CVE-2017-7080
HighSummary
An issue was discovered in certain Apple products affecting iOS before 11, macOS before 10.13, tvOS before 11, and watchOS before 4. The issue involves the 'Security' component and allows remote attackers to bypass intended certificate-trust restrictions via a revoked X.509 certificate.
Risk Assessment
Attackers can exploit this vulnerability to gain trust in revoked certificates, potentially leading to unauthorized access to data and services. This poses a serious threat to information security within the organization.
Recommendation
It is recommended to update all affected Apple products to the latest versions to mitigate this vulnerability. Additionally, monitoring and auditing the use of certificates within the organization is advised.
Other vulnerabilities in Security
See all- CVE-2017-2535High
An issue was discovered in certain Apple products, including macOS before 10.12.5, in the 'Security' component. It allows attackers to conduct sandbox-escape attacks or cause a denial of service via a crafted app.
- CVE-2017-2498High
An issue was discovered in certain Apple products, including iOS before 10.3.2, related to the 'Security' component. It allows attackers to bypass intended access restrictions via an untrusted certificate.
- CVE-2017-2485High
An issue was discovered in certain Apple products related to the 'Security' component. It affects iOS before 10.3, macOS before 10.12.4, tvOS before 10.2, and watchOS before 3.2. The issue allows remote attackers to execute arbitrary code or cause a denial of service via a crafted X.509 certificate file.
- CVE-2017-2451High
An issue was discovered in certain Apple products affecting iOS before 10.3, macOS before 10.12.4, tvOS before 10.2, and watchOS before 3.2. The issue involves the 'Security' component and allows attackers to execute arbitrary code in a privileged context or cause a denial of service (buffer overflow) via a crafted app.
- CVE-2016-7662High
An issue was discovered in certain Apple products affecting iOS before 10.2, macOS before 10.12.2, and watchOS before 3.1.3. The issue involves the 'Security' component, allowing remote attackers to spoof certificates via unspecified vectors.
- CVE-2017-2423Critical
An issue was discovered in certain Apple products affecting iOS before 10.3 and macOS before 10.12.4. The issue involves the 'Security' component and allows remote attackers to bypass intended access restrictions.
- CVE-2026-46851High
Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle, affecting the security component. It allows an unauthenticated attacker with network access via HTTP to take control of the system.
Original NVD description (English source)
An issue was discovered in certain Apple products. iOS before 11 is affected. macOS before 10.13 is affected. tvOS before 11 is affected. watchOS before 4 is affected. The issue involves the "Security" component. It allows remote attackers to bypass intended certificate-trust restrictions via a revoked X.509 certificate.