Vulnerability Details : CVE-2017-2360
An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. macOS before 10.12.3 is affected. tvOS before 10.1.1 is affected. watchOS before 3.1.3 is affected. The issue involves the "Kernel" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (use-after-free) via a crafted app.
Vulnerability category: Memory CorruptionExecute codeDenial of service
Products affected by CVE-2017-2360
- cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
- cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
- cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*
- cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
- cpe:2.3:a:webkitgtk:webkitgtk\+:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2017-2360
0.36%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 69 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2017-2360
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
9.3
|
HIGH | AV:N/AC:M/Au:N/C:C/I:C/A:C |
8.6
|
10.0
|
NIST | |
|
7.8
|
HIGH | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
1.8
|
5.9
|
NIST |
CWE ids for CVE-2017-2360
-
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-2360
-
https://support.apple.com/HT207487
About the security content of watchOS 3.1.3 - Apple SupportVendor Advisory
-
https://support.apple.com/HT207482
About the security content of iOS 10.2.1 - Apple SupportVendor Advisory
-
https://www.exploit-db.com/exploits/41165/
Apple macOS 10.12.1 / iOS Kernel - 'host_self_trap' Use-After-FreeExploit;Third Party Advisory;VDB Entry
-
http://www.securityfocus.com/bid/95729
Apple iOS/tvOS/watchOS CVE-2017-2360 Arbitray Code Execution VulnerabilityThird Party Advisory;VDB Entry
-
http://www.securityfocus.com/bid/95731
Apple iOS/macOS/tvOS/watchOS Buffer Overflow VulnerabilityThird Party Advisory;VDB Entry
-
https://support.apple.com/HT207485
About the security content of tvOS 10.1.1 - Apple SupportVendor Advisory
-
http://www.securitytracker.com/id/1037668
Apple iOS Multiple Bugs Let Remote Users Execute Arbitrary Code, Obtain Potentially Sensitive Information, Deny Service, and Gain Elevated Privileges and Let Remote and Local Users Bypass Security ResThird Party Advisory;VDB Entry
-
https://support.apple.com/HT207483
About the security content of macOS Sierra 10.12.3 - Apple SupportVendor Advisory
Jump to