CVE-2015-1086: Input Validation
Published Apr 10, 2015
·Updated
The Audio Drivers subsystem in Apple iOS before 8.3 and Apple TV before 7.2 does not properly validate IOKit object metadata, which allows attackers to execute arbitrary code in a privileged context via a crafted app.
Affected Software
2 affected components
tvOS<=7.1
iPhone OS<=8.2
Event History
Apr 10, 2015
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-1086?
CVE-2015-1086 has a high severity rating due to its potential to allow arbitrary code execution in a privileged context.
2
What software is affected by CVE-2015-1086?
CVE-2015-1086 affects Apple iOS versions before 8.3 and tvOS versions before 7.2.
3
How do I fix CVE-2015-1086?
To fix CVE-2015-1086, update to iOS 8.3 or later, or to tvOS 7.2 or later.
4
What kind of attack vector is associated with CVE-2015-1086?
CVE-2015-1086 can be exploited through a crafted application targeting the Audio Drivers subsystem.
5
Can CVE-2015-1086 lead to remote code execution?
Yes, exploitation of CVE-2015-1086 can lead to remote code execution under a privileged context.