PT-2016-1570

CVE-2016-1734

Published

2016-03-24

Updated

2016-12-03

Description by

CVSS 2.0

7.2

High

MetricsAV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apple iOS versions prior to 9.3 OS X versions prior to 10.11.4

Description The issue is caused by a buffer overflow in the AppleUSBNetworking component, allowing physically proximate attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted USB device.

Recommendations For Apple iOS versions prior to 9.3, update to version 9.3 or later. For OS X versions prior to 10.11.4, update to version 10.11.4 or later.

Exploitability

Fix

Impacts

Researchers

Andrea Barisani

Andrej Rosano

Vendors

Affected products

Weakness enumeration

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE-264

Related identifiers