PT-2017-17543

CVE-2017-7148

Published

2017-10-23

Updated

2017-10-26

Description by

CVSS 2.0

4.3

Medium

MetricsAV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions iOS versions prior to 11

Description An issue in certain Apple products involves the Location Framework component, allowing attackers to obtain sensitive location information via a crafted app that reads the location variable.

Recommendations For iOS versions prior to 11, update to a version 11 or later to resolve the issue. As a temporary workaround, consider restricting access to location services for untrusted apps until a patch is available.

Exploitability

Fix

Impacts

Researchers

Igor Makarov

Shawnna Rodriguez

Will Mcginty

Vendors

Affected products

Weakness enumeration

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Related identifiers