Main Vulnerability Database Vulnerabilities #VU9566

Memory corruption in Apple iOS - CVE-2017-13861

Published: December 7, 2017 / Updated: June 17, 2021

Vulnerability identifier: #VU9566

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-13861

CWE-ID: CWE-119

Exploitation vector: Local access

Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a local attacker to execute arbitrary code o the target system.

The weakness exists due to boundary error in IOSurface. A local attacker can use a specially crafted application, trigger memory corruption and execute arbitrary code with kernel privileges.

Successful exploitation of the vulnerability may result in system compromise.

Affected software

Apple iOS
tvOS

How to mitigate CVE-2017-13861

Update to version 11.2.

Links to Public Exploits and PoC-codes

External References

https://support.apple.com/en-us/HT208334