CVE-2017-13861

43Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendepss 15%

from disclosure to weapon0 days

Published on NVDDec 25

1st PoCDec 11

metasploit+80d

exploitation probability

15%top 4% of all CVEs

observed exploitation

nono source reports it

3 public exploit(s)

An issue was discovered in certain Apple products. iOS before 11.2 is affected. tvOS before 11.2 is affected. watchOS before 4.2 is affected. The issue involves the "IOSurface" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

Affected products

n/a · n/a

public PoCs found — 3✓ VexDay Proof

exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/43320 cve_referencepacketstormsecurity.com/files/153148/Safari-Webkit-Proxy-Object-Type-Confusion.htmlunverified cve_referencewww.exploit-db.com/exploits/43320/unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://packetstormsecurity.com/files/153148/Safari-Webkit-Proxy-Object-Type-Confusion.html https://support.apple.com/HT208325 https://support.apple.com/HT208327 https://support.apple.com/HT208334 https://www.exploit-db.com/exploits/43320/http://www.securityfocus.com/bid/102134 http://www.securitytracker.com/id/1039952 http://www.securitytracker.com/id/1039953