Details of VAR-201710-1378

ID

VAR-201710-1378

CVE

CVE-2017-7130

TITLE

plural Apple Product third party SQLite Service disruption in (DoS) Vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2017-009320

DESCRIPTION

An issue was discovered in certain Apple products. iOS before 11 is affected. macOS before 10.13 is affected. tvOS before 11 is affected. watchOS before 4 is affected. The issue involves the third-party "SQLite" product. Versions before 3.19.3 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact. SQLite is prone to multiple unspecified security vulnerabilities. Little is known about these issues or its effects at this time. We will update this BID as more information emerges. SQLite 3.19.3 and prior are vulnerable. Apple iOS is an operating system developed for mobile devices; tvOS is a smart TV operating system. SQLite is one of the C-language-based open source embedded relational database management components developed by American software developer D.Richard Hipp. A security vulnerability exists in versions of the SQLite component prior to 3.19.3 in several Apple products. The following products and versions are affected: Apple macOS prior to 10.13 High Sierra; prior to iOS 11; prior to tvOS 11; prior to watchOS 4. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 APPLE-SA-2017-09-25-5 Additional information for APPLE-SA-2017-09-20-2 watchOS 4 watchOS 4 addresses the following: CFNetwork Proxies Available for: All Apple Watch models Impact: An attacker in a privileged network position may be able to cause a denial of service Description: Multiple denial of service issues were addressed through improved memory handling. CVE-2017-7083: Abhinav Bansal of Zscaler Inc. Entry added September 25, 2017 CoreAudio Available for: All Apple Watch models Impact: An application may be able to read restricted memory Description: An out-of-bounds read was addressed by updating to Opus version 1.1.4. CVE-2017-0381: V.E.O (@VYSEa) of Mobile Threat Research Team, Trend Micro Entry added September 25, 2017 Kernel Available for: All Apple Watch models Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2017-7114: Alex Plaskett of MWR InfoSecurity Entry added September 25, 2017 libc Available for: All Apple Watch models Impact: A remote attacker may be able to cause a denial-of-service Description: A resource exhaustion issue in glob() was addressed through an improved algorithm. CVE-2017-7086: Russ Cox of Google Entry added September 25, 2017 libc Available for: All Apple Watch models Impact: An application may be able to cause a denial of service Description: A memory consumption issue was addressed through improved memory handling. CVE-2017-1000373 Entry added September 25, 2017 libexpat Available for: All Apple Watch models Impact: Multiple issues in expat Description: Multiple issues were addressed by updating to version 2.2.1 CVE-2016-9063 CVE-2017-9233 Entry added September 25, 2017 Security Available for: All Apple Watch models Impact: A revoked certificate may be trusted Description: A certificate validation issue existed in the handling of revocation data. This issue was addressed through improved validation. CVE-2017-7080: an anonymous researcher, Sven Driemecker of adesso mobile solutions gmbh, an anonymous researcher, Rune Darrud (@theflyingcorpse) of BA|rum kommune Entry added September 25, 2017 SQLite Available for: All Apple Watch models Impact: Multiple issues in SQLite Description: Multiple issues were addressed by updating to version 3.19.3. CVE-2017-10989: found by OSS-Fuzz CVE-2017-7128: found by OSS-Fuzz CVE-2017-7129: found by OSS-Fuzz CVE-2017-7130: found by OSS-Fuzz Entry added September 25, 2017 SQLite Available for: All Apple Watch models Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2017-7127: an anonymous researcher Entry added September 25, 2017 Wi-Fi Available for: All Apple Watch models Impact: Malicious code executing on the Wi-Fi chip may be able to execute arbitrary code with kernel privileges on the application processor Description: A memory corruption issue was addressed with improved memory handling. CVE-2017-7103: Gal Beniamini of Google Project Zero CVE-2017-7105: Gal Beniamini of Google Project Zero CVE-2017-7108: Gal Beniamini of Google Project Zero CVE-2017-7110: Gal Beniamini of Google Project Zero CVE-2017-7112: Gal Beniamini of Google Project Zero Wi-Fi Available for: All Apple Watch models Impact: Malicious code executing on the Wi-Fi chip may be able to read restricted kernel memory Description: A validation issue was addressed with improved input sanitization. CVE-2017-7116: Gal Beniamini of Google Project Zero zlib Available for: All Apple Watch models Impact: Multiple issues in zlib Description: Multiple issues were addressed by updating to version 1.2.11. CVE-2016-9840 CVE-2016-9841 CVE-2016-9842 CVE-2016-9843 Entry added September 25, 2017 Additional recognition Security We would like to acknowledge Abhinav Bansal of Zscaler, Inc. for their assistance. Installation note: Instructions on how to update your Apple Watch software are available at https://support.apple.com/kb/HT204641 To check the version on your Apple Watch, open the Apple Watch app on your iPhone and select "My Watch > General > About". Alternatively, on your watch, select "My Watch > General > About". Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJZyUQgAAoJEIOj74w0bLRGqL0QAIfT73f98ConKBEM8SMpm/g/ CtIS26bKtiSIniKWXjj0CHRcnFT4FPos5md2yNhBOTWIgChGtulnORWSowWu2RtI LVxqskUc97e6LLoTzFc8AM8q6b3Km2cx7C2iVNZWFrLO/JeDHfC8x2pMCgAT8Bx4 Q5FbDIGwD5+w+UYHgIVytqEPvt29OEwOBi41/f78Bvqj1oMf5+EQGjMFU+pECWGg zDucvK0iirv+5k5YcovpiQlaqx0QBPTMcaZJQLDY3t6k2RpdJZr5M7xd4Oanu0l1 E2blAl4CWN8zSQkdUfMdlamXYWwOvyv4b9iKb0+sKeLWHpWbaQ/LmOHuPHjvFgRq YWE72P3l5IVWSPZfgsUvD+70uHAobv70MB5O+TQnbLCemnwqq19psez8PMYR2fTF OfV0Dr6mpsa2GAVexNesEodlLz5a7kdjiBEAIUujJZzL8bVGdHjNll2qxHZCwlUW mWrxqot2QnymQ7Ycs1mGxg/97snO1eGT44BjVpQ47COSzI+YBhg2lLP15sGdRbF5 viCWhLkJGNBUN7naV/Jsj8sJNW0RBC1tkEz9cfRBLkU7ObtkJCORTwnmiz0jNzQf gvtVsBC+nBAlJA40Do1lB8rQw1yyizcUmckDywcJg7MatkwIymdgashIR/LVeBHR 39wnv7L2yjedzyd+/y5E =ACi9 -----END PGP SIGNATURE-----

Trust: 2.07

sources: NVD: CVE-2017-7130 // JVNDB: JVNDB-2017-009320 // BID: 100987 // VULHUB: VHN-115333 // PACKETSTORM: 144370

AFFECTED PRODUCTS

vendor:	apple	model:	tvos	scope:	lte	version:	10.2.2	Trust: 1.0
vendor:	apple	model:	mac os x	scope:	lte	version:	10.12.6	Trust: 1.0
vendor:	apple	model:	watchos	scope:	lte	version:	3.2.3	Trust: 1.0
vendor:	apple	model:	iphone os	scope:	lte	version:	10.3.3	Trust: 1.0
vendor:	apple	model:	watchos	scope:	eq	version:	3.2.3	Trust: 0.9
vendor:	apple	model:	mac os x	scope:	lt	version:	10.8 or later 10.13	Trust: 0.8
vendor:	apple	model:	ios	scope:	lt	version:	11 (ipad air or later )	Trust: 0.8
vendor:	apple	model:	ios	scope:	lt	version:	11 (iphone 5s or later )	Trust: 0.8
vendor:	apple	model:	ios	scope:	lt	version:	11 (ipod touch first 6 generation )	Trust: 0.8
vendor:	apple	model:	tvos	scope:	lt	version:	11 (apple tv first 4 generation )	Trust: 0.8
vendor:	apple	model:	watchos	scope:	lt	version:	4 (apple watch all models )	Trust: 0.8
vendor:	apple	model:	tv	scope:	eq	version:	10.2.2	Trust: 0.6
vendor:	apple	model:	iphone os	scope:	eq	version:	10.3.3	Trust: 0.6
vendor:	apple	model:	mac os x	scope:	eq	version:	10.12.6	Trust: 0.6
vendor:	apple	model:	ios	scope:	eq	version:	30	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	8	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	7	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	10.3.2	Trust: 0.3
vendor:	apple	model:	tvos	scope:	eq	version:	10.2.2	Trust: 0.3
vendor:	apple	model:	watchos	scope:	eq	version:	3.1.3	Trust: 0.3
vendor:	apple	model:	tvos	scope:	eq	version:	10.0.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	4.2.8	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	4	Trust: 0.3
vendor:	apple	model:	watch	scope:	eq	version:	0	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	4.3	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	9.0.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	4.0.2	Trust: 0.3
vendor:	apple	model:	macos	scope:	eq	version:	10.12	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	4.2	Trust: 0.3
vendor:	sqlite	model:	sqlite	scope:	eq	version:	3.13.0	Trust: 0.3
vendor:	apple	model:	watchos	scope:	eq	version:	2.0	Trust: 0.3
vendor:	apple	model:	watchos	scope:	eq	version:	3.0	Trust: 0.3
vendor:	apple	model:	tvos	scope:	eq	version:	10.1.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	8.2	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	4.0.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	8.1.2	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	8.4	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	4.1	Trust: 0.3
vendor:	sqlite	model:	sqlite	scope:	eq	version:	3.5.9	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	7.0.3	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	8.1.3	Trust: 0.3
vendor:	apple	model:	tvos	scope:	eq	version:	9.2.2	Trust: 0.3
vendor:	apple	model:	watchos	scope:	eq	version:	2.0.1	Trust: 0.3
vendor:	sqlite	model:	sqlite	scope:	ne	version:	3.19.3	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	9	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	4.2.10	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	2.1	Trust: 0.3
vendor:	apple	model:	macos	scope:	eq	version:	10.12.4	Trust: 0.3
vendor:	apple	model:	mac os	scope:	eq	version:	x10.8	Trust: 0.3
vendor:	apple	model:	mac os	scope:	eq	version:	x10.8.4	Trust: 0.3
vendor:	apple	model:	tvos	scope:	eq	version:	9.1.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	3.0	Trust: 0.3
vendor:	apple	model:	mac os	scope:	eq	version:	x10.8.1	Trust: 0.3
vendor:	apple	model:	ipod touch	scope:	eq	version:	0	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	9.3.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	40	Trust: 0.3
vendor:	sqlite	model:	sqlite	scope:	eq	version:	3.20.0	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	9.3	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	4.3.3	Trust: 0.3
vendor:	sqlite	model:	sqlite	scope:	eq	version:	3.8.8	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	10.2.1	Trust: 0.3
vendor:	sqlite	model:	sqlite	scope:	eq	version:	3.6.20	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	6.1.3	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	3.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	10.3.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	7.1.1	Trust: 0.3
vendor:	apple	model:	tvos	scope:	eq	version:	10.2	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	7.0.4	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	4.3.5	Trust: 0.3
vendor:	sqlite	model:	sqlite	scope:	eq	version:	3.8.0	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	7.1	Trust: 0.3
vendor:	apple	model:	tvos	scope:	eq	version:	10	Trust: 0.3
vendor:	apple	model:	watchos	scope:	ne	version:	4	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	8.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	9.0.2	Trust: 0.3
vendor:	sqlite	model:	sqlite	scope:	eq	version:	3.8.2	Trust: 0.3
vendor:	apple	model:	tvos	scope:	eq	version:	10.2.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	8.4.1	Trust: 0.3
vendor:	apple	model:	watchos	scope:	eq	version:	3.2.2	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	9.1	Trust: 0.3
vendor:	apple	model:	macos	scope:	eq	version:	10.12.1	Trust: 0.3
vendor:	apple	model:	tv	scope:	eq	version:	0	Trust: 0.3
vendor:	apple	model:	macos	scope:	ne	version:	10.13	Trust: 0.3
vendor:	apple	model:	watchos	scope:	eq	version:	1.0.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	6.3.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	7.0.6	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	50	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	5	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	4.2.9	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	10.3	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	10.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	2.0	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	7.1.2	Trust: 0.3
vendor:	sqlite	model:	sqlite	scope:	eq	version:	3.8.3	Trust: 0.3
vendor:	apple	model:	mac os	scope:	eq	version:	x10.8.5	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	7.2	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	10.2	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	6.1.4	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	10	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	9.2.1	Trust: 0.3
vendor:	apple	model:	watchos	scope:	eq	version:	3	Trust: 0.3
vendor:	apple	model:	tvos	scope:	eq	version:	9.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	5.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	ne	version:	11	Trust: 0.3
vendor:	apple	model:	iphone	scope:	eq	version:	0	Trust: 0.3
vendor:	apple	model:	tvos	scope:	eq	version:	10.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	9.3.4	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	4.2.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	7.0.5	Trust: 0.3
vendor:	apple	model:	tvos	scope:	eq	version:	9.2	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	9.3.5	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	6	Trust: 0.3
vendor:	apple	model:	tvos	scope:	eq	version:	9.2.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	8.1.1	Trust: 0.3
vendor:	apple	model:	watchos	scope:	eq	version:	1.0	Trust: 0.3
vendor:	sqlite	model:	sqlite	scope:	eq	version:	3.8.9	Trust: 0.3
vendor:	apple	model:	watchos	scope:	eq	version:	2.2.1	Trust: 0.3
vendor:	apple	model:	watchos	scope:	eq	version:	3.2.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	6.0.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	4.2.7	Trust: 0.3
vendor:	apple	model:	tvos	scope:	ne	version:	11	Trust: 0.3
vendor:	apple	model:	mac os	scope:	eq	version:	x10.8.3	Trust: 0.3
vendor:	apple	model:	macos	scope:	eq	version:	10.12.6	Trust: 0.3
vendor:	apple	model:	watchos	scope:	eq	version:	3.2	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	4.3.2	Trust: 0.3
vendor:	apple	model:	watchos	scope:	eq	version:	2.2	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	9.2	Trust: 0.3
vendor:	apple	model:	ipad	scope:	eq	version:	0	Trust: 0.3
vendor:	apple	model:	watchos	scope:	eq	version:	2.1	Trust: 0.3
vendor:	apple	model:	macos	scope:	eq	version:	10.12.2	Trust: 0.3
vendor:	apple	model:	macos	scope:	eq	version:	10.12.3	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	9.3.3	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	5.1.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	5.0.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	6.1	Trust: 0.3
vendor:	apple	model:	macos	scope:	eq	version:	10.12.5	Trust: 0.3
vendor:	apple	model:	watchos	scope:	eq	version:	10.1.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	3.2.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	6.1.6	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	4.3.4	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	10.0.1	Trust: 0.3
vendor:	apple	model:	watchos	scope:	eq	version:	2.2.2	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	6.0.2	Trust: 0.3
vendor:	sqlite	model:	sqlite	scope:	eq	version:	3.8.10.1	Trust: 0.3
vendor:	apple	model:	watchos	scope:	eq	version:	3.1.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	3.2.2	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	9.3.2	Trust: 0.3
vendor:	apple	model:	mac os	scope:	eq	version:	x10.8.2	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	4.2.5	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	4.3.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	8.3	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	10.3.3	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	7.0.2	Trust: 0.3
vendor:	apple	model:	watchos	scope:	eq	version:	3.1	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	3.2	Trust: 0.3
vendor:	sqlite	model:	sqlite	scope:	eq	version:	1.2.2	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	4.2.6	Trust: 0.3
vendor:	apple	model:	tvos	scope:	eq	version:	9.0	Trust: 0.3
vendor:	apple	model:	ios	scope:	eq	version:	7.0.1	Trust: 0.3

sources: BID: 100987 // JVNDB: JVNDB-2017-009320 // CNNVD: CNNVD-201703-983 // NVD: CVE-2017-7130

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2017-7130
value:	CRITICAL
Trust: 1.0
NVD:	CVE-2017-7130
value:	CRITICAL
Trust: 0.8
CNNVD:	CNNVD-201703-983
value:	CRITICAL
Trust: 0.6
VULHUB:	VHN-115333
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2017-7130
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-115333
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2017-7130
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.0
Trust: 1.8

sources: VULHUB: VHN-115333 // JVNDB: JVNDB-2017-009320 // CNNVD: CNNVD-201703-983 // NVD: CVE-2017-7130

PROBLEMTYPE DATA

problemtype:

CWE-119

Trust: 1.9

sources: VULHUB: VHN-115333 // JVNDB: JVNDB-2017-009320 // NVD: CVE-2017-7130

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201703-983

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-201703-983

CONFIGURATIONS

sources: JVNDB: JVNDB-2017-009320

PATCH

title:	Apple security updates	url:	https://support.apple.com/en-us/HT201222	Trust: 0.8
title:	HT208115	url:	https://support.apple.com/en-us/HT208115	Trust: 0.8
title:	HT208144	url:	https://support.apple.com/en-us/HT208144	Trust: 0.8
title:	HT208112	url:	https://support.apple.com/en-us/HT208112	Trust: 0.8
title:	HT208113	url:	https://support.apple.com/en-us/HT208113	Trust: 0.8
title:	HT208112	url:	https://support.apple.com/ja-jp/HT208112	Trust: 0.8
title:	HT208113	url:	https://support.apple.com/ja-jp/HT208113	Trust: 0.8
title:	HT208115	url:	https://support.apple.com/ja-jp/HT208115	Trust: 0.8
title:	HT208144	url:	https://support.apple.com/ja-jp/HT208144	Trust: 0.8
title:	Multiple Apple product SQLite Security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=90632	Trust: 0.6

sources: JVNDB: JVNDB-2017-009320 // CNNVD: CNNVD-201703-983

EXTERNAL IDS

db:	NVD	id:	CVE-2017-7130	Trust: 2.9
db:	BID	id:	100987	Trust: 2.0
db:	SECTRACK	id:	1039427	Trust: 1.7
db:	JVN	id:	JVNVU99806334	Trust: 0.8
db:	JVNDB	id:	JVNDB-2017-009320	Trust: 0.8
db:	CNNVD	id:	CNNVD-201703-983	Trust: 0.7
db:	VULHUB	id:	VHN-115333	Trust: 0.1
db:	PACKETSTORM	id:	144370	Trust: 0.1

sources: VULHUB: VHN-115333 // BID: 100987 // JVNDB: JVNDB-2017-009320 // PACKETSTORM: 144370 // CNNVD: CNNVD-201703-983 // NVD: CVE-2017-7130

REFERENCES

url:	http://www.securityfocus.com/bid/100987	Trust: 1.7
url:	https://support.apple.com/ht208112	Trust: 1.7
url:	https://support.apple.com/ht208113	Trust: 1.7
url:	https://support.apple.com/ht208115	Trust: 1.7
url:	https://support.apple.com/ht208144	Trust: 1.7
url:	http://www.securitytracker.com/id/1039427	Trust: 1.7
url:	https://nvd.nist.gov/vuln/detail/cve-2017-7130	Trust: 0.9
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-7130	Trust: 0.8
url:	http://jvn.jp/vu/jvnvu99806334/index.html	Trust: 0.8
url:	https://www.apple.com/	Trust: 0.3
url:	http://www.apple.com/ios/	Trust: 0.3
url:	http://www.apple.com/accessibility/tvos/	Trust: 0.3
url:	http://www.apple.com/watchos-2/	Trust: 0.3
url:	https://nvd.nist.gov/vuln/detail/cve-2017-9233	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2017-7112	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2017-7114	Trust: 0.1
url:	https://support.apple.com/kb/ht204641	Trust: 0.1
url:	https://support.apple.com/kb/ht201222	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2017-10989	Trust: 0.1
url:	https://gpgtools.org	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2017-7080	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2017-0381	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2017-7110	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2016-9842	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2017-1000373	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2017-7083	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2017-7129	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2017-7108	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2017-7128	Trust: 0.1
url:	https://www.apple.com/support/security/pgp/	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2016-9840	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2017-7127	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2017-7103	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2016-9063	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2016-9841	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2017-7086	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2017-7116	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2016-9843	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2017-7105	Trust: 0.1

sources: VULHUB: VHN-115333 // BID: 100987 // JVNDB: JVNDB-2017-009320 // PACKETSTORM: 144370 // CNNVD: CNNVD-201703-983 // NVD: CVE-2017-7130

CREDITS

OSS-Fuzz

Trust: 0.3

sources: BID: 100987

SOURCES

db:	VULHUB	id:	VHN-115333
db:	BID	id:	100987
db:	JVNDB	id:	JVNDB-2017-009320
db:	PACKETSTORM	id:	144370
db:	CNNVD	id:	CNNVD-201703-983
db:	NVD	id:	CVE-2017-7130

LAST UPDATE DATE

2024-11-23T20:32:03.900000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-115333	date:	2019-03-08T00:00:00
db:	BID	id:	100987	date:	2017-09-25T00:00:00
db:	JVNDB	id:	JVNDB-2017-009320	date:	2017-11-09T00:00:00
db:	CNNVD	id:	CNNVD-201703-983	date:	2019-03-13T00:00:00
db:	NVD	id:	CVE-2017-7130	date:	2024-11-21T03:31:14.073

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-115333	date:	2017-10-23T00:00:00
db:	BID	id:	100987	date:	2017-09-25T00:00:00
db:	JVNDB	id:	JVNDB-2017-009320	date:	2017-11-09T00:00:00
db:	PACKETSTORM	id:	144370	date:	2017-09-28T00:21:17
db:	CNNVD	id:	CNNVD-201703-983	date:	2017-03-23T00:00:00
db:	NVD	id:	CVE-2017-7130	date:	2017-10-23T01:29:13.487