First published: Tue Sep 12 2017(Updated: )
An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud before 7.0 on Windows is affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
Credit: Apple Wei Yuan Baidu Security Lab working with Trend MicroQixun Zhao @S0rryMybad Qihoo 360 Vulcan TeamSamuel Gro Niklas Baumstark Trend MicroTim Michaud @TimGMichaud Leviathan Security GroupWang Junjie Wei Lei Liu Yang Nanyang Technological University working with Trend MicroWei Yuan Baidu Security LabFelipe Freitas Instituto TecnolMasato Kinugawa Mario Heiderich Cure53Liu Yang Nanyang Technological Universitylikemeng Baidu Secutity Lablikemeng Baidu Security Lablokihardt Google Project Zerochenqin (陈钦) Ant product-security@apple.com
Affected Software | Affected Version | How to fix |
---|---|---|
tvOS | <11 | 11 |
Apple iOS, iPadOS, and watchOS | <11 | 11 |
Apple iCloud | <7.0 | 7.0 |
Apple Mobile Safari | <=10.1.2 | |
iStyle @cosme iPhone OS | <=10.3.3 | |
tvOS | <=10.2.2 | |
iCloud Drive | <=6.9.1 | |
iTunes | <=12.6.2 | |
Microsoft Windows | ||
iTunes | <12.7 | 12.7 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
(Found alongside the following vulnerabilities)
CVE-2017-7120 is a vulnerability in certain Apple products, including iOS, Safari, iCloud for Windows, iTunes, and tvOS, that allows remote attackers to execute arbitrary code or cause a denial of service.
iOS versions before 11, Safari versions before 11, iCloud for Windows versions before 7.0, iTunes for Windows versions before 12.7, and tvOS versions before 11 are affected.
CVE-2017-7120 has a severity score of 8.8, which is considered high.
To fix CVE-2017-7120, update your iOS, Safari, iCloud for Windows, iTunes, and tvOS to the latest versions as recommended by Apple.
You can find more information about CVE-2017-7120 on the Apple security advisory page (https://support.apple.com/en-us/HT208142), SecurityFocus (http://www.securityfocus.com/bid/101006), and SecurityTracker (http://www.securitytracker.com/id/1039384).