CVE-2015-3784: Infoleak
First published: Sun Aug 16 2015(Updated: )
Office Viewer in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Credit: product-security@apple.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apple iOS and macOS | <=10.10.4 | |
| iOS | <=8.4 | |
| Apple Numbers | <=3.5 | |
| Apple Keynote | <=6.5 | |
| Apple Pages | <=5.5.3 | |
| Apple iWork | <=2.5.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html
- http://lists.apple.com/archives/security-announce/2015/Aug/msg00002.html
- http://lists.apple.com/archives/security-announce/2015/Oct/msg00000.html
- http://www.securityfocus.com/bid/76343
- http://www.securitytracker.com/id/1033275
- https://support.apple.com/HT205373
- https://support.apple.com/kb/HT205030
- https://support.apple.com/kb/HT205031
Frequently Asked Questions
What is the severity of CVE-2015-3784?
CVE-2015-3784 is considered a moderate severity vulnerability due to its potential impact on user data privacy.
How do I fix CVE-2015-3784?
To fix CVE-2015-3784, users should update to Apple iOS version 8.4.1 or later and OS X version 10.10.5 or later.
What types of software are affected by CVE-2015-3784?
CVE-2015-3784 affects Apple iOS, OS X, and specific applications such as Apple Numbers, Keynote, and Pages.
What kind of attack is possible with CVE-2015-3784?
CVE-2015-3784 allows remote attackers to read arbitrary files through an XML External Entity (XXE) vulnerability.
When was CVE-2015-3784 disclosed?
CVE-2015-3784 was disclosed in August 2015 as part of a security announcement from Apple.
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/author
- agent/severity
- agent/last-modified-date
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/apple
- canonical/apple ios and macos
- version/apple ios and macos/10.10.4
- canonical/ios
- version/ios/8.4
- canonical/apple numbers
- version/apple numbers/3.5
- canonical/apple keynote
- version/apple keynote/6.5
- canonical/apple pages
- version/apple pages/5.5.3
- canonical/apple iwork
- version/apple iwork/2.5.4