CVEvulnerability
CVE-2015-3784
5.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2015-08-16
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-200
Description
Office Viewer in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Affected configurations
• apple mac os x (<= 10.10.4)
• apple iphone os (<= 8.4)
• apple numbers (<= 3.5)
• apple keynote (<= 6.5)
• apple pages (<= 5.5.3)
• apple iwork (<= 2.5.4)
Related
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html Vendor Advisory
- http://lists.apple.com/archives/security-announce/2015/Aug/msg00002.html Vendor Advisory
- http://lists.apple.com/archives/security-announce/2015/Oct/msg00000.html Vendor Advisory
- http://www.securityfocus.com/bid/76343 www.securityfocus.com
- http://www.securitytracker.com/id/1033275 www.securitytracker.com
- https://support.apple.com/HT205373 Vendor Advisory
- https://support.apple.com/kb/HT205030 Vendor Advisory
- https://support.apple.com/kb/HT205031 Vendor Advisory
- http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html Vendor Advisory
- http://lists.apple.com/archives/security-announce/2015/Aug/msg00002.html Vendor Advisory
- http://lists.apple.com/archives/security-announce/2015/Oct/msg00000.html Vendor Advisory
- http://www.securityfocus.com/bid/76343 www.securityfocus.com
- http://www.securitytracker.com/id/1033275 www.securitytracker.com
- https://support.apple.com/HT205373 Vendor Advisory
- https://support.apple.com/kb/HT205030 Vendor Advisory
- https://support.apple.com/kb/HT205031 Vendor Advisory