PT-2014-5842 · Apple · Nsxmlparser+1

Published 2014-09-18 · Updated 2017-08-29 · CVE-2014-4374

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apple iOS versions prior to 8

Description The issue allows attackers to read arbitrary files via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue in the NSXMLParser component of the Foundation framework.

Recommendations For versions prior to 8, update to iOS 8 or later to resolve the issue.

Fix

Related Identifiers

CVE-2014-4374

Affected Products

Nsxmlparser

Ios

References · 8

• http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.html · Vendor Advisory
• http://support.apple.com/kb/HT6443 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-4374 · Security Note
• http://securityfocus.com/bid/69905 · Note
• http://support.apple.com/kb/HT6441 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/96077 · Note
• http://securitytracker.com/id/1030866 · Note
• http://securityfocus.com/bid/69882 · Note