CVE-2015-1157
En bref
- Source
- NVD
- EPSS
- EPSS 5.62 % · centile 93 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- apple
- Statut NVD
- Modified
Rechercher sur…
Description
CoreText in Apple iOS 8.x through 8.3 allows remote attackers to cause a denial of service (reboot and messaging disruption) via crafted Unicode text that is not properly handled during display truncation in the Notifications feature, as demonstrated by Arabic characters in (1) an SMS message or (2) a WhatsApp message.
Faiblesses (CWE)
Références
- https://support.apple.com/HT205221
- http://www.securityfocus.com/bid/75491
- http://support.apple.com/kb/HT204941
- http://www.reddit.com/r/apple/comments/37e8c1/malicious_text_message/
- https://ghostbin.com/paste/zws9m
- http://www.reddit.com/r/apple/comments/37enow/about_the_latest_iphone_security_vulnerability/
- http://www.securitytracker.com/id/1032408
- http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html
- http://9to5mac.com/2015/05/27/how-to-fix-ios-text-message-bug-crash-reboot/
- http://www.reddit.com/r/explainlikeimfive/comments/37edde/eli5_how_that_text_you_can_send_to_friends_turns/
- http://lists.apple.com/archives/security-announce/2015/Sep/msg00003.html
- http://support.apple.com/kb/HT204942
- http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.html
- http://zanzebek.com/a-simple-text-message-can-ruin-any-iphone/
- http://www.ibtimes.co.uk/apple-ios-bug-sees-message-app-crash-iphone-reboot-simply-by-receiving-message-1503083
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 2.0 | HIGH 7.8 | AV:N/AC:L/Au:N/C:N/I:N/A:C | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2015-1300
- GCVE · GCVE-0-2015-1157
Avis du CERT-FR
- CERTFR-2015-AVI-398 — Multiples vulnérabilités dans Apple iTunes · cert.ssi.gouv.fr
- CERTFR-2015-AVI-273 — Multiples vulnérabilités dans Apple OSX · cert.ssi.gouv.fr
- CERTFR-2015-AVI-272 — Multiples vulnérabilités dans Apple iOS · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:o:apple:iphone_os:8.0:*:*:*:*:*:*:*cpe:2.3:o:apple:iphone_os:8.0.1:*:*:*:*:*:*:*cpe:2.3:o:apple:iphone_os:8.0.2:*:*:*:*:*:*:*cpe:2.3:o:apple:iphone_os:8.1:*:*:*:*:*:*:*cpe:2.3:o:apple:iphone_os:8.1.2:*:*:*:*:*:*:*cpe:2.3:o:apple:iphone_os:8.1.3:*:*:*:*:*:*:*cpe:2.3:o:apple:iphone_os:8.2:*:*:*:*:*:*:*cpe:2.3:o:apple:iphone_os:8.3:*:*:*:*:*:*:*cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*≤ 10.0.3cpe:2.3:a:apple:itunes:*:*:*:*:*:*:*:*≤ 12.2
Produits affectés
| Produit | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |