Apple iOS/tvOS/watchOS Memory Corruption Vulnerabilities

Bugtraq ID:	102774
Class:	Unknown
CVE:	CVE-2018-4087 CVE-2018-4095
Remote:	Yes
Local:	No
Published:	Jan 23 2018 12:00AM
Updated:	Jan 23 2018 12:00AM
Credit:	Rani Idan (@raniXCH) of Zimperium zLabs Team
Vulnerable:	Apple watchOS 10.1.1 Apple watchOS 3.1.3 Apple watchOS 3.1.1 Apple watchOS 2.2.2 Apple watchOS 2.2.1 Apple watchOS 2.0.1 Apple watchOS 1.0.1 Apple watchOS 4.2 Apple watchOS 4.1 Apple watchOS 4 Apple watchOS 3.2.3 Apple watchOS 3.2.2 Apple watchOS 3.2.1 Apple watchOS 3.2 Apple watchOS 3.1 Apple watchOS 3.0 Apple watchOS 3 Apple watchOS 2.2 Apple watchOS 2.1 Apple watchOS 2.0 Apple watchOS 1.0 Apple Watch 0 Apple tvOS 10.1.1 Apple tvOS 10.0.1 Apple tvOS 9.2.2 Apple tvOS 9.2.1 Apple tvOS 9.1.1 Apple tvOS 9.2 Apple tvOS 9.1 Apple tvOS 9.0 Apple tvOS 11.2.1 Apple tvOS 11.2 Apple tvOS 11.1 Apple tvOS 11 Apple tvOS 10.2.2 Apple tvOS 10.2.1 Apple tvOS 10.2 Apple tvOS 10.1 Apple tvOS 10 Apple TV 0 Apple iPod Touch 0 Apple iPhone 0 Apple iPad 0 Apple iOS 5 0 Apple iOS 4 0 Apple iOS 3 0 Apple iOS 10.2.1 Apple iOS 10.0.1 Apple iOS 9.3.4 Apple iOS 9.3.3 Apple iOS 9.3.2 Apple iOS 9.3.1 Apple iOS 9.2.1 Apple iOS 9.0.2 Apple iOS 9.0.1 Apple iOS 8.4.1 Apple iOS 7.2 Apple iOS 7.0.6 Apple iOS 7.0.5 Apple iOS 7.0.3 Apple iOS 7.0.2 Apple iOS 7.0.1 Apple iOS 6.3.1 Apple iOS 6.1.6 Apple iOS 6.1.4 Apple iOS 6.1.3 Apple iOS 4.2.1 Apple iOS 4.0.2 Apple iOS 4.0.1 Apple iOS 3.2.2 Apple iOS 3.2.1 Apple iOS 9.3.5 Apple iOS 9.3 Apple iOS 9.2 Apple iOS 9.1 Apple iOS 9 Apple iOS 8.4 Apple iOS 8.3 Apple iOS 8.2 Apple iOS 8.1.3 Apple iOS 8.1.2 Apple iOS 8.1.1 Apple iOS 8.1 Apple iOS 8 Apple iOS 7.1.2 Apple iOS 7.1.1 Apple iOS 7.1 Apple iOS 7.0.4 Apple iOS 7 Apple iOS 6.1 Apple iOS 6.0.2 Apple iOS 6.0.1 Apple iOS 6 Apple iOS 5.1.1 Apple iOS 5.1 Apple iOS 5.0.1 Apple iOS 5 Apple iOS 4.3.5 Apple iOS 4.3.4 Apple iOS 4.3.3 Apple iOS 4.3.2 Apple iOS 4.3.1 Apple iOS 4.3 Apple iOS 4.2.9 Apple iOS 4.2.8 Apple iOS 4.2.7 Apple iOS 4.2.6 Apple iOS 4.2.5 Apple iOS 4.2.10 Apple iOS 4.2 Apple iOS 4.1 Apple iOS 4 Apple iOS 3.2 Apple iOS 3.1 Apple iOS 3.0 Apple iOS 2.1 Apple iOS 2.0 Apple iOS 11.2.2 Apple iOS 11.2.1 Apple iOS 11.2 Apple iOS 11.1 Apple iOS 11 Apple iOS 10.3.3 Apple iOS 10.3.2 Apple iOS 10.3.1 Apple iOS 10.3 Apple iOS 10.2 Apple iOS 10.1 Apple iOS 10
Not Vulnerable:	Apple watchOS 4.2.2 Apple tvOS 11.2.5 Apple iOS 11.2.5

Apple iOS/tvOS/watchOS Memory Corruption Vulnerabilities

Apple iOS, tvOS and watchOS are prone to multiple memory corruption vulnerabilities.

An attacker can leverage these issues to execute arbitrary code with system privileges. Failed exploit attempts will likely result in denial-of-service conditions.

This issue is fixed in:

Apple iOS 11.2.5
Apple watchOS 4.2.2
Apple tvOS 11.2.5

Apple iOS/tvOS/watchOS Memory Corruption Vulnerabilities

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Apple iOS/tvOS/watchOS Memory Corruption Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Apple iOS/tvOS/watchOS Memory Corruption Vulnerabilities

References:

• Apple Home Page (Apple)
  
• Apple iOS Homepage (Apple)
  
• Apple tvOS - Homepage (Apple)
  
• APPLE-SA-2018-1-23-1 iOS 11.2.5 (Apple)
  
• APPLE-SA-2018-1-23-3 watchOS 4.2.2 (Apple)
  
• APPLE-SA-2018-1-23-4 tvOS 11.2.5 (Apple)