CVE-2017-6979
HighSummary
An issue was discovered in certain Apple products, including iOS, macOS, tvOS, and watchOS, related to the 'IOSurface' component. A race condition allows attackers to execute arbitrary code in a privileged context via a crafted app.
Risk Assessment
Organizations may be exposed to unauthorized access to systems and data, potentially leading to serious security breaches.
Recommendation
It is recommended to update systems to the latest versions to mitigate this vulnerability and to monitor third-party applications for potential threats.
Other vulnerabilities in IOSurface
See all- CVE-2017-13861High
An issue was discovered in certain Apple products, including iOS before 11.2, tvOS before 11.2, and watchOS before 4.2, involving the 'IOSurface' component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
- CVE-2016-4625High
Use-after-free vulnerability in IOSurface in Apple OS X before 10.11.6 allows local users to gain privileges via unspecified vectors.
- CVE-2015-1061High
IOSurface in Apple iOS before 8.2, Apple OS X through 10.10.2, and Apple TV before 7.1 allows attackers to execute arbitrary code in a privileged context via a crafted app that leverages 'type confusion' during serialized-object handling.
Original NVD description (English source)
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the "IOSurface" component. A race condition allows attackers to execute arbitrary code in a privileged context via a crafted app.