CVE-2017-13855: Incorrect Type Cast
First published: Sat Dec 02 2017(Updated: )
An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. tvOS before 11.2 is affected. watchOS before 4.2 is affected. The issue involves the "Kernel" component. It allows attackers to bypass intended memory-read restrictions via a crafted app that triggers type confusion.
Credit: Jann Horn Google Project ZeroJann Horn Google Project ZeroJann Horn Google Project ZeroJann Horn Google Project Zero product-security@apple.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apple iPhone OS | <11.2 | |
| Apple Mac OS X | <10.13.2 | |
| Apple tvOS | <11.2 | |
| Apple watchOS | <4.2 | |
| Apple iOS | <11.2 | 11.2 |
| Apple macOS High Sierra | <10.13.2 | 10.13.2 |
| Apple Sierra | ||
| Apple El Capitan | ||
| Apple watchOS | <4.2 | 4.2 |
| Apple tvOS | <11.2 | 11.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://support.apple.com/en-us/HT208325 (Advisory)
- https://support.apple.com/en-us/HT208327 (Advisory)
- https://support.apple.com/en-us/HT208331 (Advisory)
- https://support.apple.com/en-us/HT208334 (Advisory)
- http://www.securityfocus.com/bid/102100
- http://www.securitytracker.com/id/1039952
- http://www.securitytracker.com/id/1039953
- http://www.securitytracker.com/id/1039966
- https://support.apple.com/HT208325
- https://support.apple.com/HT208327
- https://support.apple.com/HT208331
- https://support.apple.com/HT208334
- https://www.exploit-db.com/exploits/43318/
Peer vulnerabilities
(Found alongside the following vulnerabilities)
- CVE-2017-13905
- CVE-2017-7172
- CVE-2017-7171
- CVE-2017-7151
- CVE-2017-7162
- CVE-2017-13861
- CVE-2017-13904
- CVE-2017-7154
- CVE-2017-13862
- CVE-2017-13867
- CVE-2017-13876
- CVE-2017-7173
- CVE-2017-13855
- CVE-2017-13865
- CVE-2017-13868
- CVE-2017-13869
- CVE-2017-13880
- CVE-2017-7165
- CVE-2017-13884
- CVE-2017-7153
- CVE-2017-13080
- CVE-2017-5754
- CVE-2017-13887
- CVE-2017-9798
- CVE-2017-13892
- CVE-2017-1000254
- CVE-2017-13872
- CVE-2017-15422
- CVE-2017-13883
- CVE-2017-7163
- CVE-2017-7155
- CVE-2017-13878
- CVE-2017-13875
- CVE-2017-7159
- CVE-2017-13848
- CVE-2017-13858
- CVE-2017-13847
- CVE-2017-13871
- CVE-2017-13860
- CVE-2017-3735
- CVE-2017-12837
- CVE-2017-7158
- CVE-2017-13911
- CVE-2017-13886
- CVE-2017-7164
- CVE-2017-13885
- CVE-2017-7156
- CVE-2017-7157
- CVE-2017-13856
- CVE-2017-13870
- CVE-2017-7160
- CVE-2017-13866
- CVE-2017-2411
- CVE-2017-13879
- CVE-2017-13874
- CVE-2017-7152
- CVE-2017-13888
- CVE-2017-13891
Frequently Asked Questions
What is CVE-2017-13855?
CVE-2017-13855 is a type confusion vulnerability in certain Apple products.
Which Apple products are affected by CVE-2017-13855?
iOS before 11.2, macOS before 10.13.2, tvOS before 11.2, and watchOS before 4.2 are affected by CVE-2017-13855.
How severe is CVE-2017-13855?
CVE-2017-13855 has a severity rating of 5.5 out of 10.
How can I fix CVE-2017-13855?
To fix CVE-2017-13855, update your Apple device to the latest supported version of iOS, macOS, tvOS, or watchOS.
Where can I find more information about CVE-2017-13855?
You can find more information about CVE-2017-13855 on the following security websites: [1](http://www.securityfocus.com/bid/102100), [2](http://www.securitytracker.com/id/1039952), [3](http://www.securitytracker.com/id/1039953)
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- agent/softwarecombine
- collector/apple-support
- agent/software-canonical-lookup-request
- collector/nvd-index
- agent/weakness
- agent/references
- agent/author
- agent/severity
- agent/tags
- agent/event
- agent/description
- collector/mitre-cve
- source/MITRE
- vendor/apple
- canonical/apple watchos
- canonical/apple macos high sierra
- canonical/apple sierra
- canonical/apple el capitan
- canonical/apple iphone os
- canonical/apple mac os x
- canonical/apple tvos
- canonical/apple ios