CVE-2017-13861
HighSummary
An issue was discovered in certain Apple products, including iOS before 11.2, tvOS before 11.2, and watchOS before 4.2, involving the 'IOSurface' component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
Risk Assessment
Organizations using affected versions may be vulnerable to arbitrary code execution or system crashes, potentially leading to data loss or service interruptions.
Recommendation
It is recommended to update systems to the latest versions to mitigate this vulnerability and to monitor applications for potential threats.
Other vulnerabilities in IOSurface
See all- CVE-2017-6979High
An issue was discovered in certain Apple products, including iOS, macOS, tvOS, and watchOS, related to the 'IOSurface' component. A race condition allows attackers to execute arbitrary code in a privileged context via a crafted app.
- CVE-2016-4625High
Use-after-free vulnerability in IOSurface in Apple OS X before 10.11.6 allows local users to gain privileges via unspecified vectors.
- CVE-2015-1061High
IOSurface in Apple iOS before 8.2, Apple OS X through 10.10.2, and Apple TV before 7.1 allows attackers to execute arbitrary code in a privileged context via a crafted app that leverages 'type confusion' during serialized-object handling.
Original NVD description (English source)
An issue was discovered in certain Apple products. iOS before 11.2 is affected. tvOS before 11.2 is affected. watchOS before 4.2 is affected. The issue involves the "IOSurface" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.