CVE-2015-7081 — XML External Entity (XXE) Injection in Apple Iphone OS

4 documents3 sources
Severity
5.0MEDIUMNVD
EPSS
0.5%
top 32.77%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Apple Iphone OSApple MAC OS XApple IOS+1 more
Timeline
PublishedDec 11
Latest updateMay 17

Description

iBooks in Apple iOS before 9.2 and OS X before 10.11.2 allows remote attackers to read arbitrary files via an iBooks file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

CVSS vector

AV:N/AC:L/C:P/I:N/A:NExploitability: 10.0 | Impact: 2.9

Affected Packages4 packages

▶NVDapple/mac_os_x10.11.1
▶Appleapple/ios9.2

🔴Vulnerability Details

1
GHSA
GHSA-gx54-m73v-25x3: iBooks in Apple iOS before 9↗2022-05-17
▶

📋Vendor Advisories

2
Apple
CVE-2015-7081: OS X El Capitan 10.11.2, Security Update 2015-005 Yosemite, and Security Update 2015-008 Mavericks↗
▶
Apple
CVE-2015-7081: iOS 9.2↗
▶