var-201702-0885
Vulnerability from variot
An issue was discovered in certain Apple products. GarageBand before 10.1.5 is affected. Logic Pro X before 10.3 is affected. The issue involves the "Projects" component, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted GarageBand project file. Apple From GarageBand and Logic Pro X An update for has been released.Crafted GarageBand An arbitrary code may be executed by opening the project file. Attackers can exploit this issue to execute arbitrary code on the affected system. Failed exploit attempts may result in a denial-of-service condition. CVE-2017-2372: Tyler Bohan of Cisco Talos
Installation note:
GarageBand 10.1.5 may be obtained from the Mac App Store.
Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org
iQIcBAEBCgAGBQJYf8YgAAoJEIOj74w0bLRGWiQP+gNnna3Ha0pOdJr/u3LHf/tN tpX/lArjvo8ELpqb8wc5iCDXmSq7BgrnOV2T+XNI0XtE1md0xkQ3ttfTmSWB33Nh ylVaHytLC/Xy5JqOYjuD9NWwo9wBdT+/6m1jMymUvaSs+QS3wNn64v0gp75zGKBh UW9LJHDAAzfWui2rL2Rw3Iyuk2tGAO7QmEdTjfKZ7p+wcWjz3A61LYorVVxlZOO+ d6ir0mleQudZWB55hidm0z5d3x5GWhQ9jWWgI6fdD8DvEXrQfE60bnQZEMQzplgk bGE9ZPASl41Y3rzfLb8M5c7Rfth2sWijOOTDfGiIzaXBH293S6iyfzwONnoL9eTH WeR8Em4Dbp5YpMoMoEPUR+Bx2pOgZWAPbbErn4uvP8quC1DcKQ/WzObOb/m5XfE6 /jUvV6dI1f/jNutt9uzs/y54qzoQxJDQXm6lqWo0PvlMbEOiSWUlH0ierwMpxAaG dw1EjizczK9JoLseNc8YTAYyjEvhx7BMZuRiZjmHuHzfSaTvD4Gl/8w+KTEmsIkf V0R1F6IK6gFxRphHvfY2SkDVvgYk0eHCSXq9pkPDShElJR38Iu+a4vvXOjSGkOHL h2mAUdnNalF9zyyVX2oCfgHnxtuI8dvNQDHQjYS+xmcd00VmJm63WFgT72fOzVvP n5gdgHkBKUmF+lzYVHtj =4J27 -----END PGP SIGNATURE-----
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", "affected_products": { "@id": "https://www.variotdbs.pl/ref/affected_products" }, "configurations": { "@id": "https://www.variotdbs.pl/ref/configurations" }, "credits": { "@id": "https://www.variotdbs.pl/ref/credits" }, "cvss": { "@id": "https://www.variotdbs.pl/ref/cvss/" }, "description": { "@id": "https://www.variotdbs.pl/ref/description/" }, "exploit_availability": { "@id": "https://www.variotdbs.pl/ref/exploit_availability/" }, "external_ids": { "@id": "https://www.variotdbs.pl/ref/external_ids/" }, "iot": { "@id": "https://www.variotdbs.pl/ref/iot/" }, "iot_taxonomy": { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/" }, "patch": { "@id": "https://www.variotdbs.pl/ref/patch/" }, "problemtype_data": { "@id": "https://www.variotdbs.pl/ref/problemtype_data/" }, "references": { "@id": "https://www.variotdbs.pl/ref/references/" }, "sources": { "@id": "https://www.variotdbs.pl/ref/sources/" }, "sources_release_date": { "@id": "https://www.variotdbs.pl/ref/sources_release_date/" }, "sources_update_date": { "@id": "https://www.variotdbs.pl/ref/sources_update_date/" }, "threat_type": { "@id": "https://www.variotdbs.pl/ref/threat_type/" }, "title": { "@id": "https://www.variotdbs.pl/ref/title/" }, "type": { "@id": "https://www.variotdbs.pl/ref/type/" } }, "@id": "https://www.variotdbs.pl/vuln/VAR-201702-0885", "affected_products": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "model": "logic pro x", "scope": "lte", "trust": 1.0, "vendor": "apple", "version": "10.2.4" }, { "model": "garageband", "scope": "lte", "trust": 1.0, "vendor": "apple", "version": "10.1.4" }, { "model": "garageband", "scope": "lt", "trust": 0.8, "vendor": "apple", "version": "10.1.5 earlier" }, { "model": "logic pro x", "scope": "lt", "trust": 0.8, "vendor": "apple", "version": "10.3 earlier" }, { "model": "garageband", "scope": "eq", "trust": 0.6, "vendor": "apple", "version": "10.1.4" }, { "model": "logic pro x", "scope": "eq", "trust": 0.6, "vendor": "apple", "version": "10.2.4" }, { "model": "mac os", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.10.5" }, { "model": "mac os", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.10" }, { "model": "mac os", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.10.4" }, { "model": "mac os", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.10.3" }, { "model": "mac os", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.10.2" }, { "model": "mac os", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.10.1" }, { "model": "logic pro", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.2" }, { "model": "logic pro", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.1" }, { "model": "garageband", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "10.1" }, { "model": "logic pro", "scope": "ne", "trust": 0.3, "vendor": "apple", "version": "x10.3" }, { "model": "garageband", "scope": "ne", "trust": 0.3, "vendor": "apple", "version": "10.1.5" } ], "sources": [ { "db": "BID", "id": "95627" }, { "db": "JVNDB", "id": "JVNDB-2017-001056" }, { "db": "CNNVD", "id": "CNNVD-201701-793" }, { "db": "NVD", "id": "CVE-2017-2372" } ] }, "configurations": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", "children": { "@container": "@list" }, "cpe_match": { "@container": "@list" }, "data": { "@container": "@list" }, "nodes": { "@container": "@list" } }, "data": [ { "CVE_data_version": "4.0", "nodes": [ { "cpe_match": [ { "cpe22Uri": "cpe:/a:apple:garageband", "vulnerable": true }, { "cpe22Uri": "cpe:/a:apple:logic_pro_x", "vulnerable": true } ], "operator": "OR" } ] } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2017-001056" } ] }, "credits": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Tyler Bohan of Cisco Talos", "sources": [ { "db": "BID", "id": "95627" }, { "db": "CNNVD", "id": "CNNVD-201701-793" } ], "trust": 0.9 }, "cve": "CVE-2017-2372", "cvss": { "@context": { "cvssV2": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2" }, "cvssV3": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/" }, "severity": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#" }, "@id": "https://www.variotdbs.pl/ref/cvss/severity" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "cvssV2": [ { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "author": "nvd@nist.gov", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "exploitabilityScore": 8.6, "id": "CVE-2017-2372", "impactScore": 6.4, "integrityImpact": "PARTIAL", "severity": "MEDIUM", "trust": 1.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "author": "VULHUB", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "exploitabilityScore": 8.6, "id": "VHN-110575", "impactScore": 6.4, "integrityImpact": "PARTIAL", "severity": "MEDIUM", "trust": 0.1, "vectorString": "AV:N/AC:M/AU:N/C:P/I:P/A:P", "version": "2.0" } ], "cvssV3": [ { "attackComplexity": "LOW", "attackVector": "NETWORK", "author": "nvd@nist.gov", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "exploitabilityScore": 2.8, "id": "CVE-2017-2372", "impactScore": 5.9, "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "trust": 1.8, "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" } ], "severity": [ { "author": "nvd@nist.gov", "id": "CVE-2017-2372", "trust": 1.0, "value": "HIGH" }, { "author": "NVD", "id": "CVE-2017-2372", "trust": 0.8, "value": "High" }, { "author": "CNNVD", "id": "CNNVD-201701-793", "trust": 0.6, "value": "MEDIUM" }, { "author": "VULHUB", "id": "VHN-110575", "trust": 0.1, "value": "MEDIUM" } ] } ], "sources": [ { "db": "VULHUB", "id": "VHN-110575" }, { "db": "JVNDB", "id": "JVNDB-2017-001056" }, { "db": "CNNVD", "id": "CNNVD-201701-793" }, { "db": "NVD", "id": "CVE-2017-2372" } ] }, "description": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "An issue was discovered in certain Apple products. GarageBand before 10.1.5 is affected. Logic Pro X before 10.3 is affected. The issue involves the \"Projects\" component, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted GarageBand project file. Apple From GarageBand and Logic Pro X An update for has been released.Crafted GarageBand An arbitrary code may be executed by opening the project file. \nAttackers can exploit this issue to execute arbitrary code on the affected system. Failed exploit attempts may result in a denial-of-service condition. \nCVE-2017-2372: Tyler Bohan of Cisco Talos\n\nInstallation note:\n\nGarageBand 10.1.5 may be obtained from the Mac App Store. \n\nInformation will also be posted to the Apple Security Updates\nweb site: https://support.apple.com/kb/HT201222\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n-----BEGIN PGP SIGNATURE-----\nComment: GPGTools - https://gpgtools.org\n\niQIcBAEBCgAGBQJYf8YgAAoJEIOj74w0bLRGWiQP+gNnna3Ha0pOdJr/u3LHf/tN\ntpX/lArjvo8ELpqb8wc5iCDXmSq7BgrnOV2T+XNI0XtE1md0xkQ3ttfTmSWB33Nh\nylVaHytLC/Xy5JqOYjuD9NWwo9wBdT+/6m1jMymUvaSs+QS3wNn64v0gp75zGKBh\nUW9LJHDAAzfWui2rL2Rw3Iyuk2tGAO7QmEdTjfKZ7p+wcWjz3A61LYorVVxlZOO+\nd6ir0mleQudZWB55hidm0z5d3x5GWhQ9jWWgI6fdD8DvEXrQfE60bnQZEMQzplgk\nbGE9ZPASl41Y3rzfLb8M5c7Rfth2sWijOOTDfGiIzaXBH293S6iyfzwONnoL9eTH\nWeR8Em4Dbp5YpMoMoEPUR+Bx2pOgZWAPbbErn4uvP8quC1DcKQ/WzObOb/m5XfE6\n/jUvV6dI1f/jNutt9uzs/y54qzoQxJDQXm6lqWo0PvlMbEOiSWUlH0ierwMpxAaG\ndw1EjizczK9JoLseNc8YTAYyjEvhx7BMZuRiZjmHuHzfSaTvD4Gl/8w+KTEmsIkf\nV0R1F6IK6gFxRphHvfY2SkDVvgYk0eHCSXq9pkPDShElJR38Iu+a4vvXOjSGkOHL\nh2mAUdnNalF9zyyVX2oCfgHnxtuI8dvNQDHQjYS+xmcd00VmJm63WFgT72fOzVvP\nn5gdgHkBKUmF+lzYVHtj\n=4J27\n-----END PGP SIGNATURE-----\n\n\n\n", "sources": [ { "db": "NVD", "id": "CVE-2017-2372" }, { "db": "JVNDB", "id": "JVNDB-2017-001056" }, { "db": "BID", "id": "95627" }, { "db": "VULHUB", "id": "VHN-110575" }, { "db": "PACKETSTORM", "id": "140631" }, { "db": "PACKETSTORM", "id": "140630" } ], "trust": 2.16 }, "external_ids": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "db": "NVD", "id": "CVE-2017-2372", "trust": 3.0 }, { "db": "BID", "id": "95627", "trust": 2.0 }, { "db": "TALOS", "id": "TALOS-2016-0262", "trust": 1.1 }, { "db": "SECTRACK", "id": "1037627", "trust": 1.1 }, { "db": "JVN", "id": "JVNVU90290095", "trust": 0.8 }, { "db": "JVNDB", "id": "JVNDB-2017-001056", "trust": 0.8 }, { "db": "CNNVD", "id": "CNNVD-201701-793", "trust": 0.7 }, { "db": "PACKETSTORM", "id": "140631", "trust": 0.2 }, { "db": "PACKETSTORM", "id": "140630", "trust": 0.2 }, { "db": "SEEBUG", "id": "SSVID-96570", "trust": 0.1 }, { "db": "VULHUB", "id": "VHN-110575", "trust": 0.1 } ], "sources": [ { "db": "VULHUB", "id": "VHN-110575" }, { "db": "BID", "id": "95627" }, { "db": "JVNDB", "id": "JVNDB-2017-001056" }, { "db": "PACKETSTORM", "id": "140631" }, { "db": "PACKETSTORM", "id": "140630" }, { "db": "CNNVD", "id": "CNNVD-201701-793" }, { "db": "NVD", "id": "CVE-2017-2372" } ] }, "id": "VAR-201702-0885", "iot": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": true, "sources": [ { "db": "VULHUB", "id": "VHN-110575" } ], "trust": 0.01 }, "last_update_date": "2024-11-23T22:52:33.324000Z", "patch": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "title": "HT207477 (About the security content of GarageBand 10.1.5)", "trust": 0.8, "url": "https://support.apple.com/en-us/HT207477" }, { "title": "HT207476 (About the security content of Logic Pro X 10.3)", "trust": 0.8, "url": "https://support.apple.com/en-us/HT207476" }, { "title": "HT207476", "trust": 0.8, "url": "https://support.apple.com/ja-jp/HT207476" }, { "title": "HT207477", "trust": 0.8, "url": "https://support.apple.com/ja-jp/HT207477" }, { "title": "Apple Logic Pro X and GarageBand Security vulnerabilities", "trust": 0.6, "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=67351" } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2017-001056" }, { "db": "CNNVD", "id": "CNNVD-201701-793" } ] }, "problemtype_data": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "problemtype": "CWE-119", "trust": 1.9 } ], "sources": [ { "db": "VULHUB", "id": "VHN-110575" }, { "db": "JVNDB", "id": "JVNDB-2017-001056" }, { "db": "NVD", "id": "CVE-2017-2372" } ] }, "references": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "trust": 1.7, "url": "http://www.securityfocus.com/bid/95627" }, { "trust": 1.7, "url": "https://support.apple.com/ht207476" }, { "trust": 1.7, "url": "https://support.apple.com/ht207477" }, { "trust": 1.1, "url": "http://www.talosintelligence.com/reports/talos-2016-0262/" }, { "trust": 1.1, "url": "http://www.securitytracker.com/id/1037627" }, { "trust": 0.8, "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-2372" }, { "trust": 0.8, "url": "http://jvn.jp/cert/jvnvu90290095" }, { "trust": 0.8, "url": "https://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2017-2372" }, { "trust": 0.3, "url": "https://www.apple.com/" }, { "trust": 0.2, "url": "https://support.apple.com/kb/ht201222" }, { "trust": 0.2, "url": "https://nvd.nist.gov/vuln/detail/cve-2017-2372" }, { "trust": 0.2, "url": "https://www.apple.com/support/security/pgp/" }, { "trust": 0.2, "url": "https://gpgtools.org" } ], "sources": [ { "db": "VULHUB", "id": "VHN-110575" }, { "db": "BID", "id": "95627" }, { "db": "JVNDB", "id": "JVNDB-2017-001056" }, { "db": "PACKETSTORM", "id": "140631" }, { "db": "PACKETSTORM", "id": "140630" }, { "db": "CNNVD", "id": "CNNVD-201701-793" }, { "db": "NVD", "id": "CVE-2017-2372" } ] }, "sources": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", "data": { "@container": "@list" } }, "data": [ { "db": "VULHUB", "id": "VHN-110575" }, { "db": "BID", "id": "95627" }, { "db": "JVNDB", "id": "JVNDB-2017-001056" }, { "db": "PACKETSTORM", "id": "140631" }, { "db": "PACKETSTORM", "id": "140630" }, { "db": "CNNVD", "id": "CNNVD-201701-793" }, { "db": "NVD", "id": "CVE-2017-2372" } ] }, "sources_release_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2017-02-20T00:00:00", "db": "VULHUB", "id": "VHN-110575" }, { "date": "2017-01-18T00:00:00", "db": "BID", "id": "95627" }, { "date": "2017-01-23T00:00:00", "db": "JVNDB", "id": "JVNDB-2017-001056" }, { "date": "2017-01-20T01:45:28", "db": "PACKETSTORM", "id": "140631" }, { "date": "2017-01-20T01:43:41", "db": "PACKETSTORM", "id": "140630" }, { "date": "2017-01-20T00:00:00", "db": "CNNVD", "id": "CNNVD-201701-793" }, { "date": "2017-02-20T08:59:05.400000", "db": "NVD", "id": "CVE-2017-2372" } ] }, "sources_update_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2017-07-26T00:00:00", "db": "VULHUB", "id": "VHN-110575" }, { "date": "2017-01-23T01:11:00", "db": "BID", "id": "95627" }, { "date": "2017-01-23T00:00:00", "db": "JVNDB", "id": "JVNDB-2017-001056" }, { "date": "2017-02-27T00:00:00", "db": "CNNVD", "id": "CNNVD-201701-793" }, { "date": "2024-11-21T03:23:23.550000", "db": "NVD", "id": "CVE-2017-2372" } ] }, "threat_type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "remote", "sources": [ { "db": "CNNVD", "id": "CNNVD-201701-793" } ], "trust": 0.6 }, "title": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Apple GarageBand and Logic Pro X Update for vulnerabilities", "sources": [ { "db": "JVNDB", "id": "JVNDB-2017-001056" } ], "trust": 0.8 }, "type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "buffer overflow", "sources": [ { "db": "CNNVD", "id": "CNNVD-201701-793" } ], "trust": 0.6 } }
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.