PT-2015-5076 · Apple · Foundation+2

Ikuya Fukumoto · Published 2015-04-10 · Updated 2019-03-08 · CVE-2015-1092

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Foundation in Apple iOS versions prior to 8.3 Foundation in Apple TV versions prior to 7.2

Description The issue allows remote attackers to read arbitrary files via an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. This occurs due to a problem with NSXMLParser in Foundation.

Recommendations For Foundation in Apple iOS versions prior to 8.3, update to version 8.3 or later. For Foundation in Apple TV versions prior to 7.2, update to version 7.2 or later.

Fix

Related Identifiers

CVE-2015-1092

Affected Products

Tv

Foundation

Ios

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2015-1092 · Security Note
• https://support.apple.com/HT204662 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2015/Apr/msg00002.html · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2015/Apr/msg00003.html · Vendor Advisory
• https://support.apple.com/HT204661 · Vendor Advisory
• http://securitytracker.com/id/1032050 · Note
• http://securityfocus.com/bid/73983 · Note
• https://support.apple.com/kb/HT204870 · Note