2014-4462"
}
]
},
"id": "VAR-201411-0493",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-72402"
}
],
"trust": 0.01
},
"last_update_date": "2024-11-23T20:33:55.957000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "APPLE-SA-2014-11-17-1",
"trust": 0.8,
"url": "http://lists.apple.com/archives/security-announce/2014/Nov/msg00000.html"
},
{
"title": "APPLE-SA-2014-11-17-3",
"trust": 0.8,
"url": "http://lists.apple.com/archives/security-announce/2014/Nov/msg00002.html"
},
{
"title": "HT6592",
"trust": 0.8,
"url": "https://support.apple.com/en-eu/HT6592"
},
{
"title": "HT6590",
"trust": 0.8,
"url": "https://support.apple.com/en-eu/HT6590"
},
{
"title": "HT6590",
"trust": 0.8,
"url": "https://support.apple.com/ja-jp/HT6590"
},
{
"title": "HT6592",
"trust": 0.8,
"url": "https://support.apple.com/ja-jp/HT6592"
},
{
"title": "OSXUpd10.10.1",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=52402"
},
{
"title": "iPhone7,2_8.1.1_12B436_Restore",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=52401"
},
{
"title": "AppleTV3,1_7.0.2_12B435_Restore",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=52403"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-005518"
},
{
"db": "CNNVD",
"id": "CNNVD-201411-315"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-399",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-72402"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-005518"
},
{
"db": "NVD",
"id": "CVE-2014-4462"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "http://lists.apple.com/archives/security-announce/2014/nov/msg00000.html"
},
{
"trust": 1.7,
"url": "http://lists.apple.com/archives/security-announce/2014/nov/msg00002.html"
},
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/71142"
},
{
"trust": 1.7,
"url": "https://support.apple.com/en-us/ht204418"
},
{
"trust": 1.7,
"url": "https://support.apple.com/en-us/ht6590"
},
{
"trust": 1.7,
"url": "https://support.apple.com/en-us/ht6592"
},
{
"trust": 1.7,
"url": "http://www.securitytracker.com/id/1031231"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/62504"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/62505"
},
{
"trust": 1.7,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/98772"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-4462"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-4462"
},
{
"trust": 0.3,
"url": "http://www.apple.com/ipad/"
},
{
"trust": 0.3,
"url": "http://www.apple.com/iphone/"
},
{
"trust": 0.3,
"url": "http://www.apple.com/ipodtouch/"
},
{
"trust": 0.3,
"url": "http://www.webkit.org/"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4462"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4455"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4461"
},
{
"trust": 0.2,
"url": "https://www.apple.com/support/security/pgp/"
},
{
"trust": 0.2,
"url": "http://support.apple.com/kb/ht1222"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4452"
},
{
"trust": 0.2,
"url": "http://gpgtools.org"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4460"
},
{
"trust": 0.1,
"url": "https://www.apple.com/itunes/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4457"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4453"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4463"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4451"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-72402"
},
{
"db": "BID",
"id": "71142"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-005518"
},
{
"db": "PACKETSTORM",
"id": "129158"
},
{
"db": "PACKETSTORM",
"id": "129163"
},
{
"db": "CNNVD",
"id": "CNNVD-201411-315"
},
{
"db": "NVD",
"id": "CVE-2014-4462"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-72402"
},
{
"db": "BID",
"id": "71142"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-005518"
},
{
"db": "PACKETSTORM",
"id": "129158"
},
{
"db": "PACKETSTORM",
"id": "129163"
},
{
"db": "CNNVD",
"id": "CNNVD-201411-315"
},
{
"db": "NVD",
"id": "CVE-2014-4462"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-11-18T00:00:00",
"db": "VULHUB",
"id": "VHN-72402"
},
{
"date": "2014-11-17T00:00:00",
"db": "BID",
"id": "71142"
},
{
"date": "2014-11-19T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-005518"
},
{
"date": "2014-11-19T00:41:28",
"db": "PACKETSTORM",
"id": "129158"
},
{
"date": "2014-11-19T01:30:54",
"db": "PACKETSTORM",
"id": "129163"
},
{
"date": "2014-11-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201411-315"
},
{
"date": "2014-11-18T11:59:09.687000",
"db": "NVD",
"id": "CVE-2014-4462"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-03-08T00:00:00",
"db": "VULHUB",
"id": "VHN-72402"
},
{
"date": "2014-12-10T14:57:00",
"db": "BID",
"id": "71142"
},
{
"date": "2014-11-19T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-005518"
},
{
"date": "2019-03-13T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201411-315"
},
{
"date": "2024-11-21T02:10:14.687000",
"db": "NVD",
"id": "CVE-2014-4462"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "specific network environment",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201411-315"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Apple iOS and Apple TV Used in etc. Webkit Vulnerable to arbitrary code execution",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-005518"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "resource management error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201411-315"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…