Apple iOS/macOS/tvOS CVE-2017-7008 Memory Corruption Vulnerability

Bugtraq ID:	99880
Class:	Unknown
CVE:	CVE-2017-7008
Remote:	Yes
Local:	No
Published:	Jul 19 2017 12:00AM
Updated:	Jul 19 2017 12:00AM
Credit:	Yangkang (@dnpushme) of Qihoo 360 Qex Team.
Vulnerable:	Apple tvOS 10.1.1 Apple tvOS 10.0.1 Apple tvOS 9.2.2 Apple tvOS 9.2.1 Apple tvOS 9.1.1 Apple tvOS 9.2 Apple tvOS 9.1 Apple tvOS 9.0 Apple tvOS 10.2.1 Apple tvOS 10.2 Apple tvOS 10.1 Apple tvOS 10 Apple TV 0 Apple macOS 10.12.5 Apple iPod Touch 0 Apple iPhone 0 Apple iPad 0 Apple iOS 5 0 Apple iOS 4 0 Apple iOS 3 0 Apple iOS 10.2.1 Apple iOS 10.0.1 Apple iOS 9.3.4 Apple iOS 9.3.3 Apple iOS 9.3.2 Apple iOS 9.3.1 Apple iOS 9.2.1 Apple iOS 9.0.2 Apple iOS 9.0.1 Apple iOS 8.4.1 Apple iOS 7.2 Apple iOS 7.0.6 Apple iOS 7.0.5 Apple iOS 7.0.3 Apple iOS 7.0.2 Apple iOS 7.0.1 Apple iOS 6.3.1 Apple iOS 6.1.6 Apple iOS 6.1.4 Apple iOS 6.1.3 Apple iOS 4.2.1 Apple iOS 4.0.2 Apple iOS 4.0.1 Apple iOS 3.2.2 Apple iOS 3.2.1 Apple iOS 9.3.5 Apple iOS 9.3 Apple iOS 9.2 Apple iOS 9.1 Apple iOS 9 Apple iOS 8.4 Apple iOS 8.3 Apple iOS 8.2 Apple iOS 8.1.3 Apple iOS 8.1.2 Apple iOS 8.1.1 Apple iOS 8.1 Apple iOS 8 Apple iOS 7.1.2 Apple iOS 7.1.1 Apple iOS 7.1 Apple iOS 7.0.4 Apple iOS 7 Apple iOS 6.1 Apple iOS 6.0.2 Apple iOS 6.0.1 Apple iOS 6 Apple iOS 5.1.1 Apple iOS 5.1 Apple iOS 5.0.1 Apple iOS 5 Apple iOS 4.3.5 Apple iOS 4.3.4 Apple iOS 4.3.3 Apple iOS 4.3.2 Apple iOS 4.3.1 Apple iOS 4.3 Apple iOS 4.2.9 Apple iOS 4.2.8 Apple iOS 4.2.7 Apple iOS 4.2.6 Apple iOS 4.2.5 Apple iOS 4.2.10 Apple iOS 4.2 Apple iOS 4.1 Apple iOS 4 Apple iOS 3.2 Apple iOS 3.1 Apple iOS 3.0 Apple iOS 2.1 Apple iOS 2.0 Apple iOS 10.3.2 Apple iOS 10.3.1 Apple iOS 10.3 Apple iOS 10.2 Apple iOS 10.1 Apple iOS 10
Not Vulnerable:	Apple tvOS 10.2.2 Apple macOS 10.12.6 Apple iOS 10.3.3

Apple iOS/macOS/tvOS CVE-2017-7008 Memory Corruption Vulnerability

Apple iOS, macOS and tvOS are prone to a memory corruption vulnerability.

Attackers can exploit this issue to execute arbitrary code within the context of the application. Failed exploit attempts may result in a denial-of-service condition.

The following versions fixes the issue:

Versions prior to Apple iOS 10.3.3
Versions prior to Apple tvOS 10.2.2
Versions prior to Apple macOS 10.12.6

Apple iOS/macOS/tvOS CVE-2017-7008 Memory Corruption Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Apple iOS/macOS/tvOS CVE-2017-7008 Memory Corruption Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Apple iOS/macOS/tvOS CVE-2017-7008 Memory Corruption Vulnerability

References:

• Apple Home Page (Apple)
  
• Apple iOS Homepage (Apple)
  
• Apple Mac OS X Homepage (Apple)
  
• Apple tvOS - Homepage (Apple)
  
• About the security content of iOS 10.3.3 (Apple)
  
• About the security content of macOS Sierra 10.12.6, Security Update 2017-003 El (Apple)
  
• About the security content of tvOS 10.2.2 (Apple)