CVE-2014-4404

high-risk
Published 2014-09-18

Heap-based buffer overflow in IOHIDFamily in Apple iOS before 8 and Apple TV before 7 allows attackers to execute arbitrary code in a privileged context via an application that provides crafted key-mapping properties.

Do I need to act?

!
62.0% chance of exploitation in next 30 days
EPSS score — higher than 38% of all CVEs
!
CISA KEV: actively exploited in the wild
On the Known Exploited Vulnerabilities catalog — federal agencies must patch
!
1 public exploit available
35440
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.8/10 High
LOCAL / LOW complexity

Affected Products (3)

Affected Vendors

Apple

References (25)

Broken Link http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.html
Broken Link http://archives.neohapsis.com/archives/bugtraq/2014-09/0107.html
Broken Link http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html
Mailing List http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html
Vendor Advisory http://support.apple.com/kb/HT6441
Vendor Advisory http://support.apple.com/kb/HT6442
Broken Link http://www.securityfocus.com/bid/69882
Broken Link http://www.securityfocus.com/bid/69947
Broken Link http://www.securitytracker.com/id/1030866
Third Party Advisory https://exchange.xforce.ibmcloud.com/vulnerabilities/96111
Vendor Advisory https://support.apple.com/HT204659
Vendor Advisory https://support.apple.com/kb/HT6535
Broken Link http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.html
Broken Link http://archives.neohapsis.com/archives/bugtraq/2014-09/0107.html
Broken Link http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html
Mailing List http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html
Vendor Advisory http://support.apple.com/kb/HT6441
Vendor Advisory http://support.apple.com/kb/HT6442
Broken Link http://www.securityfocus.com/bid/69882
Broken Link http://www.securityfocus.com/bid/69947
and 5 more references
66
/ 100
high-risk
Severity 24/34 · High
Exploitability 33/34 · Critical
Exposure 9/34 · Low