Published: 02/04/2017 Updated: 08/03/2019

CVSS v2 Base Score: 9.3 | Impact Score: 10 | Exploitability Score: 8.6

CVSS v3 Base Score: 8.8 | Impact Score: 5.9 | Exploitability Score: 2.8

VMScore: 828

Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C

An issue exists in certain Apple products. iOS prior to 10.3 is affected. macOS prior to 10.12.4 is affected. tvOS prior to 10.2 is affected. watchOS prior to 3.2 is affected. The issue involves the "Security" component. It allows remote malicious users to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted X.509 certificate file.

Vulnerable Product	Search on Vulmon	Subscribe to Product
apple iphone os
apple watchos
apple mac os x
apple tvos

Apple squashes cert-handling bug affecting macOS and iOS

The Register • John Leyden • 28 Mar 2017

Flaw posed remote code execution risk

Apple has resolved a certification validation vulnerability affecting both macOS and iOS users. The (CVE-2017-2485) vulnerability posed a remote code execution risk on affected systems, which created a potential mechanism for hackers to craft exploits that pushed malware on to otherwise patched iThings. The flaw – discovered and responsibly disclosed by security researchers from Cisco Talos – stemmed from bugs in the X.509 certificate validation functionality of Apple macOS and iOS. Improper...

CVE-2017-2485

Vulnerability Summary

Vulnerability Trend

Recent Articles

References

Vulmon Search

About

Products

Connect