{"api_version":"1","generated_at":"2026-07-23T06:22:08+00:00","cve":"CVE-2015-3784","urls":{"html":"https://cve.report/CVE-2015-3784","api":"https://cve.report/api/cve/CVE-2015-3784.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2015-3784","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2015-3784"},"summary":{"title":"CVE-2015-3784","description":"Office Viewer in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.","state":"PUBLISHED","assigner":"apple","published_at":"2015-08-16 23:59:56","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-200","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"}}],"references":[{"url":"http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html","name":"http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"APPLE-SA-2015-08-13-2 OS X Yosemite v10.10.5 and Security Update\t2015-006","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://support.apple.com/kb/HT205031","name":"https://support.apple.com/kb/HT205031","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"About the security content of OS X Yosemite v10.10.5 and Security Update 2015-006 - Apple Support","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securitytracker.com/id/1033275","name":"http://www.securitytracker.com/id/1033275","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Apple iOS Multiple Flaws Let Remote Users Execute Arbitrary Code, Obtain Potentially Sensitive Information, and Deny Service and Let Apps Gain Elevated Privileges - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://support.apple.com/HT205373","name":"https://support.apple.com/HT205373","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"About the security content of Keynote 6.6, Pages 5.6, Numbers 3.6, and iWork for iOS 2.6 - Apple Support","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://lists.apple.com/archives/security-announce/2015/Oct/msg00000.html","name":"http://lists.apple.com/archives/security-announce/2015/Oct/msg00000.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"APPLE-SA-2015-10-15-1  Keynote 6.6, Pages 5.6, Numbers 3.6,\tand iWork for iOS 2.6","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://support.apple.com/kb/HT205030","name":"https://support.apple.com/kb/HT205030","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"About the security content of iOS 8.4.1 - Apple Support","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://lists.apple.com/archives/security-announce/2015/Aug/msg00002.html","name":"http://lists.apple.com/archives/security-announce/2015/Aug/msg00002.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"APPLE-SA-2015-08-13-3 iOS 8.4.1","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/76343","name":"http://www.securityfocus.com/bid/76343","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Apple Mac OS X and iOS Multiple Security Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-3784","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3784","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2015","cve_id":"3784","vulnerable":"1","versionEndIncluding":"8.4","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"apple","cpe5":"iphone_os","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"3784","vulnerable":"1","versionEndIncluding":"2.5.4","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"apple","cpe5":"iwork","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"3784","vulnerable":"1","versionEndIncluding":"6.5","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"apple","cpe5":"keynote","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"3784","vulnerable":"1","versionEndIncluding":"10.10.4","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"apple","cpe5":"mac_os_x","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"3784","vulnerable":"1","versionEndIncluding":"3.5","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"apple","cpe5":"numbers","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"3784","vulnerable":"1","versionEndIncluding":"5.5.3","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"apple","cpe5":"pages","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T05:56:14.994Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://support.apple.com/kb/HT205030"},{"name":"1033275","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id/1033275"},{"name":"APPLE-SA-2015-08-13-2","tags":["vendor-advisory","x_refsource_APPLE","x_transferred"],"url":"http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html"},{"name":"APPLE-SA-2015-08-13-3","tags":["vendor-advisory","x_refsource_APPLE","x_transferred"],"url":"http://lists.apple.com/archives/security-announce/2015/Aug/msg00002.html"},{"name":"APPLE-SA-2015-10-15-1","tags":["vendor-advisory","x_refsource_APPLE","x_transferred"],"url":"http://lists.apple.com/archives/security-announce/2015/Oct/msg00000.html"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://support.apple.com/kb/HT205031"},{"name":"76343","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/76343"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://support.apple.com/HT205373"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2015-08-13T00:00:00.000Z","descriptions":[{"lang":"en","value":"Office Viewer in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2016-12-22T18:57:01.000Z","orgId":"286789f9-fbc2-4510-9f9a-43facdede74c","shortName":"apple"},"references":[{"tags":["x_refsource_CONFIRM"],"url":"https://support.apple.com/kb/HT205030"},{"name":"1033275","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id/1033275"},{"name":"APPLE-SA-2015-08-13-2","tags":["vendor-advisory","x_refsource_APPLE"],"url":"http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html"},{"name":"APPLE-SA-2015-08-13-3","tags":["vendor-advisory","x_refsource_APPLE"],"url":"http://lists.apple.com/archives/security-announce/2015/Aug/msg00002.html"},{"name":"APPLE-SA-2015-10-15-1","tags":["vendor-advisory","x_refsource_APPLE"],"url":"http://lists.apple.com/archives/security-announce/2015/Oct/msg00000.html"},{"tags":["x_refsource_CONFIRM"],"url":"https://support.apple.com/kb/HT205031"},{"name":"76343","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/76343"},{"tags":["x_refsource_CONFIRM"],"url":"https://support.apple.com/HT205373"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"product-security@apple.com","ID":"CVE-2015-3784","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Office Viewer in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"https://support.apple.com/kb/HT205030","refsource":"CONFIRM","url":"https://support.apple.com/kb/HT205030"},{"name":"1033275","refsource":"SECTRACK","url":"http://www.securitytracker.com/id/1033275"},{"name":"APPLE-SA-2015-08-13-2","refsource":"APPLE","url":"http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html"},{"name":"APPLE-SA-2015-08-13-3","refsource":"APPLE","url":"http://lists.apple.com/archives/security-announce/2015/Aug/msg00002.html"},{"name":"APPLE-SA-2015-10-15-1","refsource":"APPLE","url":"http://lists.apple.com/archives/security-announce/2015/Oct/msg00000.html"},{"name":"https://support.apple.com/kb/HT205031","refsource":"CONFIRM","url":"https://support.apple.com/kb/HT205031"},{"name":"76343","refsource":"BID","url":"http://www.securityfocus.com/bid/76343"},{"name":"https://support.apple.com/HT205373","refsource":"CONFIRM","url":"https://support.apple.com/HT205373"}]}}}},"cveMetadata":{"assignerOrgId":"286789f9-fbc2-4510-9f9a-43facdede74c","assignerShortName":"apple","cveId":"CVE-2015-3784","datePublished":"2015-08-16T23:00:00.000Z","dateReserved":"2015-05-07T00:00:00.000Z","dateUpdated":"2024-08-06T05:56:14.994Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2015-08-16 23:59:56","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-200","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*","versionEndIncluding":"10.10.4","matchCriteriaId":"7883E465-932D-4C11-AA54-97E44181F906"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*","versionEndIncluding":"8.4","matchCriteriaId":"0D52ECBD-7375-4FC9-BE05-2354EEA1332F"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apple:numbers:*:*:*:*:*:*:*:*","versionEndIncluding":"3.5","matchCriteriaId":"10874393-972D-434A-A4D8-958BBE93B19A"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apple:keynote:*:*:*:*:*:*:*:*","versionEndIncluding":"6.5","matchCriteriaId":"A76A2649-1CD1-4F36-9C0B-5B47CDCB55CB"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apple:pages:*:*:*:*:*:*:*:*","versionEndIncluding":"5.5.3","matchCriteriaId":"BE816C24-5B72-4913-8BB2-A30730631937"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apple:iwork:*:*:*:*:*:*:*:*","versionEndIncluding":"2.5.4","matchCriteriaId":"A6D18EAE-3E40-4E8B-8276-6A96B7874DDD"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2015","CveId":"3784","Ordinal":"1","Title":"CVE-2015-3784","CVE":"CVE-2015-3784","Year":"2015"},"notes":[{"CveYear":"2015","CveId":"3784","Ordinal":"1","NoteData":"Office Viewer in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.","Type":"Description","Title":"CVE-2015-3784"},{"CveYear":"2015","CveId":"3784","Ordinal":"2","NoteData":"2015-08-16","Type":"Other","Title":"Published"},{"CveYear":"2015","CveId":"3784","Ordinal":"3","NoteData":"2016-12-22","Type":"Other","Title":"Modified"}]}}}