Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2013-6835 (GCVE-0-2013-6835)
Vulnerability from cvelistv5 – Published: 2014-03-14 10:00 – Updated: 2024-08-06 17:46
VLAI?
EPSS
Summary
TelephonyUI Framework in Apple iOS 7 before 7.1, when Safari is used, does not require user confirmation for FaceTime audio calls, which allows remote attackers to obtain telephone number or e-mail address information via a facetime-audio: URL.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T17:46:23.794Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20140310 [CVE-2013-6835] - iOS 7.0.6 Safari/Facetime-Audio Privacy issue",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://seclists.org/bugtraq/2014/Mar/63"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://support.apple.com/kb/HT6441"
},
{
"name": "66108",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/66108"
},
{
"name": "APPLE-SA-2014-09-17-1",
"tags": [
"vendor-advisory",
"x_refsource_APPLE",
"x_transferred"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://support.apple.com/kb/HT6162"
},
{
"name": "20140311 [CVE-2013-6835] - iOS 7.0.6 Safari/Facetime-Audio Privacy issue",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2014/Mar/92"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-03-10T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "TelephonyUI Framework in Apple iOS 7 before 7.1, when Safari is used, does not require user confirmation for FaceTime audio calls, which allows remote attackers to obtain telephone number or e-mail address information via a facetime-audio: URL."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-01-04T17:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20140310 [CVE-2013-6835] - iOS 7.0.6 Safari/Facetime-Audio Privacy issue",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://seclists.org/bugtraq/2014/Mar/63"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://support.apple.com/kb/HT6441"
},
{
"name": "66108",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/66108"
},
{
"name": "APPLE-SA-2014-09-17-1",
"tags": [
"vendor-advisory",
"x_refsource_APPLE"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://support.apple.com/kb/HT6162"
},
{
"name": "20140311 [CVE-2013-6835] - iOS 7.0.6 Safari/Facetime-Audio Privacy issue",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://seclists.org/fulldisclosure/2014/Mar/92"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-6835",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "TelephonyUI Framework in Apple iOS 7 before 7.1, when Safari is used, does not require user confirmation for FaceTime audio calls, which allows remote attackers to obtain telephone number or e-mail address information via a facetime-audio: URL."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20140310 [CVE-2013-6835] - iOS 7.0.6 Safari/Facetime-Audio Privacy issue",
"refsource": "BUGTRAQ",
"url": "http://seclists.org/bugtraq/2014/Mar/63"
},
{
"name": "http://support.apple.com/kb/HT6441",
"refsource": "CONFIRM",
"url": "http://support.apple.com/kb/HT6441"
},
{
"name": "66108",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/66108"
},
{
"name": "APPLE-SA-2014-09-17-1",
"refsource": "APPLE",
"url": "http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.html"
},
{
"name": "http://support.apple.com/kb/HT6162",
"refsource": "CONFIRM",
"url": "http://support.apple.com/kb/HT6162"
},
{
"name": "20140311 [CVE-2013-6835] - iOS 7.0.6 Safari/Facetime-Audio Privacy issue",
"refsource": "FULLDISC",
"url": "http://seclists.org/fulldisclosure/2014/Mar/92"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-6835",
"datePublished": "2014-03-14T10:00:00",
"dateReserved": "2013-11-20T00:00:00",
"dateUpdated": "2024-08-06T17:46:23.794Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"fkie_nvd": {
"configurations": "[{\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"7.0.6\", \"matchCriteriaId\": \"CF3077AD-297B-4DCA-98B8-5343D24B0C15\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:apple:iphone_os:7.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"07A11433-B725-4BD6-B998-4B3637F061EC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:apple:iphone_os:7.0.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4FD62141-07B1-4E3D-80BC-25D519F90DBD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:apple:iphone_os:7.0.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D9737BD4-B4F4-4291-A1E9-B692ECBC657E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:apple:iphone_os:7.0.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B6160869-944D-4E34-BB81-6A1259D692B1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:apple:iphone_os:7.0.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"090CAC3C-4B20-46E5-A8C7-950B7E1DB5E9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:apple:iphone_os:7.0.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E96F77DD-0962-4E55-97A2-9BC2FE01D8A8\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"AE370CAA-04B3-434E-BD5B-1D87DE596C10\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"TelephonyUI Framework in Apple iOS 7 before 7.1, when Safari is used, does not require user confirmation for FaceTime audio calls, which allows remote attackers to obtain telephone number or e-mail address information via a facetime-audio: URL.\"}, {\"lang\": \"es\", \"value\": \"TelephonyUI Framework en Apple iOS 7 anterior a 7.1, cuando Safari es utilizado, no requiere confirmaci\\u00f3n de usuario para llamadas de audio FaceTime, lo que permite a atacantes remotos obtener informaci\\u00f3n de n\\u00famero de tel\\u00e9fono o direcci\\u00f3n de email a trav\\u00e9s de una URL facetime-audio:.\"}]",
"id": "CVE-2013-6835",
"lastModified": "2024-11-21T01:59:48.443",
"metrics": "{\"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:N/C:P/I:N/A:N\", \"baseScore\": 5.0, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 10.0, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
"published": "2014-03-14T10:55:05.567",
"references": "[{\"url\": \"http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://seclists.org/bugtraq/2014/Mar/63\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://seclists.org/fulldisclosure/2014/Mar/92\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://support.apple.com/kb/HT6162\", \"source\": \"cve@mitre.org\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://support.apple.com/kb/HT6441\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.securityfocus.com/bid/66108\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://seclists.org/bugtraq/2014/Mar/63\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://seclists.org/fulldisclosure/2014/Mar/92\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://support.apple.com/kb/HT6162\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://support.apple.com/kb/HT6441\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.securityfocus.com/bid/66108\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-264\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2013-6835\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2014-03-14T10:55:05.567\",\"lastModified\":\"2025-04-12T10:46:40.837\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"TelephonyUI Framework in Apple iOS 7 before 7.1, when Safari is used, does not require user confirmation for FaceTime audio calls, which allows remote attackers to obtain telephone number or e-mail address information via a facetime-audio: URL.\"},{\"lang\":\"es\",\"value\":\"TelephonyUI Framework en Apple iOS 7 anterior a 7.1, cuando Safari es utilizado, no requiere confirmaci\u00f3n de usuario para llamadas de audio FaceTime, lo que permite a atacantes remotos obtener informaci\u00f3n de n\u00famero de tel\u00e9fono o direcci\u00f3n de email a trav\u00e9s de una URL facetime-audio:.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:N/A:N\",\"baseScore\":5.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-264\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"7.0.6\",\"matchCriteriaId\":\"CF3077AD-297B-4DCA-98B8-5343D24B0C15\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:apple:iphone_os:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"07A11433-B725-4BD6-B998-4B3637F061EC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:apple:iphone_os:7.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4FD62141-07B1-4E3D-80BC-25D519F90DBD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:apple:iphone_os:7.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D9737BD4-B4F4-4291-A1E9-B692ECBC657E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:apple:iphone_os:7.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B6160869-944D-4E34-BB81-6A1259D692B1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:apple:iphone_os:7.0.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"090CAC3C-4B20-46E5-A8C7-950B7E1DB5E9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:apple:iphone_os:7.0.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E96F77DD-0962-4E55-97A2-9BC2FE01D8A8\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AE370CAA-04B3-434E-BD5B-1D87DE596C10\"}]}]}],\"references\":[{\"url\":\"http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://seclists.org/bugtraq/2014/Mar/63\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://seclists.org/fulldisclosure/2014/Mar/92\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://support.apple.com/kb/HT6162\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://support.apple.com/kb/HT6441\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityfocus.com/bid/66108\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://seclists.org/bugtraq/2014/Mar/63\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://seclists.org/fulldisclosure/2014/Mar/92\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://support.apple.com/kb/HT6162\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://support.apple.com/kb/HT6441\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/bid/66108\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
}
}
CERTFR-2014-AVI-116
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été corrigées dans les produits Apple. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un déni de service.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
References
| Title | Publication Time | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Apple TV versions ant\u00e9rieures \u00e0 6.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "Apple iOS versions ant\u00e9rieures \u00e0 7.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Apple",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2014-1252",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1252"
},
{
"name": "CVE-2013-5197",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5197"
},
{
"name": "CVE-2013-2909",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-2909"
},
{
"name": "CVE-2013-5133",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5133"
},
{
"name": "CVE-2013-5198",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5198"
},
{
"name": "CVE-2014-1271",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1271"
},
{
"name": "CVE-2012-2088",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-2088"
},
{
"name": "CVE-2013-6625",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-6625"
},
{
"name": "CVE-2014-1293",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1293"
},
{
"name": "CVE-2014-1273",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1273"
},
{
"name": "CVE-2013-6835",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-6835"
},
{
"name": "CVE-2014-1290",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1290"
},
{
"name": "CVE-2014-1277",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1277"
},
{
"name": "CVE-2014-1287",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1287"
},
{
"name": "CVE-2014-1280",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1280"
},
{
"name": "CVE-2013-5225",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5225"
},
{
"name": "CVE-2014-1282",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1282"
},
{
"name": "CVE-2014-1279",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1279"
},
{
"name": "CVE-2013-2928",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-2928"
},
{
"name": "CVE-2013-5228",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5228"
},
{
"name": "CVE-2014-1278",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1278"
},
{
"name": "CVE-2013-6629",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-6629"
},
{
"name": "CVE-2014-1267",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1267"
},
{
"name": "CVE-2014-1269",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1269"
},
{
"name": "CVE-2013-2926",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-2926"
},
{
"name": "CVE-2014-1281",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1281"
},
{
"name": "CVE-2014-1276",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1276"
},
{
"name": "CVE-2013-5199",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5199"
},
{
"name": "CVE-2013-5196",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5196"
},
{
"name": "CVE-2014-1275",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1275"
},
{
"name": "CVE-2014-1274",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1274"
},
{
"name": "CVE-2013-5227",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5227"
},
{
"name": "CVE-2014-1294",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1294"
},
{
"name": "CVE-2014-1289",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1289"
},
{
"name": "CVE-2014-1285",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1285"
},
{
"name": "CVE-2014-1291",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1291"
},
{
"name": "CVE-2014-1284",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1284"
},
{
"name": "CVE-2014-1270",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1270"
},
{
"name": "CVE-2014-1272",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1272"
},
{
"name": "CVE-2014-1286",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1286"
},
{
"name": "CVE-2013-6635",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-6635"
},
{
"name": "CVE-2014-1292",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1292"
}
],
"links": [],
"reference": "CERTFR-2014-AVI-116",
"revisions": [
{
"description": "version initiale.",
"revision_date": "2014-03-11T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "D\u00e9ni de service"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans les produits \u003cspan\nclass=\"textit\"\u003eApple\u003c/span\u003e. Certaines d\u0027entre elles permettent \u00e0 un\nattaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un\nd\u00e9ni de service \u00e0 distance et un d\u00e9ni de service.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Apple",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Apple HT6162 du 11 mars 2014",
"url": "http://support.apple.com/kb/HT6162"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Apple HT6163 du 11 mars 2014",
"url": "http://support.apple.com/kb/HT6163"
}
]
}
CERTFR-2014-AVI-393
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été corrigées dans les produits Apple. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une exécution de code arbitraire et un déni de service à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Apple | Safari | Apple Safari versions antérieures à 6.2 | ||
| Apple | N/A | Apple OS X Server versions antérieures à 3.2.1 | ||
| Apple | N/A | Apple iOS versions antérieures à 8 | ||
| Apple | N/A | Apple OS X Mavericks versions antérieures à 10.9.5 | ||
| Apple | N/A | Apple TV versions antérieures à 7 | ||
| Apple | N/A | Apple Xcode versions antérieures à 6.0.1 | ||
| Apple | Safari | Apple Safari versions antérieures à 7.1 | ||
| Apple | N/A | Apple OS X Server versions antérieures à 2.2.3 |
References
| Title | Publication Time | Tags | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Apple Safari versions ant\u00e9rieures \u00e0 6.2",
"product": {
"name": "Safari",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "Apple OS X Server versions ant\u00e9rieures \u00e0 3.2.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "Apple iOS versions ant\u00e9rieures \u00e0 8",
"product": {
"name": "N/A",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "Apple OS X Mavericks versions ant\u00e9rieures \u00e0 10.9.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "Apple TV versions ant\u00e9rieures \u00e0 7",
"product": {
"name": "N/A",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "Apple Xcode versions ant\u00e9rieures \u00e0 6.0.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "Apple Safari versions ant\u00e9rieures \u00e0 7.1",
"product": {
"name": "Safari",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "Apple OS X Server versions ant\u00e9rieures \u00e0 2.2.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Apple",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2014-4396",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4396"
},
{
"name": "CVE-2014-1389",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1389"
},
{
"name": "CVE-2014-4424",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4424"
},
{
"name": "CVE-2014-3479",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3479"
},
{
"name": "CVE-2014-4394",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4394"
},
{
"name": "CVE-2014-0238",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0238"
},
{
"name": "CVE-2014-1348",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1348"
},
{
"name": "CVE-2014-4410",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4410"
},
{
"name": "CVE-2014-0063",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0063"
},
{
"name": "CVE-2014-0207",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0207"
},
{
"name": "CVE-2014-4369",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4369"
},
{
"name": "CVE-2014-4378",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4378"
},
{
"name": "CVE-2014-4379",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4379"
},
{
"name": "CVE-2014-4375",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4375"
},
{
"name": "CVE-2014-4406",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4406"
},
{
"name": "CVE-2014-0061",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0061"
},
{
"name": "CVE-2014-4377",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4377"
},
{
"name": "CVE-2014-4395",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4395"
},
{
"name": "CVE-2014-4418",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4418"
},
{
"name": "CVE-2014-4399",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4399"
},
{
"name": "CVE-2014-4397",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4397"
},
{
"name": "CVE-2013-6835",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-6835"
},
{
"name": "CVE-2014-4366",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4366"
},
{
"name": "CVE-2014-4422",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4422"
},
{
"name": "CVE-2014-4367",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4367"
},
{
"name": "CVE-2014-4398",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4398"
},
{
"name": "CVE-2014-4380",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4380"
},
{
"name": "CVE-2014-0185",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0185"
},
{
"name": "CVE-2014-4364",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4364"
},
{
"name": "CVE-2014-4372",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4372"
},
{
"name": "CVE-2014-4362",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4362"
},
{
"name": "CVE-2014-0032",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0032"
},
{
"name": "CVE-2014-4415",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4415"
},
{
"name": "CVE-2014-4411",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4411"
},
{
"name": "CVE-2014-4350",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4350"
},
{
"name": "CVE-2014-3515",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3515"
},
{
"name": "CVE-2014-1385",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1385"
},
{
"name": "CVE-2014-4368",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4368"
},
{
"name": "CVE-2014-0237",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0237"
},
{
"name": "CVE-2014-4409",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4409"
},
{
"name": "CVE-2014-4403",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4403"
},
{
"name": "CVE-2014-4405",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4405"
},
{
"name": "CVE-2014-4416",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4416"
},
{
"name": "CVE-2014-4401",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4401"
},
{
"name": "CVE-2014-2525",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-2525"
},
{
"name": "CVE-2014-4374",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4374"
},
{
"name": "CVE-2014-0221",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0221"
},
{
"name": "CVE-2014-1388",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1388"
},
{
"name": "CVE-2014-4421",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4421"
},
{
"name": "CVE-2014-1360",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1360"
},
{
"name": "CVE-2014-0195",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0195"
},
{
"name": "CVE-2013-6663",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-6663"
},
{
"name": "CVE-2014-4413",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4413"
},
{
"name": "CVE-2014-4376",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4376"
},
{
"name": "CVE-2014-4356",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4356"
},
{
"name": "CVE-2014-4386",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4386"
},
{
"name": "CVE-2014-1943",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1943"
},
{
"name": "CVE-2014-4381",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4381"
},
{
"name": "CVE-2014-4404",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4404"
},
{
"name": "CVE-2014-4353",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4353"
},
{
"name": "CVE-2014-1384",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1384"
},
{
"name": "CVE-2014-4383",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4383"
},
{
"name": "CVE-2014-4390",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4390"
},
{
"name": "CVE-2014-4423",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4423"
},
{
"name": "CVE-2014-4412",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4412"
},
{
"name": "CVE-2014-4419",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4419"
},
{
"name": "CVE-2014-4420",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4420"
},
{
"name": "CVE-2014-1387",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1387"
},
{
"name": "CVE-2014-0224",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0224"
},
{
"name": "CVE-2014-4384",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4384"
},
{
"name": "CVE-2014-4363",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4363"
},
{
"name": "CVE-2014-4400",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4400"
},
{
"name": "CVE-2014-1391",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1391"
},
{
"name": "CVE-2014-4408",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4408"
},
{
"name": "CVE-2014-0064",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0064"
},
{
"name": "CVE-2014-0065",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0065"
},
{
"name": "CVE-2014-4407",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4407"
},
{
"name": "CVE-2014-3480",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3480"
},
{
"name": "CVE-2014-3478",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3478"
},
{
"name": "CVE-2014-3470",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3470"
},
{
"name": "CVE-2014-3981",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3981"
},
{
"name": "CVE-2014-4361",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4361"
},
{
"name": "CVE-2014-0062",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0062"
},
{
"name": "CVE-2013-7345",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-7345"
},
{
"name": "CVE-2014-4389",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4389"
},
{
"name": "CVE-2014-4357",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4357"
},
{
"name": "CVE-2013-5227",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5227"
},
{
"name": "CVE-2014-4979",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4979"
},
{
"name": "CVE-2014-0076",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0076"
},
{
"name": "CVE-2014-4371",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4371"
},
{
"name": "CVE-2014-4402",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4402"
},
{
"name": "CVE-2014-4373",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4373"
},
{
"name": "CVE-2014-4393",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4393"
},
{
"name": "CVE-2014-2270",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-2270"
},
{
"name": "CVE-2014-4352",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4352"
},
{
"name": "CVE-2014-0060",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0060"
},
{
"name": "CVE-2014-4414",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4414"
},
{
"name": "CVE-2014-4354",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4354"
},
{
"name": "CVE-2014-4388",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4388"
},
{
"name": "CVE-2014-3487",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3487"
},
{
"name": "CVE-2014-4049",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4049"
},
{
"name": "CVE-2011-2391",
"url": "https://www.cve.org/CVERecord?id=CVE-2011-2391"
},
{
"name": "CVE-2014-0066",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0066"
}
],
"links": [],
"reference": "CERTFR-2014-AVI-393",
"revisions": [
{
"description": "version initiale.",
"revision_date": "2014-09-18T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
},
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "D\u00e9ni de service"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans les produits \u003cspan\nclass=\"textit\"\u003eApple\u003c/span\u003e. Certaines d\u0027entre elles permettent \u00e0 un\nattaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une\nex\u00e9cution de code arbitraire et un d\u00e9ni de service \u00e0 distance.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Apple",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Apple HT6449 du 17 septembre 2014",
"url": "http://support.apple.com/kb/HT6449"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Apple HT6442 du 17 septembre 2014",
"url": "http://support.apple.com/kb/HT6442"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Apple HT6448 du 17 septembre 2014",
"url": "http://support.apple.com/kb/HT6448"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Apple HT6441 du 17 septembre 2014",
"url": "http://support.apple.com/kb/HT6441"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Apple HT6443 du 17 septembre 2014",
"url": "http://support.apple.com/kb/HT6443"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Apple HT6444 du 17 septembre 2014",
"url": "http://support.apple.com/kb/HT6444"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Apple HT6440 du 17 septembre 2014",
"url": "http://support.apple.com/kb/HT6440"
}
]
}
CERTFR-2014-AVI-116
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été corrigées dans les produits Apple. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un déni de service.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
References
| Title | Publication Time | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Apple TV versions ant\u00e9rieures \u00e0 6.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "Apple iOS versions ant\u00e9rieures \u00e0 7.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Apple",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2014-1252",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1252"
},
{
"name": "CVE-2013-5197",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5197"
},
{
"name": "CVE-2013-2909",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-2909"
},
{
"name": "CVE-2013-5133",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5133"
},
{
"name": "CVE-2013-5198",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5198"
},
{
"name": "CVE-2014-1271",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1271"
},
{
"name": "CVE-2012-2088",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-2088"
},
{
"name": "CVE-2013-6625",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-6625"
},
{
"name": "CVE-2014-1293",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1293"
},
{
"name": "CVE-2014-1273",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1273"
},
{
"name": "CVE-2013-6835",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-6835"
},
{
"name": "CVE-2014-1290",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1290"
},
{
"name": "CVE-2014-1277",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1277"
},
{
"name": "CVE-2014-1287",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1287"
},
{
"name": "CVE-2014-1280",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1280"
},
{
"name": "CVE-2013-5225",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5225"
},
{
"name": "CVE-2014-1282",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1282"
},
{
"name": "CVE-2014-1279",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1279"
},
{
"name": "CVE-2013-2928",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-2928"
},
{
"name": "CVE-2013-5228",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5228"
},
{
"name": "CVE-2014-1278",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1278"
},
{
"name": "CVE-2013-6629",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-6629"
},
{
"name": "CVE-2014-1267",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1267"
},
{
"name": "CVE-2014-1269",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1269"
},
{
"name": "CVE-2013-2926",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-2926"
},
{
"name": "CVE-2014-1281",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1281"
},
{
"name": "CVE-2014-1276",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1276"
},
{
"name": "CVE-2013-5199",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5199"
},
{
"name": "CVE-2013-5196",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5196"
},
{
"name": "CVE-2014-1275",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1275"
},
{
"name": "CVE-2014-1274",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1274"
},
{
"name": "CVE-2013-5227",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5227"
},
{
"name": "CVE-2014-1294",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1294"
},
{
"name": "CVE-2014-1289",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1289"
},
{
"name": "CVE-2014-1285",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1285"
},
{
"name": "CVE-2014-1291",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1291"
},
{
"name": "CVE-2014-1284",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1284"
},
{
"name": "CVE-2014-1270",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1270"
},
{
"name": "CVE-2014-1272",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1272"
},
{
"name": "CVE-2014-1286",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1286"
},
{
"name": "CVE-2013-6635",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-6635"
},
{
"name": "CVE-2014-1292",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1292"
}
],
"links": [],
"reference": "CERTFR-2014-AVI-116",
"revisions": [
{
"description": "version initiale.",
"revision_date": "2014-03-11T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "D\u00e9ni de service"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans les produits \u003cspan\nclass=\"textit\"\u003eApple\u003c/span\u003e. Certaines d\u0027entre elles permettent \u00e0 un\nattaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un\nd\u00e9ni de service \u00e0 distance et un d\u00e9ni de service.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Apple",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Apple HT6162 du 11 mars 2014",
"url": "http://support.apple.com/kb/HT6162"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Apple HT6163 du 11 mars 2014",
"url": "http://support.apple.com/kb/HT6163"
}
]
}
CERTFR-2014-AVI-393
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été corrigées dans les produits Apple. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une exécution de code arbitraire et un déni de service à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Apple | Safari | Apple Safari versions antérieures à 6.2 | ||
| Apple | N/A | Apple OS X Server versions antérieures à 3.2.1 | ||
| Apple | N/A | Apple iOS versions antérieures à 8 | ||
| Apple | N/A | Apple OS X Mavericks versions antérieures à 10.9.5 | ||
| Apple | N/A | Apple TV versions antérieures à 7 | ||
| Apple | N/A | Apple Xcode versions antérieures à 6.0.1 | ||
| Apple | Safari | Apple Safari versions antérieures à 7.1 | ||
| Apple | N/A | Apple OS X Server versions antérieures à 2.2.3 |
References
| Title | Publication Time | Tags | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Apple Safari versions ant\u00e9rieures \u00e0 6.2",
"product": {
"name": "Safari",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "Apple OS X Server versions ant\u00e9rieures \u00e0 3.2.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "Apple iOS versions ant\u00e9rieures \u00e0 8",
"product": {
"name": "N/A",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "Apple OS X Mavericks versions ant\u00e9rieures \u00e0 10.9.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "Apple TV versions ant\u00e9rieures \u00e0 7",
"product": {
"name": "N/A",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "Apple Xcode versions ant\u00e9rieures \u00e0 6.0.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "Apple Safari versions ant\u00e9rieures \u00e0 7.1",
"product": {
"name": "Safari",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "Apple OS X Server versions ant\u00e9rieures \u00e0 2.2.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Apple",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2014-4396",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4396"
},
{
"name": "CVE-2014-1389",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1389"
},
{
"name": "CVE-2014-4424",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4424"
},
{
"name": "CVE-2014-3479",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3479"
},
{
"name": "CVE-2014-4394",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4394"
},
{
"name": "CVE-2014-0238",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0238"
},
{
"name": "CVE-2014-1348",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1348"
},
{
"name": "CVE-2014-4410",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4410"
},
{
"name": "CVE-2014-0063",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0063"
},
{
"name": "CVE-2014-0207",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0207"
},
{
"name": "CVE-2014-4369",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4369"
},
{
"name": "CVE-2014-4378",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4378"
},
{
"name": "CVE-2014-4379",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4379"
},
{
"name": "CVE-2014-4375",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4375"
},
{
"name": "CVE-2014-4406",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4406"
},
{
"name": "CVE-2014-0061",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0061"
},
{
"name": "CVE-2014-4377",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4377"
},
{
"name": "CVE-2014-4395",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4395"
},
{
"name": "CVE-2014-4418",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4418"
},
{
"name": "CVE-2014-4399",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4399"
},
{
"name": "CVE-2014-4397",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4397"
},
{
"name": "CVE-2013-6835",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-6835"
},
{
"name": "CVE-2014-4366",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4366"
},
{
"name": "CVE-2014-4422",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4422"
},
{
"name": "CVE-2014-4367",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4367"
},
{
"name": "CVE-2014-4398",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4398"
},
{
"name": "CVE-2014-4380",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4380"
},
{
"name": "CVE-2014-0185",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0185"
},
{
"name": "CVE-2014-4364",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4364"
},
{
"name": "CVE-2014-4372",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4372"
},
{
"name": "CVE-2014-4362",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4362"
},
{
"name": "CVE-2014-0032",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0032"
},
{
"name": "CVE-2014-4415",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4415"
},
{
"name": "CVE-2014-4411",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4411"
},
{
"name": "CVE-2014-4350",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4350"
},
{
"name": "CVE-2014-3515",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3515"
},
{
"name": "CVE-2014-1385",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1385"
},
{
"name": "CVE-2014-4368",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4368"
},
{
"name": "CVE-2014-0237",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0237"
},
{
"name": "CVE-2014-4409",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4409"
},
{
"name": "CVE-2014-4403",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4403"
},
{
"name": "CVE-2014-4405",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4405"
},
{
"name": "CVE-2014-4416",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4416"
},
{
"name": "CVE-2014-4401",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4401"
},
{
"name": "CVE-2014-2525",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-2525"
},
{
"name": "CVE-2014-4374",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4374"
},
{
"name": "CVE-2014-0221",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0221"
},
{
"name": "CVE-2014-1388",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1388"
},
{
"name": "CVE-2014-4421",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4421"
},
{
"name": "CVE-2014-1360",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1360"
},
{
"name": "CVE-2014-0195",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0195"
},
{
"name": "CVE-2013-6663",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-6663"
},
{
"name": "CVE-2014-4413",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4413"
},
{
"name": "CVE-2014-4376",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4376"
},
{
"name": "CVE-2014-4356",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4356"
},
{
"name": "CVE-2014-4386",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4386"
},
{
"name": "CVE-2014-1943",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1943"
},
{
"name": "CVE-2014-4381",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4381"
},
{
"name": "CVE-2014-4404",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4404"
},
{
"name": "CVE-2014-4353",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4353"
},
{
"name": "CVE-2014-1384",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1384"
},
{
"name": "CVE-2014-4383",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4383"
},
{
"name": "CVE-2014-4390",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4390"
},
{
"name": "CVE-2014-4423",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4423"
},
{
"name": "CVE-2014-4412",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4412"
},
{
"name": "CVE-2014-4419",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4419"
},
{
"name": "CVE-2014-4420",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4420"
},
{
"name": "CVE-2014-1387",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1387"
},
{
"name": "CVE-2014-0224",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0224"
},
{
"name": "CVE-2014-4384",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4384"
},
{
"name": "CVE-2014-4363",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4363"
},
{
"name": "CVE-2014-4400",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4400"
},
{
"name": "CVE-2014-1391",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-1391"
},
{
"name": "CVE-2014-4408",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4408"
},
{
"name": "CVE-2014-0064",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0064"
},
{
"name": "CVE-2014-0065",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0065"
},
{
"name": "CVE-2014-4407",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4407"
},
{
"name": "CVE-2014-3480",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3480"
},
{
"name": "CVE-2014-3478",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3478"
},
{
"name": "CVE-2014-3470",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3470"
},
{
"name": "CVE-2014-3981",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3981"
},
{
"name": "CVE-2014-4361",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4361"
},
{
"name": "CVE-2014-0062",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0062"
},
{
"name": "CVE-2013-7345",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-7345"
},
{
"name": "CVE-2014-4389",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4389"
},
{
"name": "CVE-2014-4357",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4357"
},
{
"name": "CVE-2013-5227",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-5227"
},
{
"name": "CVE-2014-4979",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4979"
},
{
"name": "CVE-2014-0076",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0076"
},
{
"name": "CVE-2014-4371",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4371"
},
{
"name": "CVE-2014-4402",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4402"
},
{
"name": "CVE-2014-4373",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4373"
},
{
"name": "CVE-2014-4393",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4393"
},
{
"name": "CVE-2014-2270",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-2270"
},
{
"name": "CVE-2014-4352",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4352"
},
{
"name": "CVE-2014-0060",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0060"
},
{
"name": "CVE-2014-4414",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4414"
},
{
"name": "CVE-2014-4354",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4354"
},
{
"name": "CVE-2014-4388",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4388"
},
{
"name": "CVE-2014-3487",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3487"
},
{
"name": "CVE-2014-4049",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-4049"
},
{
"name": "CVE-2011-2391",
"url": "https://www.cve.org/CVERecord?id=CVE-2011-2391"
},
{
"name": "CVE-2014-0066",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0066"
}
],
"links": [],
"reference": "CERTFR-2014-AVI-393",
"revisions": [
{
"description": "version initiale.",
"revision_date": "2014-09-18T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
},
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "D\u00e9ni de service"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans les produits \u003cspan\nclass=\"textit\"\u003eApple\u003c/span\u003e. Certaines d\u0027entre elles permettent \u00e0 un\nattaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une\nex\u00e9cution de code arbitraire et un d\u00e9ni de service \u00e0 distance.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Apple",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Apple HT6449 du 17 septembre 2014",
"url": "http://support.apple.com/kb/HT6449"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Apple HT6442 du 17 septembre 2014",
"url": "http://support.apple.com/kb/HT6442"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Apple HT6448 du 17 septembre 2014",
"url": "http://support.apple.com/kb/HT6448"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Apple HT6441 du 17 septembre 2014",
"url": "http://support.apple.com/kb/HT6441"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Apple HT6443 du 17 septembre 2014",
"url": "http://support.apple.com/kb/HT6443"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Apple HT6444 du 17 septembre 2014",
"url": "http://support.apple.com/kb/HT6444"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Apple HT6440 du 17 septembre 2014",
"url": "http://support.apple.com/kb/HT6440"
}
]
}
FKIE_CVE-2013-6835
Vulnerability from fkie_nvd - Published: 2014-03-14 10:55 - Updated: 2025-04-12 10:46
Severity ?
Summary
TelephonyUI Framework in Apple iOS 7 before 7.1, when Safari is used, does not require user confirmation for FaceTime audio calls, which allows remote attackers to obtain telephone number or e-mail address information via a facetime-audio: URL.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CF3077AD-297B-4DCA-98B8-5343D24B0C15",
"versionEndIncluding": "7.0.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:apple:iphone_os:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "07A11433-B725-4BD6-B998-4B3637F061EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:apple:iphone_os:7.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4FD62141-07B1-4E3D-80BC-25D519F90DBD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:apple:iphone_os:7.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D9737BD4-B4F4-4291-A1E9-B692ECBC657E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:apple:iphone_os:7.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "B6160869-944D-4E34-BB81-6A1259D692B1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:apple:iphone_os:7.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "090CAC3C-4B20-46E5-A8C7-950B7E1DB5E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:apple:iphone_os:7.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "E96F77DD-0962-4E55-97A2-9BC2FE01D8A8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AE370CAA-04B3-434E-BD5B-1D87DE596C10",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "TelephonyUI Framework in Apple iOS 7 before 7.1, when Safari is used, does not require user confirmation for FaceTime audio calls, which allows remote attackers to obtain telephone number or e-mail address information via a facetime-audio: URL."
},
{
"lang": "es",
"value": "TelephonyUI Framework en Apple iOS 7 anterior a 7.1, cuando Safari es utilizado, no requiere confirmaci\u00f3n de usuario para llamadas de audio FaceTime, lo que permite a atacantes remotos obtener informaci\u00f3n de n\u00famero de tel\u00e9fono o direcci\u00f3n de email a trav\u00e9s de una URL facetime-audio:."
}
],
"id": "CVE-2013-6835",
"lastModified": "2025-04-12T10:46:40.837",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2014-03-14T10:55:05.567",
"references": [
{
"source": "cve@mitre.org",
"url": "http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.html"
},
{
"source": "cve@mitre.org",
"url": "http://seclists.org/bugtraq/2014/Mar/63"
},
{
"source": "cve@mitre.org",
"url": "http://seclists.org/fulldisclosure/2014/Mar/92"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://support.apple.com/kb/HT6162"
},
{
"source": "cve@mitre.org",
"url": "http://support.apple.com/kb/HT6441"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/66108"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://seclists.org/bugtraq/2014/Mar/63"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://seclists.org/fulldisclosure/2014/Mar/92"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://support.apple.com/kb/HT6162"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://support.apple.com/kb/HT6441"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/66108"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-264"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
GSD-2013-6835
Vulnerability from gsd - Updated: 2023-12-13 01:22Details
TelephonyUI Framework in Apple iOS 7 before 7.1, when Safari is used, does not require user confirmation for FaceTime audio calls, which allows remote attackers to obtain telephone number or e-mail address information via a facetime-audio: URL.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2013-6835",
"description": "TelephonyUI Framework in Apple iOS 7 before 7.1, when Safari is used, does not require user confirmation for FaceTime audio calls, which allows remote attackers to obtain telephone number or e-mail address information via a facetime-audio: URL.",
"id": "GSD-2013-6835",
"references": [
"https://packetstormsecurity.com/files/cve/CVE-2013-6835"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2013-6835"
],
"details": "TelephonyUI Framework in Apple iOS 7 before 7.1, when Safari is used, does not require user confirmation for FaceTime audio calls, which allows remote attackers to obtain telephone number or e-mail address information via a facetime-audio: URL.",
"id": "GSD-2013-6835",
"modified": "2023-12-13T01:22:19.295050Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-6835",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "TelephonyUI Framework in Apple iOS 7 before 7.1, when Safari is used, does not require user confirmation for FaceTime audio calls, which allows remote attackers to obtain telephone number or e-mail address information via a facetime-audio: URL."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20140310 [CVE-2013-6835] - iOS 7.0.6 Safari/Facetime-Audio Privacy issue",
"refsource": "BUGTRAQ",
"url": "http://seclists.org/bugtraq/2014/Mar/63"
},
{
"name": "http://support.apple.com/kb/HT6441",
"refsource": "CONFIRM",
"url": "http://support.apple.com/kb/HT6441"
},
{
"name": "66108",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/66108"
},
{
"name": "APPLE-SA-2014-09-17-1",
"refsource": "APPLE",
"url": "http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.html"
},
{
"name": "http://support.apple.com/kb/HT6162",
"refsource": "CONFIRM",
"url": "http://support.apple.com/kb/HT6162"
},
{
"name": "20140311 [CVE-2013-6835] - iOS 7.0.6 Safari/Facetime-Audio Privacy issue",
"refsource": "FULLDISC",
"url": "http://seclists.org/fulldisclosure/2014/Mar/92"
}
]
}
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "7.0.6",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:7.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:7.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:7.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:7.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:7.0.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:7.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-6835"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "TelephonyUI Framework in Apple iOS 7 before 7.1, when Safari is used, does not require user confirmation for FaceTime audio calls, which allows remote attackers to obtain telephone number or e-mail address information via a facetime-audio: URL."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-264"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20140310 [CVE-2013-6835] - iOS 7.0.6 Safari/Facetime-Audio Privacy issue",
"refsource": "BUGTRAQ",
"tags": [],
"url": "http://seclists.org/bugtraq/2014/Mar/63"
},
{
"name": "http://support.apple.com/kb/HT6162",
"refsource": "CONFIRM",
"tags": [
"Vendor Advisory"
],
"url": "http://support.apple.com/kb/HT6162"
},
{
"name": "20140311 [CVE-2013-6835] - iOS 7.0.6 Safari/Facetime-Audio Privacy issue",
"refsource": "FULLDISC",
"tags": [],
"url": "http://seclists.org/fulldisclosure/2014/Mar/92"
},
{
"name": "APPLE-SA-2014-09-17-1",
"refsource": "APPLE",
"tags": [],
"url": "http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.html"
},
{
"name": "66108",
"refsource": "BID",
"tags": [],
"url": "http://www.securityfocus.com/bid/66108"
},
{
"name": "http://support.apple.com/kb/HT6441",
"refsource": "CONFIRM",
"tags": [],
"url": "http://support.apple.com/kb/HT6441"
}
]
}
},
"impact": {
"baseMetricV2": {
"cvssV2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"userInteractionRequired": false
}
},
"lastModifiedDate": "2017-01-07T02:59Z",
"publishedDate": "2014-03-14T10:55Z"
}
}
}
VAR-201403-0199
Vulnerability from variot - Updated: 2023-12-18 11:48TelephonyUI Framework in Apple iOS 7 before 7.1, when Safari is used, does not require user confirmation for FaceTime audio calls, which allows remote attackers to obtain telephone number or e-mail address information via a facetime-audio: URL. Apple iOS is affected by a security-bypass vulnerability. Successfully exploiting this issue may allow an attacker to bypass certain security warnings. This may aid in further attacks. These issues affect Apple iOS versions prior to 7.1. Note: This issue was previously discussed in BID 66087 (Apple iOS APPLE-SA-2014-03-10-1 Multiple Security Vulnerabilities), but has been moved to its own record to better document it. The vulnerability is caused by Safari not asking the user before launching the facetime-audio:// URL. CVE-ID CVE-2014-1276 : Min Zheng, Hui Xue, and Dr. This issue was mitigated by using SSL and prompting the user during URL redirects. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
APPLE-SA-2014-09-17-1 iOS 8
iOS 8 is now available and addresses the following:
802.1X Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: An attacker can obtain WiFi credentials Description: An attacker could have impersonated a WiFi access point, offered to authenticate with LEAP, broken the MS-CHAPv1 hash, and used the derived credentials to authenticate to the intended access point even if that access point supported stronger authentication methods. This issue was addressed by disabling LEAP by default. CVE-ID CVE-2014-4364 : Pieter Robyns, Bram Bonne, Peter Quax, and Wim Lamotte of Universiteit Hasselt
Accounts Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A malicious application may be able to identify the Apple ID of the user Description: An issue existed in the access control logic for accounts. A sandboxed application could get information about the currently-active iCloud account, including the name of the account. This issue was addressed by restricting access to certain account types from unauthorized applications. CVE-ID CVE-2014-4423 : Adam Weaver
Certificate Trust Policy Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Update to the certificate trust policy Description: The certificate trust policy was updated. The complete list of certificates may be viewed at http://support.apple.com/kb/HT5012.
Accessibility Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: The device may not lock the screen when using AssistiveTouch Description: A logic issue existed in AssistiveTouch's handling of events, which resulted in the screen not locking. This issue was addressed through improved handling of the lock timer. CVE-ID CVE-2014-4368 : Hendrik Bettermann
Accounts Framework Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: An attacker with access to an iOS device may access sensitive user information from logs Description: Sensitive user information was logged. This issue was addressed by logging less information. CVE-ID CVE-2014-4357 : Heli Myllykoski of OP-Pohjola Group
Address Book Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A person with physical access to an iOS device may read the address book Description: The address book was encrypted with a key protected only by the hardware UID. This issue was addressed by encrypting the address book with a key protected by the hardware UID and the user's passcode. CVE-ID CVE-2014-4352 : Jonathan Zdziarski
App Installation Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A local attacker may be able to escalate privileges and install unverified applications Description: A race condition existed in App Installation. An attacker with the capability of writing to /tmp may have been able to install an unverified app. This issue was addressed by staging files for installation in another directory. CVE-ID CVE-2014-4386 : evad3rs
App Installation Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A local attacker may be able to escalate privileges and install unverified applications Description: A path traversal issue existed in App Installation. A local attacker could have retargeted code signature validation to a bundle different from the one being installed and cause installation of an unverified app. This issue was addressed by detecting and preventing path traversal when determining which code signature to verify. CVE-ID CVE-2014-4384 : evad3rs
Assets Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: An attacker with a privileged network position may be able to cause an iOS device to think that it is up to date even when it is not Description: A validation issue existed in the handling of update check responses. Spoofed dates from Last-Modified response headers set to future dates were used for If-Modified-Since checks in subsequent update requests. This issue was addressed by validation of the Last-Modified header. CVE-ID CVE-2014-4383 : Raul Siles of DinoSec
Bluetooth Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Bluetooth is unexpectedly enabled by default after upgrading iOS Description: Bluetooth was enabled automatically after upgrading iOS. This was addressed by only turning on Bluetooth for major or minor version updates. CVE-ID CVE-2014-4354 : Maneet Singh, Sean Bluestein
CoreGraphics Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Opening a maliciously crafted PDF file may lead to an unexpected application termination or arbitrary code execution Description: An integer overflow existed in the handling of PDF files. This issue was addressed through improved bounds checking. CVE-ID CVE-2014-4377 : Felipe Andres Manzano of Binamuse VRT working with the iSIGHT Partners GVP Program
CoreGraphics Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Opening a maliciously crafted PDF file may lead to an unexpected application termination or an information disclosure Description: An out of bounds memory read existed in the handling of PDF files. This issue was addressed through improved bounds checking. CVE-ID CVE-2014-4378 : Felipe Andres Manzano of Binamuse VRT working with the iSIGHT Partners GVP Program
Data Detectors Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Tapping on a FaceTime link in Mail would trigger a FaceTime audio call without prompting Description: Mail did not consult the user before launching facetime-audio:// URLs. This issue was addressed with the addition of a confirmation prompt. CVE-ID CVE-2013-6835 : Guillaume Ross
Foundation Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: An application using NSXMLParser may be misused to disclose information Description: An XML External Entity issue existed in NSXMLParser's handling of XML. This issue was addressed by not loading external entities across origins. CVE-ID CVE-2014-4374 : George Gal of VSR (http://www.vsecurity.com/)
Home & Lock Screen Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A background app can determine which app is frontmost Description: The private API for determining the frontmost app did not have sufficient access control. This issue was addressed through additional access control. CVE-ID CVE-2014-4361 : Andreas Kurtz of NESO Security Labs and Markus TroBbach of Heilbronn University
iMessage Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Attachments may persist after the parent iMessage or MMS is deleted Description: A race condition existed in how attachments were deleted. This issue was addressed by conducting additional checks on whether an attachment has been deleted. CVE-ID CVE-2014-4353 : Silviu Schiau
IOAcceleratorFamily Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: An application may cause an unexpected system termination Description: A null pointer dereference existed in the handling of IOAcceleratorFamily API arguments. This issue was addressed through improved validation of IOAcceleratorFamily API arguments. CVE-ID CVE-2014-4369 : Catherine aka winocm
IOAcceleratorFamily Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: The device may unexpectedly restart Description: A NULL pointer dereference was present in the IntelAccelerator driver. The issue was addressed by improved error handling. CVE-ID CVE-2014-4373 : cunzhang from Adlab of Venustech
IOHIDFamily Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A malicious application may be able to read kernel pointers, which can be used to bypass kernel address space layout randomization Description: An out-of-bounds read issue existed in the handling of an IOHIDFamily function. This issue was addressed through improved bounds checking. CVE-ID CVE-2014-4379 : Ian Beer of Google Project Zero
IOHIDFamily Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A malicious application may be able to execute arbitrary code with system privileges Description: A heap buffer overflow existed in IOHIDFamily's handling of key-mapping properties. This issue was addressed through improved bounds checking. CVE-ID CVE-2014-4404 : Ian Beer of Google Project Zero
IOHIDFamily Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A malicious application may be able to execute arbitrary code with system privileges Description: A null pointer dereference existed in IOHIDFamily's handling of key-mapping properties. This issue was addressed through improved validation of IOHIDFamily key-mapping properties. CVE-ID CVE-2014-4405 : Ian Beer of Google Project Zero
IOHIDFamily Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A malicious application may be able to execute arbitrary code with kernel privileges Description: An out-of-bounds write issue existed in the IOHIDFamily kernel extension. This issue was addressed through improved bounds checking. CVE-ID CVE-2014-4380 : cunzhang from Adlab of Venustech
IOKit Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A malicious application may be able to read uninitialized data from kernel memory Description: An uninitialized memory access issue existed in the handling of IOKit functions. This issue was addressed through improved memory initialization CVE-ID CVE-2014-4407 : @PanguTeam
IOKit Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A malicious application may be able to execute arbitrary code with system privileges Description: A validation issue existed in the handling of certain metadata fields of IODataQueue objects. This issue was addressed through improved validation of metadata. CVE-ID CVE-2014-4418 : Ian Beer of Google Project Zero
IOKit Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A malicious application may be able to execute arbitrary code with system privileges Description: A validation issue existed in the handling of certain metadata fields of IODataQueue objects. This issue was addressed through improved validation of metadata. CVE-ID CVE-2014-4388 : @PanguTeam
IOKit Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A malicious application may be able to execute arbitrary code with system privileges Description: An integer overflow existed in the handling of IOKit functions. This issue was addressed through improved validation of IOKit API arguments. CVE-ID CVE-2014-4389 : Ian Beer of Google Project Zero
Kernel Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A local user may be able to determine kernel memory layout Description: Multiple uninitialized memory issues existed in the network statistics interface, which led to the disclosure of kernel memory content. This issue was addressed through additional memory initialization. CVE-ID CVE-2014-4371 : Fermin J. Serna of the Google Security Team CVE-2014-4419 : Fermin J. Serna of the Google Security Team CVE-2014-4420 : Fermin J. Serna of the Google Security Team CVE-2014-4421 : Fermin J. Serna of the Google Security Team
Kernel Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A person with a privileged network position may cause a denial of service Description: A race condition issue existed in the handling of IPv6 packets. This issue was addressed through improved lock state checking. CVE-ID CVE-2011-2391 : Marc Heuse
Kernel Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A local user may be able to cause an unexpected system termination or arbitrary code execution in the kernel Description: A double free issue existed in the handling of Mach ports. This issue was addressed through improved validation of Mach ports. CVE-ID CVE-2014-4375 : an anonymous researcher
Kernel Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A local user may be able to cause an unexpected system termination or arbitrary code execution in the kernel Description: An out-of-bounds read issue existed in rt_setgate. This may lead to memory disclosure or memory corruption. This issue was addressed through improved bounds checking. CVE-ID CVE-2014-4408
Kernel Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Some kernel hardening measures may be bypassed Description: The random number generator used for kernel hardening measures early in the boot process was not cryptographically secure. Some of its output was inferable from user space, allowing bypass of the hardening measures. This issue was addressed by using a cryptographically secure algorithm. CVE-ID CVE-2014-4422 : Tarjei Mandt of Azimuth Security
Libnotify Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A malicious application may be able to execute arbitrary code with root privileges Description: An out-of-bounds write issue existed in Libnotify. This issue was addressed through improved bounds checking. CVE-ID CVE-2014-4381 : Ian Beer of Google Project Zero
Lockdown Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A device can be manipulated into incorrectly presenting the home screen when the device is activation locked Description: An issue existed with unlocking behavior that caused a device to proceed to the home screen even if it should still be in an activation locked state. This was addressed by changing the information a device verifies during an unlock request. CVE-ID CVE-2014-1360
Mail Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Login credentials can be sent in plaintext even if the server has advertised the LOGINDISABLED IMAP capability Description: Mail sent the LOGIN command to servers even if they had advertised the LOGINDISABLED IMAP capability. This issue is mostly a concern when connecting to servers that are configured to accept non- encrypted connections and that advertise LOGINDISABLED. This issue was addressed by respecting the LOGINDISABLED IMAP capability. CVE-ID CVE-2014-4366 : Mark Crispin
Mail Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A person with physical access to an iOS device may potentially read email attachments Description: A logic issue existed in Mail's use of Data Protection on email attachments. This issue was addressed by properly setting the Data Protection class for email attachments. CVE-ID CVE-2014-1348 : Andreas Kurtz of NESO Security Labs
Profiles Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Voice Dial is unexpectedly enabled after upgrading iOS Description: Voice Dial was enabled automatically after upgrading iOS. This issue was addressed through improved state management. CVE-ID CVE-2014-4367 : Sven Heinemann
Safari Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: User credentials may be disclosed to an unintended site via autofill Description: Safari may have autofilled user names and passwords into a subframe from a different domain than the main frame. This issue was addressed through improved origin tracking. CVE-ID CVE-2013-5227 : Niklas Malmgren of Klarna AB
Safari Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: An attacker with a privileged network position may intercept user credentials Description: Saved passwords were autofilled on http sites, on https sites with broken trust, and in iframes. This issue was addressed by restricting password autofill to the main frame of https sites with valid certificate chains. CVE-ID CVE-2014-4363 : David Silver, Suman Jana, and Dan Boneh of Stanford University working with Eric Chen and Collin Jackson of Carnegie Mellon University
Sandbox Profiles Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Apple ID information is accessible by third-party apps Description: An information disclosure issue existed in the third- party app sandbox. This issue was addressed by improving the third- party sandbox profile. CVE-ID CVE-2014-4362 : Andreas Kurtz of NESO Security Labs and Markus TroBbach of Heilbronn University
Settings Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Text message previews may appear at the lock screen even when this feature is disabled Description: An issue existed in the previewing of text message notifications at the lock screen. As a result, the contents of received messages would be shown at the lock screen even when previews were disabled in Settings. The issue was addressed through improved observance of this setting. CVE-ID CVE-2014-4356 : Mattia Schirinzi from San Pietro Vernotico (BR), Italy
syslog Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A local user may be able to change permissions on arbitrary files Description: syslogd followed symbolic links while changing permissions on files. This issue was addressed through improved handling of symbolic links. CVE-ID CVE-2014-4372 : Tielei Wang and YeongJin Jang of Georgia Tech Information Security Center (GTISC)
Weather Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Location information was sent unencrypted Description: An information disclosure issue existed in an API used to determine local weather. This issue was addressed by changing APIs.
WebKit Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A malicious website may be able to track users even when private browsing is enabled Description: A web application could store HTML 5 application cache data during normal browsing and then read the data during private browsing. This was addressed by disabling access to the application cache when in private browsing mode. CVE-ID CVE-2014-4409 : Yosuke Hasegawa (NetAgent Co., Led.)
WebKit Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues existed in WebKit. These issues were addressed through improved memory handling. CVE-ID CVE-2013-6663 : Atte Kettunen of OUSPG CVE-2014-1384 : Apple CVE-2014-1385 : Apple CVE-2014-1387 : Google Chrome Security Team CVE-2014-1388 : Apple CVE-2014-1389 : Apple CVE-2014-4410 : Eric Seidel of Google CVE-2014-4411 : Google Chrome Security Team CVE-2014-4412 : Apple CVE-2014-4413 : Apple CVE-2014-4414 : Apple CVE-2014-4415 : Apple
WiFi Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A device may be passively tracked by its WiFi MAC address Description: An information disclosure existed because a stable MAC address was being used to scan for WiFi networks. This issue was addressed by randomizing the MAC address for passive WiFi scans.
Note: iOS 8 contains changes to some diagnostic capabilities. For details, please consult http://support.apple.com/kb/HT6331 iOS 8 now permits devices to untrust all previously trusted computers. Instructions can be found at http://support.apple.com/kb/HT5868
Installation note:
This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from www.apple.com/itunes/
iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device.
To check that the iPhone, iPod touch, or iPad has been updated:
- Navigate to Settings
- Select General
- Select About. The version after applying this update will be "8".
Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222
This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.22 (Darwin) Comment: GPGTools - http://gpgtools.org
iQIcBAEBAgAGBQJUGNl6AAoJEBcWfLTuOo7tD0oP/2QjJQxEaVKH5GhKX7HTLB9e W2oU7kHqds6p9HQg3iw9SXs/c03EH2++Tf5+Kul8V94QZB2jD4T28MUctAjrvSX7 rHRTPFJn8dm6Dr/zReon3q6ph8PlnDGySJLON/RwrSwHpWcd8wA4uCC6gTPur3T9 tNfPrkT+b4iO4QsSLQaK6bJqTFmWruqEFwdXmtOY8qYOsEANMr9HPdm9WwEcdQaZ tZZpa1FU4jIdfHZw18a3rzQ1LW4OO9fWbihKRgY8xq+Q8+Cs/EnY9hCIN0jl0OHm TMvKojeO4CCBAKpwUQOVERkI4Oc7Ux6GefT84ttYu095KzmZVjq9yWmi0FcBAVMV s32YL/alCNm86uNvxvkAvWJ3ZeZymuoTZHoNX5YNGIhuunRZONK94ay1RtYMdWPl iesWma7tn9g/xMWRaDKfRy2vtUuetBVxiaAr3AqvMp+mx0lmmLOO8x1SxeKe+QUy HO1O1DVAWPv2JIEf7mstDBHfQKYBRcgM3P4DJAgkrgH42ZNWb06ZyQhpAvFLVncD g2/Q0cwUlPOvdNKxoUD3IVVwPZeIefw3vqrSHXSQPpIMkJJFrBbIB8v6nnkheebg h5bPWfIxP0wuBjWz8SjOlPaSjxNxpmHK3H0tLU1q6TneBlmte405ytT4zSI7bvOY ZZCDpw0BRMEXUyXqTns7 =hlmW -----END PGP SIGNATURE-----
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201403-0199",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "iphone os",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "7.0"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "7.0.5"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "7.0.3"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "7.0.1"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "7.0.2"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "7.0.4"
},
{
"model": "iphone os",
"scope": "lte",
"trust": 1.0,
"vendor": "apple",
"version": "7.0.6"
},
{
"model": "ios",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "7.1 (ipad 2 or later ) (ht6162)"
},
{
"model": "ios",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "7.1 (iphone 4 or later ) (ht6162)"
},
{
"model": "ios",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "7.1 (ipod touch no. 5 after generation ) (ht6162)"
},
{
"model": "ios",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "8 (ipad 2 or later ) (ht6441)"
},
{
"model": "ios",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "8 (iphone 4s or later ) (ht6441)"
},
{
"model": "ios",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "8 (ipod touch no. 5 after generation ) (ht6441)"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "7.0.6"
},
{
"model": "ipod touch",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "0"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.0"
},
{
"model": "ipad",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "0"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.0.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.0.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.2.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.2.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5.1.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5.0.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3.5"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3.4"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3.3"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.9"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.8"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.7"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.6"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.5"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.10"
},
{
"model": "ios beta",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.0"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.0"
}
],
"sources": [
{
"db": "BID",
"id": "66108"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001658"
},
{
"db": "NVD",
"id": "CVE-2013-6835"
},
{
"db": "CNNVD",
"id": "CNNVD-201403-247"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "7.0.6",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:7.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:7.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:7.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:7.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:7.0.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:7.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2013-6835"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Guillaume Ross",
"sources": [
{
"db": "BID",
"id": "66108"
}
],
"trust": 0.3
},
"cve": "CVE-2013-6835",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 5.0,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2013-6835",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "VHN-66837",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2013-6835",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201403-247",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-66837",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-66837"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001658"
},
{
"db": "NVD",
"id": "CVE-2013-6835"
},
{
"db": "CNNVD",
"id": "CNNVD-201403-247"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "TelephonyUI Framework in Apple iOS 7 before 7.1, when Safari is used, does not require user confirmation for FaceTime audio calls, which allows remote attackers to obtain telephone number or e-mail address information via a facetime-audio: URL. Apple iOS is affected by a security-bypass vulnerability. \nSuccessfully exploiting this issue may allow an attacker to bypass certain security warnings. This may aid in further attacks. \nThese issues affect Apple iOS versions prior to 7.1. \nNote: This issue was previously discussed in BID 66087 (Apple iOS APPLE-SA-2014-03-10-1 Multiple Security Vulnerabilities), but has been moved to its own record to better document it. The vulnerability is caused by Safari not asking the user before launching the facetime-audio:// URL. \nCVE-ID\nCVE-2014-1276 : Min Zheng, Hui Xue, and Dr. This issue was mitigated by using SSL and prompting\nthe user during URL redirects. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\nAPPLE-SA-2014-09-17-1 iOS 8\n\niOS 8 is now available and addresses the following:\n\n802.1X\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: An attacker can obtain WiFi credentials\nDescription: An attacker could have impersonated a WiFi access\npoint, offered to authenticate with LEAP, broken the MS-CHAPv1 hash,\nand used the derived credentials to authenticate to the intended\naccess point even if that access point supported stronger\nauthentication methods. This issue was addressed by disabling LEAP by\ndefault. \nCVE-ID\nCVE-2014-4364 : Pieter Robyns, Bram Bonne, Peter Quax, and Wim\nLamotte of Universiteit Hasselt\n\nAccounts\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: A malicious application may be able to identify the Apple ID\nof the user\nDescription: An issue existed in the access control logic for\naccounts. A sandboxed application could get information about the\ncurrently-active iCloud account, including the name of the account. \nThis issue was addressed by restricting access to certain account\ntypes from unauthorized applications. \nCVE-ID\nCVE-2014-4423 : Adam Weaver\n\nCertificate Trust Policy\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: Update to the certificate trust policy\nDescription: The certificate trust policy was updated. The complete\nlist of certificates may be viewed at\nhttp://support.apple.com/kb/HT5012. \n\nAccessibility\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: The device may not lock the screen when using AssistiveTouch\nDescription: A logic issue existed in AssistiveTouch\u0027s handling of\nevents, which resulted in the screen not locking. This issue was\naddressed through improved handling of the lock timer. \nCVE-ID\nCVE-2014-4368 : Hendrik Bettermann\n\nAccounts Framework\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: An attacker with access to an iOS device may access\nsensitive user information from logs\nDescription: Sensitive user information was logged. This issue was\naddressed by logging less information. \nCVE-ID\nCVE-2014-4357 : Heli Myllykoski of OP-Pohjola Group\n\nAddress Book\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: A person with physical access to an iOS device may read the\naddress book\nDescription: The address book was encrypted with a key protected\nonly by the hardware UID. This issue was addressed by encrypting the\naddress book with a key protected by the hardware UID and the user\u0027s\npasscode. \nCVE-ID\nCVE-2014-4352 : Jonathan Zdziarski\n\nApp Installation\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: A local attacker may be able to escalate privileges and\ninstall unverified applications\nDescription: A race condition existed in App Installation. An\nattacker with the capability of writing to /tmp may have been able to\ninstall an unverified app. This issue was addressed by staging files\nfor installation in another directory. \nCVE-ID\nCVE-2014-4386 : evad3rs\n\nApp Installation\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: A local attacker may be able to escalate privileges and\ninstall unverified applications\nDescription: A path traversal issue existed in App Installation. A\nlocal attacker could have retargeted code signature validation to a\nbundle different from the one being installed and cause installation\nof an unverified app. This issue was addressed by detecting and\npreventing path traversal when determining which code signature to\nverify. \nCVE-ID\nCVE-2014-4384 : evad3rs\n\nAssets\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: An attacker with a privileged network position may be able\nto cause an iOS device to think that it is up to date even when it is\nnot\nDescription: A validation issue existed in the handling of update\ncheck responses. Spoofed dates from Last-Modified response headers\nset to future dates were used for If-Modified-Since checks in\nsubsequent update requests. This issue was addressed by validation of\nthe Last-Modified header. \nCVE-ID\nCVE-2014-4383 : Raul Siles of DinoSec\n\nBluetooth\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: Bluetooth is unexpectedly enabled by default after upgrading\niOS\nDescription: Bluetooth was enabled automatically after upgrading\niOS. This was addressed by only turning on Bluetooth for major or\nminor version updates. \nCVE-ID\nCVE-2014-4354 : Maneet Singh, Sean Bluestein\n\nCoreGraphics\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: Opening a maliciously crafted PDF file may lead to an\nunexpected application termination or arbitrary code execution\nDescription: An integer overflow existed in the handling of PDF\nfiles. This issue was addressed through improved bounds checking. \nCVE-ID\nCVE-2014-4377 : Felipe Andres Manzano of Binamuse VRT working with\nthe iSIGHT Partners GVP Program\n\nCoreGraphics\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: Opening a maliciously crafted PDF file may lead to an\nunexpected application termination or an information disclosure\nDescription: An out of bounds memory read existed in the handling of\nPDF files. This issue was addressed through improved bounds checking. \nCVE-ID\nCVE-2014-4378 : Felipe Andres Manzano of Binamuse VRT working with\nthe iSIGHT Partners GVP Program\n\nData Detectors\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: Tapping on a FaceTime link in Mail would trigger a FaceTime\naudio call without prompting\nDescription: Mail did not consult the user before launching\nfacetime-audio:// URLs. This issue was addressed with the addition of\na confirmation prompt. \nCVE-ID\nCVE-2013-6835 : Guillaume Ross\n\nFoundation\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: An application using NSXMLParser may be misused to disclose\ninformation\nDescription: An XML External Entity issue existed in NSXMLParser\u0027s\nhandling of XML. This issue was addressed by not loading external\nentities across origins. \nCVE-ID\nCVE-2014-4374 : George Gal of VSR (http://www.vsecurity.com/)\n\nHome \u0026 Lock Screen\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: A background app can determine which app is frontmost\nDescription: The private API for determining the frontmost app did\nnot have sufficient access control. This issue was addressed through\nadditional access control. \nCVE-ID\nCVE-2014-4361 : Andreas Kurtz of NESO Security Labs and Markus\nTroBbach of Heilbronn University\n\niMessage\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: Attachments may persist after the parent iMessage or MMS is\ndeleted\nDescription: A race condition existed in how attachments were\ndeleted. This issue was addressed by conducting additional checks on\nwhether an attachment has been deleted. \nCVE-ID\nCVE-2014-4353 : Silviu Schiau\n\nIOAcceleratorFamily\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: An application may cause an unexpected system termination\nDescription: A null pointer dereference existed in the handling of\nIOAcceleratorFamily API arguments. This issue was addressed through\nimproved validation of IOAcceleratorFamily API arguments. \nCVE-ID\nCVE-2014-4369 : Catherine aka winocm\n\nIOAcceleratorFamily\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: The device may unexpectedly restart\nDescription: A NULL pointer dereference was present in the\nIntelAccelerator driver. The issue was addressed by improved error\nhandling. \nCVE-ID\nCVE-2014-4373 : cunzhang from Adlab of Venustech\n\nIOHIDFamily\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: A malicious application may be able to read kernel pointers,\nwhich can be used to bypass kernel address space layout randomization\nDescription: An out-of-bounds read issue existed in the handling of\nan IOHIDFamily function. This issue was addressed through improved\nbounds checking. \nCVE-ID\nCVE-2014-4379 : Ian Beer of Google Project Zero\n\nIOHIDFamily\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: A malicious application may be able to execute arbitrary\ncode with system privileges\nDescription: A heap buffer overflow existed in IOHIDFamily\u0027s\nhandling of key-mapping properties. This issue was addressed through\nimproved bounds checking. \nCVE-ID\nCVE-2014-4404 : Ian Beer of Google Project Zero\n\nIOHIDFamily\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: A malicious application may be able to execute arbitrary\ncode with system privileges\nDescription: A null pointer dereference existed in IOHIDFamily\u0027s\nhandling of key-mapping properties. This issue was addressed through\nimproved validation of IOHIDFamily key-mapping properties. \nCVE-ID\nCVE-2014-4405 : Ian Beer of Google Project Zero\n\nIOHIDFamily\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: A malicious application may be able to execute arbitrary\ncode with kernel privileges\nDescription: An out-of-bounds write issue existed in the IOHIDFamily\nkernel extension. This issue was addressed through improved bounds\nchecking. \nCVE-ID\nCVE-2014-4380 : cunzhang from Adlab of Venustech\n\nIOKit\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: A malicious application may be able to read uninitialized\ndata from kernel memory\nDescription: An uninitialized memory access issue existed in the\nhandling of IOKit functions. This issue was addressed through\nimproved memory initialization\nCVE-ID\nCVE-2014-4407 : @PanguTeam\n\nIOKit\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: A malicious application may be able to execute arbitrary\ncode with system privileges\nDescription: A validation issue existed in the handling of certain\nmetadata fields of IODataQueue objects. This issue was addressed\nthrough improved validation of metadata. \nCVE-ID\nCVE-2014-4418 : Ian Beer of Google Project Zero\n\nIOKit\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: A malicious application may be able to execute arbitrary\ncode with system privileges\nDescription: A validation issue existed in the handling of certain\nmetadata fields of IODataQueue objects. This issue was addressed\nthrough improved validation of metadata. \nCVE-ID\nCVE-2014-4388 : @PanguTeam\n\nIOKit\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: A malicious application may be able to execute arbitrary\ncode with system privileges\nDescription: An integer overflow existed in the handling of IOKit\nfunctions. This issue was addressed through improved validation of\nIOKit API arguments. \nCVE-ID\nCVE-2014-4389 : Ian Beer of Google Project Zero\n\nKernel\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: A local user may be able to determine kernel memory layout\nDescription: Multiple uninitialized memory issues existed in the\nnetwork statistics interface, which led to the disclosure of kernel\nmemory content. This issue was addressed through additional memory\ninitialization. \nCVE-ID\nCVE-2014-4371 : Fermin J. Serna of the Google Security Team\nCVE-2014-4419 : Fermin J. Serna of the Google Security Team\nCVE-2014-4420 : Fermin J. Serna of the Google Security Team\nCVE-2014-4421 : Fermin J. Serna of the Google Security Team\n\nKernel\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: A person with a privileged network position may cause a\ndenial of service\nDescription: A race condition issue existed in the handling of IPv6\npackets. This issue was addressed through improved lock state\nchecking. \nCVE-ID\nCVE-2011-2391 : Marc Heuse\n\nKernel\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: A local user may be able to cause an unexpected system\ntermination or arbitrary code execution in the kernel\nDescription: A double free issue existed in the handling of Mach\nports. This issue was addressed through improved validation of Mach\nports. \nCVE-ID\nCVE-2014-4375 : an anonymous researcher\n\nKernel\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: A local user may be able to cause an unexpected system\ntermination or arbitrary code execution in the kernel\nDescription: An out-of-bounds read issue existed in rt_setgate. This\nmay lead to memory disclosure or memory corruption. This issue was\naddressed through improved bounds checking. \nCVE-ID\nCVE-2014-4408\n\nKernel\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: Some kernel hardening measures may be bypassed\nDescription: The random number generator used for kernel hardening\nmeasures early in the boot process was not cryptographically secure. \nSome of its output was inferable from user space, allowing bypass of\nthe hardening measures. This issue was addressed by using a\ncryptographically secure algorithm. \nCVE-ID\nCVE-2014-4422 : Tarjei Mandt of Azimuth Security\n\nLibnotify\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: A malicious application may be able to execute arbitrary\ncode with root privileges\nDescription: An out-of-bounds write issue existed in Libnotify. This\nissue was addressed through improved bounds checking. \nCVE-ID\nCVE-2014-4381 : Ian Beer of Google Project Zero\n\nLockdown\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: A device can be manipulated into incorrectly presenting the\nhome screen when the device is activation locked\nDescription: An issue existed with unlocking behavior that caused a\ndevice to proceed to the home screen even if it should still be in an\nactivation locked state. This was addressed by changing the\ninformation a device verifies during an unlock request. \nCVE-ID\nCVE-2014-1360\n\nMail\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: Login credentials can be sent in plaintext even if the\nserver has advertised the LOGINDISABLED IMAP capability\nDescription: Mail sent the LOGIN command to servers even if they had\nadvertised the LOGINDISABLED IMAP capability. This issue is mostly a\nconcern when connecting to servers that are configured to accept non-\nencrypted connections and that advertise LOGINDISABLED. This issue\nwas addressed by respecting the LOGINDISABLED IMAP capability. \nCVE-ID\nCVE-2014-4366 : Mark Crispin\n\nMail\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: A person with physical access to an iOS device may\npotentially read email attachments\nDescription: A logic issue existed in Mail\u0027s use of Data Protection\non email attachments. This issue was addressed by properly setting\nthe Data Protection class for email attachments. \nCVE-ID\nCVE-2014-1348 : Andreas Kurtz of NESO Security Labs\n\nProfiles\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: Voice Dial is unexpectedly enabled after upgrading iOS\nDescription: Voice Dial was enabled automatically after upgrading\niOS. This issue was addressed through improved state management. \nCVE-ID\nCVE-2014-4367 : Sven Heinemann\n\nSafari\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: User credentials may be disclosed to an unintended site via\nautofill\nDescription: Safari may have autofilled user names and passwords\ninto a subframe from a different domain than the main frame. This\nissue was addressed through improved origin tracking. \nCVE-ID\nCVE-2013-5227 : Niklas Malmgren of Klarna AB\n\nSafari\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: An attacker with a privileged network position may intercept\nuser credentials\nDescription: Saved passwords were autofilled on http sites, on https\nsites with broken trust, and in iframes. This issue was addressed by\nrestricting password autofill to the main frame of https sites with\nvalid certificate chains. \nCVE-ID\nCVE-2014-4363 : David Silver, Suman Jana, and Dan Boneh of Stanford\nUniversity working with Eric Chen and Collin Jackson of Carnegie\nMellon University\n\nSandbox Profiles\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: Apple ID information is accessible by third-party apps\nDescription: An information disclosure issue existed in the third-\nparty app sandbox. This issue was addressed by improving the third-\nparty sandbox profile. \nCVE-ID\nCVE-2014-4362 : Andreas Kurtz of NESO Security Labs and Markus\nTroBbach of Heilbronn University\n\nSettings\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: Text message previews may appear at the lock screen even\nwhen this feature is disabled\nDescription: An issue existed in the previewing of text message\nnotifications at the lock screen. As a result, the contents of\nreceived messages would be shown at the lock screen even when\npreviews were disabled in Settings. The issue was addressed through\nimproved observance of this setting. \nCVE-ID\nCVE-2014-4356 : Mattia Schirinzi from San Pietro Vernotico (BR),\nItaly\n\nsyslog\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: A local user may be able to change permissions on arbitrary\nfiles\nDescription: syslogd followed symbolic links while changing\npermissions on files. This issue was addressed through improved\nhandling of symbolic links. \nCVE-ID\nCVE-2014-4372 : Tielei Wang and YeongJin Jang of Georgia Tech\nInformation Security Center (GTISC)\n\nWeather\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: Location information was sent unencrypted\nDescription: An information disclosure issue existed in an API used\nto determine local weather. This issue was addressed by changing\nAPIs. \n\nWebKit\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: A malicious website may be able to track users even when\nprivate browsing is enabled\nDescription: A web application could store HTML 5 application cache\ndata during normal browsing and then read the data during private\nbrowsing. This was addressed by disabling access to the application\ncache when in private browsing mode. \nCVE-ID\nCVE-2014-4409 : Yosuke Hasegawa (NetAgent Co., Led.)\n\nWebKit\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: Visiting a maliciously crafted website may lead to an\nunexpected application termination or arbitrary code execution\nDescription: Multiple memory corruption issues existed in WebKit. \nThese issues were addressed through improved memory handling. \nCVE-ID\nCVE-2013-6663 : Atte Kettunen of OUSPG\nCVE-2014-1384 : Apple\nCVE-2014-1385 : Apple\nCVE-2014-1387 : Google Chrome Security Team\nCVE-2014-1388 : Apple\nCVE-2014-1389 : Apple\nCVE-2014-4410 : Eric Seidel of Google\nCVE-2014-4411 : Google Chrome Security Team\nCVE-2014-4412 : Apple\nCVE-2014-4413 : Apple\nCVE-2014-4414 : Apple\nCVE-2014-4415 : Apple\n\nWiFi\nAvailable for: iPhone 4s and later,\niPod touch (5th generation) and later, iPad 2 and later\nImpact: A device may be passively tracked by its WiFi MAC address\nDescription: An information disclosure existed because a stable MAC\naddress was being used to scan for WiFi networks. This issue was\naddressed by randomizing the MAC address for passive WiFi scans. \n\nNote:\niOS 8 contains changes to some diagnostic capabilities. \nFor details, please consult http://support.apple.com/kb/HT6331\niOS 8 now permits devices to untrust all previously trusted\ncomputers. Instructions can be found at\nhttp://support.apple.com/kb/HT5868\n\n\nInstallation note:\n\nThis update is available through iTunes and Software Update on your\niOS device, and will not appear in your computer\u0027s Software Update\napplication, or in the Apple Downloads site. Make sure you have an\nInternet connection and have installed the latest version of iTunes\nfrom www.apple.com/itunes/\n\niTunes and Software Update on the device will automatically check\nApple\u0027s update server on its weekly schedule. When an update is\ndetected, it is downloaded and the option to be installed is\npresented to the user when the iOS device is docked. We recommend\napplying the update immediately if possible. Selecting Don\u0027t Install\nwill present the option the next time you connect your iOS device. \n\nThe automatic update process may take up to a week depending on the\nday that iTunes or the device checks for updates. You may manually\nobtain the update via the Check for Updates button within iTunes, or\nthe Software Update on your device. \n\nTo check that the iPhone, iPod touch, or iPad has been updated:\n\n* Navigate to Settings\n* Select General\n* Select About. The version after applying this update\nwill be \"8\". \n\nInformation will also be posted to the Apple Security Updates\nweb site: http://support.apple.com/kb/HT1222\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG/MacGPG2 v2.0.22 (Darwin)\nComment: GPGTools - http://gpgtools.org\n\niQIcBAEBAgAGBQJUGNl6AAoJEBcWfLTuOo7tD0oP/2QjJQxEaVKH5GhKX7HTLB9e\nW2oU7kHqds6p9HQg3iw9SXs/c03EH2++Tf5+Kul8V94QZB2jD4T28MUctAjrvSX7\nrHRTPFJn8dm6Dr/zReon3q6ph8PlnDGySJLON/RwrSwHpWcd8wA4uCC6gTPur3T9\ntNfPrkT+b4iO4QsSLQaK6bJqTFmWruqEFwdXmtOY8qYOsEANMr9HPdm9WwEcdQaZ\ntZZpa1FU4jIdfHZw18a3rzQ1LW4OO9fWbihKRgY8xq+Q8+Cs/EnY9hCIN0jl0OHm\nTMvKojeO4CCBAKpwUQOVERkI4Oc7Ux6GefT84ttYu095KzmZVjq9yWmi0FcBAVMV\ns32YL/alCNm86uNvxvkAvWJ3ZeZymuoTZHoNX5YNGIhuunRZONK94ay1RtYMdWPl\niesWma7tn9g/xMWRaDKfRy2vtUuetBVxiaAr3AqvMp+mx0lmmLOO8x1SxeKe+QUy\nHO1O1DVAWPv2JIEf7mstDBHfQKYBRcgM3P4DJAgkrgH42ZNWb06ZyQhpAvFLVncD\ng2/Q0cwUlPOvdNKxoUD3IVVwPZeIefw3vqrSHXSQPpIMkJJFrBbIB8v6nnkheebg\nh5bPWfIxP0wuBjWz8SjOlPaSjxNxpmHK3H0tLU1q6TneBlmte405ytT4zSI7bvOY\nZZCDpw0BRMEXUyXqTns7\n=hlmW\n-----END PGP SIGNATURE-----\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2013-6835"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001658"
},
{
"db": "BID",
"id": "66108"
},
{
"db": "VULHUB",
"id": "VHN-66837"
},
{
"db": "PACKETSTORM",
"id": "125644"
},
{
"db": "PACKETSTORM",
"id": "128298"
}
],
"trust": 2.16
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-66837",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-66837"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2013-6835",
"trust": 3.0
},
{
"db": "BID",
"id": "66108",
"trust": 1.4
},
{
"db": "JVN",
"id": "JVNVU94229445",
"trust": 0.8
},
{
"db": "JVN",
"id": "JVNVU93868849",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001658",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201403-247",
"trust": 0.7
},
{
"db": "BUGTRAQ",
"id": "20140310 [CVE-2013-6835] - IOS 7.0.6 SAFARI/FACETIME-AUDIO PRIVACY ISSUE",
"trust": 0.6
},
{
"db": "SECUNIA",
"id": "57294",
"trust": 0.6
},
{
"db": "NSFOCUS",
"id": "26226",
"trust": 0.6
},
{
"db": "NSFOCUS",
"id": "26203",
"trust": 0.6
},
{
"db": "PACKETSTORM",
"id": "125659",
"trust": 0.1
},
{
"db": "EXPLOIT-DB",
"id": "39114",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-66837",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "125644",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "128298",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-66837"
},
{
"db": "BID",
"id": "66108"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001658"
},
{
"db": "PACKETSTORM",
"id": "125644"
},
{
"db": "PACKETSTORM",
"id": "128298"
},
{
"db": "NVD",
"id": "CVE-2013-6835"
},
{
"db": "CNNVD",
"id": "CNNVD-201403-247"
}
]
},
"id": "VAR-201403-0199",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-66837"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T11:48:15.609000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "HT6162",
"trust": 0.8,
"url": "http://support.apple.com/kb/ht6162"
},
{
"title": "HT6441",
"trust": 0.8,
"url": "http://support.apple.com/kb/ht6441"
},
{
"title": "HT6441",
"trust": 0.8,
"url": "http://support.apple.com/kb/ht6441?viewlocale=ja_jp"
},
{
"title": "HT6162",
"trust": 0.8,
"url": "http://support.apple.com/kb/ht6162?viewlocale=ja_jp"
},
{
"title": "AppleTV3,1_6.1_11D169b_Restore",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=48637"
},
{
"title": "AppleTV2,1_6.1_11D169b_Restore",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=48636"
},
{
"title": "iPhone6,2_7.1_11D167_Restore",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=48635"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-001658"
},
{
"db": "CNNVD",
"id": "CNNVD-201403-247"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-264",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-66837"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001658"
},
{
"db": "NVD",
"id": "CVE-2013-6835"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.9,
"url": "http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.html"
},
{
"trust": 1.7,
"url": "http://seclists.org/bugtraq/2014/mar/63"
},
{
"trust": 1.7,
"url": "http://support.apple.com/kb/ht6162"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/bid/66108"
},
{
"trust": 1.1,
"url": "http://support.apple.com/kb/ht6441"
},
{
"trust": 1.1,
"url": "http://seclists.org/fulldisclosure/2014/mar/92"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-6835"
},
{
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu94229445/"
},
{
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu93868849/index.html"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2013-6835"
},
{
"trust": 0.6,
"url": "http://secunia.com/advisories/57294"
},
{
"trust": 0.6,
"url": "http://www.nsfocus.net/vulndb/26226"
},
{
"trust": 0.6,
"url": "http://www.nsfocus.net/vulndb/26203"
},
{
"trust": 0.3,
"url": "http://www.apple.com/ios/"
},
{
"trust": 0.2,
"url": "https://www.apple.com/itunes/"
},
{
"trust": 0.2,
"url": "http://support.apple.com/kb/ht1222"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-5227"
},
{
"trust": 0.2,
"url": "https://www.apple.com/support/security/pgp/"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-6835"
},
{
"trust": 0.2,
"url": "http://gpgtools.org"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-6629"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-5133"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-1269"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-1270"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-1252"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-5228"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-2928"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-5196"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-1267"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-1271"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-1275"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-2088"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-1274"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-1278"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-1276"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-5198"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-1273"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-2926"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-6635"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-2909"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-5225"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-6625"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-1272"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-5197"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-5199"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-1277"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-1388"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4368"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4366"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-1387"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-6663"
},
{
"trust": 0.1,
"url": "http://support.apple.com/kb/ht5868"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4352"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4354"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4356"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4361"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-1389"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4369"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4353"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4372"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-2391"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-1360"
},
{
"trust": 0.1,
"url": "http://support.apple.com/kb/ht6331"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-1385"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4357"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4362"
},
{
"trust": 0.1,
"url": "http://www.vsecurity.com/)"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4363"
},
{
"trust": 0.1,
"url": "http://support.apple.com/kb/ht5012."
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4371"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4367"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4373"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-1348"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4374"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-1384"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4364"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-66837"
},
{
"db": "BID",
"id": "66108"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001658"
},
{
"db": "PACKETSTORM",
"id": "125644"
},
{
"db": "PACKETSTORM",
"id": "128298"
},
{
"db": "NVD",
"id": "CVE-2013-6835"
},
{
"db": "CNNVD",
"id": "CNNVD-201403-247"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-66837"
},
{
"db": "BID",
"id": "66108"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001658"
},
{
"db": "PACKETSTORM",
"id": "125644"
},
{
"db": "PACKETSTORM",
"id": "128298"
},
{
"db": "NVD",
"id": "CVE-2013-6835"
},
{
"db": "CNNVD",
"id": "CNNVD-201403-247"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-03-14T00:00:00",
"db": "VULHUB",
"id": "VHN-66837"
},
{
"date": "2014-03-10T00:00:00",
"db": "BID",
"id": "66108"
},
{
"date": "2014-03-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-001658"
},
{
"date": "2014-03-11T02:13:44",
"db": "PACKETSTORM",
"id": "125644"
},
{
"date": "2014-09-17T20:48:00",
"db": "PACKETSTORM",
"id": "128298"
},
{
"date": "2014-03-14T10:55:05.567000",
"db": "NVD",
"id": "CVE-2013-6835"
},
{
"date": "2014-03-14T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201403-247"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-01-07T00:00:00",
"db": "VULHUB",
"id": "VHN-66837"
},
{
"date": "2014-03-10T00:00:00",
"db": "BID",
"id": "66108"
},
{
"date": "2014-09-22T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-001658"
},
{
"date": "2017-01-07T02:59:14.340000",
"db": "NVD",
"id": "CVE-2013-6835"
},
{
"date": "2014-04-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201403-247"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201403-247"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Apple iOS of TelephonyUI Vulnerability in obtaining phone number or email address information in the framework",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-001658"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "permissions and access control",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201403-247"
}
],
"trust": 0.6
}
}
GHSA-27GV-HMXX-3R2X
Vulnerability from github – Published: 2022-05-17 03:07 – Updated: 2022-05-17 03:07
VLAI?
Details
TelephonyUI Framework in Apple iOS 7 before 7.1, when Safari is used, does not require user confirmation for FaceTime audio calls, which allows remote attackers to obtain telephone number or e-mail address information via a facetime-audio: URL.
{
"affected": [],
"aliases": [
"CVE-2013-6835"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2014-03-14T10:55:00Z",
"severity": "MODERATE"
},
"details": "TelephonyUI Framework in Apple iOS 7 before 7.1, when Safari is used, does not require user confirmation for FaceTime audio calls, which allows remote attackers to obtain telephone number or e-mail address information via a facetime-audio: URL.",
"id": "GHSA-27gv-hmxx-3r2x",
"modified": "2022-05-17T03:07:06Z",
"published": "2022-05-17T03:07:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-6835"
},
{
"type": "WEB",
"url": "http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.html"
},
{
"type": "WEB",
"url": "http://seclists.org/bugtraq/2014/Mar/63"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2014/Mar/92"
},
{
"type": "WEB",
"url": "http://support.apple.com/kb/HT6162"
},
{
"type": "WEB",
"url": "http://support.apple.com/kb/HT6441"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/66108"
}
],
"schema_version": "1.4.0",
"severity": []
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…