Apple iOS/macOS/tvOS/watchOS CVE-2016-4688 Buffer Overflow Vulnerability

Bugtraq ID:	94572
Class:	Boundary Condition Error
CVE:	CVE-2016-4688
Remote:	Yes
Local:	No
Published:	Nov 27 2016 12:00AM
Updated:	Feb 02 2017 01:00AM
Credit:	Simon Huang of Alipay company, [email protected].
Vulnerable:	Apple watchOS 10.1.1 Apple watchOS 3.1.1 Apple watchOS 2.2.2 Apple watchOS 2.2.1 Apple watchOS 2.0.1 Apple watchOS 1.0.1 Apple watchOS 3.1 Apple watchOS 3.0 Apple watchOS 3 Apple watchOS 2.2 Apple watchOS 2.1 Apple watchOS 2.0 Apple watchOS 1.0 Apple tvOS 10.0.1 Apple tvOS 9.2.2 Apple tvOS 9.2.1 Apple tvOS 9.1.1 Apple tvOS 9.2 Apple tvOS 9.1 Apple tvOS 9.0 Apple tvOS 10 Apple macOS 10.12.1 Apple macOS 10.12 Apple iOS 5 0 Apple iOS 4 0 Apple iOS 3 0 Apple iOS 10.0.1 Apple iOS 9.3.4 Apple iOS 9.3.3 Apple iOS 9.3.2 Apple iOS 9.3.1 Apple iOS 9.2.1 Apple iOS 9.0.2 Apple iOS 9.0.1 Apple iOS 8.4.1 Apple iOS 7.2 Apple iOS 7.0.6 Apple iOS 7.0.5 Apple iOS 7.0.3 Apple iOS 7.0.2 Apple iOS 7.0.1 Apple iOS 6.3.1 Apple iOS 6.1.6 Apple iOS 6.1.4 Apple iOS 6.1.3 Apple iOS 4.2.1 Apple iOS 4.0.2 Apple iOS 4.0.1 Apple iOS 3.2.2 Apple iOS 3.2.1 Apple iOS 9.3.5 Apple iOS 9.3 Apple iOS 9.2 Apple iOS 9.1 Apple iOS 9 Apple iOS 8.4 Apple iOS 8.3 Apple iOS 8.2 Apple iOS 8.1.3 Apple iOS 8.1.2 Apple iOS 8.1.1 Apple iOS 8.1 Apple iOS 8 Apple iOS 7.1.2 Apple iOS 7.1.1 Apple iOS 7.1 Apple iOS 7.0.4 Apple iOS 7 Apple iOS 6.1 Apple iOS 6.0.2 Apple iOS 6.0.1 Apple iOS 6 Apple iOS 5.1.1 Apple iOS 5.1 Apple iOS 5.0.1 Apple iOS 5 Apple iOS 4.3.5 Apple iOS 4.3.4 Apple iOS 4.3.3 Apple iOS 4.3.2 Apple iOS 4.3.1 Apple iOS 4.3 Apple iOS 4.2.9 Apple iOS 4.2.8 Apple iOS 4.2.7 Apple iOS 4.2.6 Apple iOS 4.2.5 Apple iOS 4.2.10 Apple iOS 4.2 Apple iOS 4.1 Apple iOS 4 Apple iOS 3.2 Apple iOS 3.1 Apple iOS 3.0 Apple iOS 2.1 Apple iOS 2.0 Apple iOS 10.1 Apple iOS 10
Not Vulnerable:	Apple watchOS 3.1.3 Apple watchOS 3.1.1 Apple tvOS 10.1 Apple macOS 10.12.2 Apple Mac OS X Security Update 2016-006 0 Apple Mac OS X Security Update 2016-002 0 Apple iOS 10.2

Apple iOS/macOS/tvOS/watchOS CVE-2016-4688 Buffer Overflow Vulnerability

Apple iOS/macOS/tvOS and watchOS are prone to a buffer-overflow vulnerability because they fail to adequately bounds-check user-supplied data before copying it to an insufficiently sized memory buffer.

Attackers can exploit this issue to execute arbitrary code in the context of the affected application. Failed exploit attempts will result in denial-of-service conditions.

Apple iOS/macOS/tvOS/watchOS CVE-2016-4688 Buffer Overflow Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: mail:[email protected].

Apple iOS/macOS/tvOS/watchOS CVE-2016-4688 Buffer Overflow Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Apple iOS/macOS/tvOS/watchOS CVE-2016-4688 Buffer Overflow Vulnerability

References:

• About the security content of iOS 10.1 (Apple)
  
• About the security content of macOS Sierra 10.12.1, Security Update 2016-002 El (Apple)
  
• Apple Home Page (Apple)
  
• About the security content of tvOS 10.0.1 (Apple)
  
• About the security content of watchOS 3.1 (Apple)
  
• APPLE-SA-2017-01-23-3 watchOS 3.1.3 (Apple)