var-201804-0438
Vulnerability from variot
An issue was discovered in certain Apple products. iOS before 11 is affected. macOS before 10.13 is affected. tvOS before 11 is affected. watchOS before 4 is affected. The issue involves the "Kernel" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app. Apple iOS, macOS High Sierra, tvOS, and watchOS are all products of Apple Inc. in the United States. Apple iOS is an operating system developed for mobile devices; macOS High Sierra is a dedicated operating system developed for Mac computers; tvOS is a smart TV operating system; watchOS is a smart watch operating system. The following products and versions are affected: versions prior to macOS High Sierra 10.13; versions prior to watchOS 4; versions prior to tvOS 11; versions prior to iOS 11
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", affected_products: { "@id": "https://www.variotdbs.pl/ref/affected_products", }, configurations: { "@id": "https://www.variotdbs.pl/ref/configurations", }, credits: { "@id": "https://www.variotdbs.pl/ref/credits", }, cvss: { "@id": "https://www.variotdbs.pl/ref/cvss/", }, description: { "@id": "https://www.variotdbs.pl/ref/description/", }, exploit_availability: { "@id": "https://www.variotdbs.pl/ref/exploit_availability/", }, external_ids: { "@id": "https://www.variotdbs.pl/ref/external_ids/", }, iot: { "@id": "https://www.variotdbs.pl/ref/iot/", }, iot_taxonomy: { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/", }, patch: { "@id": "https://www.variotdbs.pl/ref/patch/", }, problemtype_data: { "@id": "https://www.variotdbs.pl/ref/problemtype_data/", }, references: { "@id": "https://www.variotdbs.pl/ref/references/", }, sources: { "@id": "https://www.variotdbs.pl/ref/sources/", }, sources_release_date: { "@id": "https://www.variotdbs.pl/ref/sources_release_date/", }, sources_update_date: { "@id": "https://www.variotdbs.pl/ref/sources_update_date/", }, threat_type: { "@id": "https://www.variotdbs.pl/ref/threat_type/", }, title: { "@id": "https://www.variotdbs.pl/ref/title/", }, type: { "@id": "https://www.variotdbs.pl/ref/type/", }, }, "@id": "https://www.variotdbs.pl/vuln/VAR-201804-0438", affected_products: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, "@id": "https://www.variotdbs.pl/ref/sources", }, }, data: [ { model: "tvos", scope: "lt", trust: 1, vendor: "apple", version: "11.0", }, { model: "mac os x", scope: "lt", trust: 1, vendor: "apple", version: "10.13.0", }, { model: "watchos", scope: "lt", trust: 1, vendor: "apple", version: "4.0", }, { model: "iphone os", scope: "lt", trust: 1, vendor: "apple", version: "11.0", }, { model: "mac os x", scope: "lt", trust: 0.8, vendor: "apple", version: "10.8 or later 10.13", }, { model: "ios", scope: "lt", trust: 0.8, vendor: "apple", version: "11 (ipad air or later )", }, { model: "ios", scope: "lt", trust: 0.8, vendor: "apple", version: "11 (iphone 5s or later )", }, { model: "ios", scope: "lt", trust: 0.8, vendor: "apple", version: "11 (ipod touch first 6 generation )", }, { model: "tvos", scope: "lt", trust: 0.8, vendor: "apple", version: "11 (apple tv first 4 generation )", }, { model: "watchos", scope: "lt", trust: 0.8, vendor: "apple", version: "4 (apple watch all models )", }, { model: "mac os x", scope: "eq", trust: 0.6, vendor: "apple", version: "10.3.6", }, { model: "iphone os", scope: "eq", trust: 0.6, vendor: "apple", version: "4.0.2", }, { model: "mac os x", scope: "eq", trust: 0.6, vendor: "apple", version: "10.3.1", }, { model: "iphone os", scope: "eq", trust: 0.6, vendor: "apple", version: "4.1", }, { model: "mac os x", scope: "eq", trust: 0.6, vendor: "apple", version: "10.3.9", }, { model: "mac os x", scope: "eq", trust: 0.6, vendor: "apple", version: "10.3.2", }, { model: "mac os x", scope: "eq", trust: 0.6, vendor: "apple", version: "10.4.1", }, { model: "mac os x", scope: "eq", trust: 0.6, vendor: "apple", version: "10.2.7", }, { model: "mac os x", scope: "eq", trust: 0.6, vendor: "apple", version: "10.4.0", }, { model: "mac os x", scope: "eq", trust: 0.6, vendor: "apple", version: "10.2.6", }, ], sources: [ { db: "JVNDB", id: "JVNDB-2017-013123", }, { db: "CNNVD", id: "CNNVD-201804-219", }, { db: "NVD", id: "CVE-2017-13854", }, ], }, configurations: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", children: { "@container": "@list", }, cpe_match: { "@container": "@list", }, data: { "@container": "@list", }, nodes: { "@container": "@list", }, }, data: [ { CVE_data_version: "4.0", nodes: [ { cpe_match: [ { cpe22Uri: "cpe:/o:apple:mac_os_x", vulnerable: true, }, { cpe22Uri: "cpe:/o:apple:iphone_os", vulnerable: true, }, { cpe22Uri: "cpe:/o:apple:apple_tv", vulnerable: true, }, { cpe22Uri: "cpe:/o:apple:watchos", vulnerable: true, }, ], operator: "OR", }, ], }, ], sources: [ { db: "JVNDB", id: "JVNDB-2017-013123", }, ], }, cve: "CVE-2017-13854", cvss: { "@context": { cvssV2: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#", }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2", }, cvssV3: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#", }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/", }, severity: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#", }, "@id": "https://www.variotdbs.pl/ref/cvss/severity", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, "@id": "https://www.variotdbs.pl/ref/sources", }, }, data: [ { cvssV2: [ { accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "NONE", author: "nvd@nist.gov", availabilityImpact: "COMPLETE", baseScore: 9.3, confidentialityImpact: "COMPLETE", exploitabilityScore: 8.6, id: "CVE-2017-13854", impactScore: 10, integrityImpact: "COMPLETE", severity: "HIGH", trust: 1.8, vectorString: "AV:N/AC:M/Au:N/C:C/I:C/A:C", version: "2.0", }, { accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "NONE", author: "VULHUB", availabilityImpact: "COMPLETE", baseScore: 9.3, confidentialityImpact: "COMPLETE", exploitabilityScore: 8.6, id: "VHN-104518", impactScore: 10, integrityImpact: "COMPLETE", severity: "HIGH", trust: 0.1, vectorString: "AV:N/AC:M/AU:N/C:C/I:C/A:C", version: "2.0", }, ], cvssV3: [ { attackComplexity: "LOW", attackVector: "LOCAL", author: "nvd@nist.gov", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", exploitabilityScore: 1.8, id: "CVE-2017-13854", impactScore: 5.9, integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", trust: 1.8, userInteraction: "REQUIRED", vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.0", }, ], severity: [ { author: "nvd@nist.gov", id: "CVE-2017-13854", trust: 1, value: "HIGH", }, { author: "NVD", id: "CVE-2017-13854", trust: 0.8, value: "High", }, { author: "CNNVD", id: "CNNVD-201804-219", trust: 0.6, value: "HIGH", }, { author: "VULHUB", id: "VHN-104518", trust: 0.1, value: "HIGH", }, ], }, ], sources: [ { db: "VULHUB", id: "VHN-104518", }, { db: "JVNDB", id: "JVNDB-2017-013123", }, { db: "CNNVD", id: "CNNVD-201804-219", }, { db: "NVD", id: "CVE-2017-13854", }, ], }, description: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "An issue was discovered in certain Apple products. iOS before 11 is affected. macOS before 10.13 is affected. tvOS before 11 is affected. watchOS before 4 is affected. The issue involves the \"Kernel\" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app. Apple iOS, macOS High Sierra, tvOS, and watchOS are all products of Apple Inc. in the United States. Apple iOS is an operating system developed for mobile devices; macOS High Sierra is a dedicated operating system developed for Mac computers; tvOS is a smart TV operating system; watchOS is a smart watch operating system. The following products and versions are affected: versions prior to macOS High Sierra 10.13; versions prior to watchOS 4; versions prior to tvOS 11; versions prior to iOS 11", sources: [ { db: "NVD", id: "CVE-2017-13854", }, { db: "JVNDB", id: "JVNDB-2017-013123", }, { db: "VULHUB", id: "VHN-104518", }, ], trust: 1.71, }, external_ids: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { db: "NVD", id: "CVE-2017-13854", trust: 2.5, }, { db: "JVN", id: "JVNVU99806334", trust: 0.8, }, { db: "JVNDB", id: "JVNDB-2017-013123", trust: 0.8, }, { db: "CNNVD", id: "CNNVD-201804-219", trust: 0.6, }, { db: "VULHUB", id: "VHN-104518", trust: 0.1, }, ], sources: [ { db: "VULHUB", id: "VHN-104518", }, { db: "JVNDB", id: "JVNDB-2017-013123", }, { db: "CNNVD", id: "CNNVD-201804-219", }, { db: "NVD", id: "CVE-2017-13854", }, ], }, id: "VAR-201804-0438", iot: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: true, sources: [ { db: "VULHUB", id: "VHN-104518", }, ], trust: 0.01, }, last_update_date: "2024-11-23T20:06:55.845000Z", patch: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { title: "HT208144", trust: 0.8, url: "https://support.apple.com/en-us/HT208144", }, { title: "HT208112", trust: 0.8, url: "https://support.apple.com/en-us/HT208112", }, { title: "HT208113", trust: 0.8, url: "https://support.apple.com/en-us/HT208113", }, { title: "HT208115", trust: 0.8, url: "https://support.apple.com/en-us/HT208115", }, { title: "HT208112", trust: 0.8, url: "https://support.apple.com/ja-jp/HT208112", }, { title: "HT208113", trust: 0.8, url: "https://support.apple.com/ja-jp/HT208113", }, { title: "HT208115", trust: 0.8, url: "https://support.apple.com/ja-jp/HT208115", }, { title: "HT208144", trust: 0.8, url: "https://support.apple.com/ja-jp/HT208144", }, { title: "Multiple Apple product Kernel Security vulnerabilities", trust: 0.6, url: "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=83071", }, ], sources: [ { db: "JVNDB", id: "JVNDB-2017-013123", }, { db: "CNNVD", id: "CNNVD-201804-219", }, ], }, problemtype_data: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { problemtype: "CWE-119", trust: 1.9, }, ], sources: [ { db: "VULHUB", id: "VHN-104518", }, { db: "JVNDB", id: "JVNDB-2017-013123", }, { db: "NVD", id: "CVE-2017-13854", }, ], }, references: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { trust: 1.7, url: "https://support.apple.com/ht208112", }, { trust: 1.7, url: "https://support.apple.com/ht208113", }, { trust: 1.7, url: "https://support.apple.com/ht208115", }, { trust: 1.7, url: "https://support.apple.com/ht208144", }, { trust: 0.8, url: "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-13854", }, { trust: 0.8, url: "http://jvn.jp/vu/jvnvu99806334/index.html", }, { trust: 0.8, url: "https://nvd.nist.gov/vuln/detail/cve-2017-13854", }, ], sources: [ { db: "VULHUB", id: "VHN-104518", }, { db: "JVNDB", id: "JVNDB-2017-013123", }, { db: "CNNVD", id: "CNNVD-201804-219", }, { db: "NVD", id: "CVE-2017-13854", }, ], }, sources: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", data: { "@container": "@list", }, }, data: [ { db: "VULHUB", id: "VHN-104518", }, { db: "JVNDB", id: "JVNDB-2017-013123", }, { db: "CNNVD", id: "CNNVD-201804-219", }, { db: "NVD", id: "CVE-2017-13854", }, ], }, sources_release_date: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", data: { "@container": "@list", }, }, data: [ { date: "2018-04-03T00:00:00", db: "VULHUB", id: "VHN-104518", }, { date: "2018-06-01T00:00:00", db: "JVNDB", id: "JVNDB-2017-013123", }, { date: "2018-04-04T00:00:00", db: "CNNVD", id: "CNNVD-201804-219", }, { date: "2018-04-03T06:29:00.687000", db: "NVD", id: "CVE-2017-13854", }, ], }, sources_update_date: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", data: { "@container": "@list", }, }, data: [ { date: "2019-03-08T00:00:00", db: "VULHUB", id: "VHN-104518", }, { date: "2018-06-01T00:00:00", db: "JVNDB", id: "JVNDB-2017-013123", }, { date: "2019-03-13T00:00:00", db: "CNNVD", id: "CNNVD-201804-219", }, { date: "2024-11-21T03:11:48.267000", db: "NVD", id: "CVE-2017-13854", }, ], }, threat_type: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "local", sources: [ { db: "CNNVD", id: "CNNVD-201804-219", }, ], trust: 0.6, }, title: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "plural Apple Vulnerability in the kernel component of a product that allows arbitrary code execution in privileged contexts", sources: [ { db: "JVNDB", id: "JVNDB-2017-013123", }, ], trust: 0.8, }, type: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "buffer error", sources: [ { db: "CNNVD", id: "CNNVD-201804-219", }, ], trust: 0.6, }, }
Log in or create an account to share your comment.
This schema specifies the format of a comment related to a security advisory.
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.