Apple iOS/WatchOS/tvOS Multiple Memory Corruption Vulnerabilities

Bugtraq ID:	98571
Class:	Input Validation Error
CVE:	CVE-2017-6999 CVE-2017-6998 CVE-2017-6997 CVE-2017-6996 CVE-2017-6995 CVE-2017-6994
Remote:	Yes
Local:	No
Published:	May 15 2017 12:00AM
Updated:	May 15 2017 12:00AM
Credit:	Adam Donenfeld (@doadam) of the Zimperium zLabs Team
Vulnerable:	Apple watchOS 10.1.1 Apple watchOS 3.1.3 Apple watchOS 3.1.1 Apple watchOS 2.2.2 Apple watchOS 2.2.1 Apple watchOS 2.0.1 Apple watchOS 1.0.1 Apple watchOS 3.2 Apple watchOS 3.1 Apple watchOS 3.0 Apple watchOS 3 Apple watchOS 2.2 Apple watchOS 2.1 Apple watchOS 2.0 Apple watchOS 1.0 Apple Watch 0 Apple tvOS 10.1.1 Apple tvOS 10.0.1 Apple tvOS 9.2.2 Apple tvOS 9.2.1 Apple tvOS 9.1.1 Apple tvOS 9.2 Apple tvOS 9.1 Apple tvOS 9.0 Apple tvOS 10.2 Apple tvOS 10.1 Apple tvOS 10 Apple TV 0 Apple iPod Touch 0 Apple iPhone 0 Apple iPad 0 Apple iOS 5 0 Apple iOS 4 0 Apple iOS 3 0 Apple iOS 10.2.1 Apple iOS 10.0.1 Apple iOS 9.3.4 Apple iOS 9.3.3 Apple iOS 9.3.2 Apple iOS 9.3.1 Apple iOS 9.2.1 Apple iOS 9.0.2 Apple iOS 9.0.1 Apple iOS 8.4.1 Apple iOS 7.2 Apple iOS 7.0.6 Apple iOS 7.0.5 Apple iOS 7.0.3 Apple iOS 7.0.2 Apple iOS 7.0.1 Apple iOS 6.3.1 Apple iOS 6.1.6 Apple iOS 6.1.4 Apple iOS 6.1.3 Apple iOS 4.2.1 Apple iOS 4.0.2 Apple iOS 4.0.1 Apple iOS 3.2.2 Apple iOS 3.2.1 Apple iOS 9.3.5 Apple iOS 9.3 Apple iOS 9.2 Apple iOS 9.1 Apple iOS 9 Apple iOS 8.4 Apple iOS 8.3 Apple iOS 8.2 Apple iOS 8.1.3 Apple iOS 8.1.2 Apple iOS 8.1.1 Apple iOS 8.1 Apple iOS 8 Apple iOS 7.1.2 Apple iOS 7.1.1 Apple iOS 7.1 Apple iOS 7.0.4 Apple iOS 7 Apple iOS 6.1 Apple iOS 6.0.2 Apple iOS 6.0.1 Apple iOS 6 Apple iOS 5.1.1 Apple iOS 5.1 Apple iOS 5.0.1 Apple iOS 5 Apple iOS 4.3.5 Apple iOS 4.3.4 Apple iOS 4.3.3 Apple iOS 4.3.2 Apple iOS 4.3.1 Apple iOS 4.3 Apple iOS 4.2.9 Apple iOS 4.2.8 Apple iOS 4.2.7 Apple iOS 4.2.6 Apple iOS 4.2.5 Apple iOS 4.2.10 Apple iOS 4.2 Apple iOS 4.1 Apple iOS 4 Apple iOS 3.2 Apple iOS 3.1 Apple iOS 3.0 Apple iOS 2.1 Apple iOS 2.0 Apple iOS 10.3.1 Apple iOS 10.3 Apple iOS 10.2 Apple iOS 10.1 Apple iOS 10
Not Vulnerable:	Apple watchOS 3.2.2 Apple tvOS 10.2.1 Apple iOS 10.3.2

Apple iOS/WatchOS/tvOS Multiple Memory Corruption Vulnerabilities

Apple iOS, WatchOS and tvOS are prone to multiple memory corruption vulnerabilities.

An attacker can exploit these issues to execute arbitrary code within the context of kernel privileges.

The following versions fixes the issue:

Versions prior to Apple iOS 10.3.2
Versions prior to Apple watchOS 3.2.2
Versions prior to Apple tvOS 10.2.1

Apple iOS/WatchOS/tvOS Multiple Memory Corruption Vulnerabilities

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Apple iOS/WatchOS/tvOS Multiple Memory Corruption Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Apple iOS/WatchOS/tvOS Multiple Memory Corruption Vulnerabilities

References:

• Apple Home Page (Apple)
  
• Apple iOS Homepage (Apple)
  
• Apple tvOS - Homepage (Apple)
  
• Apple watchOS Homepage (Apple)