CVE-2015-1157

HIGH
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

CoreText in Apple iOS 8.x through 8.3 allows remote attackers to cause a denial of service (reboot and messaging disruption) via crafted Unicode text that is not properly handled during display truncation in the Notifications feature, as demonstrated by Arabic characters in (1) an SMS message or (2) a WhatsApp message.

References

http://9to5mac.com/2015/05/27/how-to-fix-ios-text-message-bug-crash-reboot/

http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.html

http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html

http://lists.apple.com/archives/security-announce/2015/Sep/msg00003.html

http://support.apple.com/kb/HT204941

http://support.apple.com/kb/HT204942

http://www.ibtimes.co.uk/apple-ios-bug-sees-message-app-crash-iphone-reboot-simply-by-receiving-message-1503083

http://www.reddit.com/r/apple/comments/37e8c1/malicious_text_message/

http://www.reddit.com/r/apple/comments/37enow/about_the_latest_iphone_security_vulnerability/

http://www.reddit.com/r/explainlikeimfive/comments/37edde/eli5_how_that_text_you_can_send_to_friends_turns/

http://www.securityfocus.com/bid/75491

http://www.securitytracker.com/id/1032408

http://zanzebek.com/a-simple-text-message-can-ruin-any-iphone/

https://ghostbin.com/paste/zws9m

https://support.apple.com/HT205221

Details

Source: MITRE

Published: 2015-05-28

Updated: 2016-11-28

Type: CWE-17

Risk Information

CVSS v2

Base Score: 7.8

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C

Impact Score: 6.9

Exploitability Score: 10

Severity: HIGH

Tenable Plugins

View all (8 total)

IDNameProductFamilySeverity
86601Apple iTunes < 12.3 Multiple Vulnerabilities (uncredentialed check)NessusPeer-To-Peer File Sharing
high
8958iTunes for Windows < 12.3 Multiple Vulnerabilities Nessus Network MonitorWeb Clients
high
8977Apple iOS < 8.4 Multiple VulnerabilitiesNessus Network MonitorMobile Devices
high
8801Mac OS X < 10.10.4 Multiple VulnerabilitiesNessus Network MonitorOperating System Detection
critical
86001Apple iTunes < 12.3 Multiple Vulnerabilities (credentialed check)NessusWindows
high
84490Apple iOS < 8.4 Multiple Vulnerabilities (Logjam)NessusMobile Devices
high
84489Mac OS X Multiple Vulnerabilities (Security Update 2015-005) (GHOST) (Logjam)NessusMacOS X Local Security Checks
critical
84488Mac OS X 10.10.x < 10.10.4 Multiple Vulnerabilities (GHOST) (Logjam)NessusMacOS X Local Security Checks
critical