CVE-2017-2423 An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. The issue involves the "Security" component. It allows remote attackers to bypass inte...
CriticalCVSS 9.8
EPSS 1.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. The issue involves the "Security" component. It allows remote attackers to bypass intended access restrictions by leveraging a successful result from a SecKeyRawVerify API call with an empty signature.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apple iphone os | <= 10.2.1 | No fix listed |
| apple mac os x | <= 10.12.3 | No fix listed |
References
- 97147 third-party-advisory vdb-entry
- 1038138 vdb-entry
- support.apple.com vendor-advisory
- support.apple.com vendor-advisory