CVE-2015-3784

high

Description

Office Viewer in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

References

https://support.apple.com/kb/HT205031

https://support.apple.com/kb/HT205030

https://support.apple.com/HT205373

http://www.securitytracker.com/id/1033275

http://www.securityfocus.com/bid/76343

http://lists.apple.com/archives/security-announce/2015/Oct/msg00000.html

http://lists.apple.com/archives/security-announce/2015/Aug/msg00002.html

http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html

Details

Source: Mitre, NVD

Published: 2015-08-16

Updated: 2025-04-12

Risk Information

CVSS v2

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

Severity: Medium

CVSS v3

Base Score: 7.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Severity: High

EPSS

EPSS: 0.00592