CVE-2015-1092
First published: Fri Apr 10 2015(Updated: )
NSXMLParser in Foundation in Apple iOS before 8.3 and Apple TV before 7.2 allows remote attackers to read arbitrary files via an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Credit: product-security@apple.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| tvOS | <=7.1 | |
| iStyle @cosme iPhone OS | <=8.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.apple.com/archives/security-announce/2015/Apr/msg00002.html
- http://lists.apple.com/archives/security-announce/2015/Apr/msg00003.html
- http://www.securityfocus.com/bid/73983
- http://www.securitytracker.com/id/1032050
- https://support.apple.com/HT204661
- https://support.apple.com/HT204662
- https://support.apple.com/kb/HT204870
Frequently Asked Questions
What is the severity of CVE-2015-1092?
CVE-2015-1092 is considered a high severity vulnerability due to its potential for remote attackers to exploit XML External Entity (XXE) processing.
How do I fix CVE-2015-1092?
To mitigate CVE-2015-1092, users should upgrade to Apple iOS version 8.3 or later, or tvOS version 7.2 or later.
What are the potential impacts of CVE-2015-1092?
The exploitation of CVE-2015-1092 could allow remote attackers to read arbitrary files on the device.
Which devices are affected by CVE-2015-1092?
CVE-2015-1092 affects Apple iOS versions prior to 8.3 and Apple TV versions prior to 7.2.
What kind of vulnerability is CVE-2015-1092 classified as?
CVE-2015-1092 is classified as an XML External Entity (XXE) vulnerability.
- agent/type
- agent/severity
- agent/references
- agent/author
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/apple
- canonical/tvos
- version/tvos/7.1
- canonical/istyle @cosme iphone os
- version/istyle @cosme iphone os/8.2