CVE-2015-1157

Severity

78%

Complexity

99%

Confidentiality

115%

CoreText in Apple iOS 8.x through 8.3 allows remote attackers to cause a denial of service (reboot and messaging disruption) via crafted Unicode text that is not properly handled during display truncation in the Notifications feature, as demonstrated by Arabic characters in (1) an SMS message or (2) a WhatsApp message.

CoreText in Apple iOS 8.x through 8.3 allows remote attackers to cause a denial of service (reboot and messaging disruption) via crafted Unicode text that is not properly handled during display truncation in the Notifications feature, as demonstrated by Arabic characters in (1) an SMS message or (2) a WhatsApp message.

CVSS 2.0 Base Score 7.8. CVSS Attack Vector: network. CVSS Attack Complexity: low. CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:C).

Overview

Type

Apple

First reported 9 years ago

2015-05-28 01:59:00

Last updated 8 years ago

2016-11-28 19:17:00

Affected Software

Apple iPhone OS 8.0

8.0

Apple iPhone OS 8.0.1

8.0.1

Apple iPhone OS 8.0.2

8.0.2

Apple iPhone OS 8.1

8.1

Apple iPhone OS 8.1.2

8.1.2

Apple iPhone OS 8.1.3

8.1.3

Apple iPhone OS 8.2

8.2

Apple iPhone OS 8.3

8.3

Apple Mac OS X

Apple iTunes

References

http://9to5mac.com/2015/05/27/how-to-fix-ios-text-message-bug-crash-reboot/

APPLE-SA-2015-06-30-1

Vendor Advisory

APPLE-SA-2015-06-30-2

Patch, Vendor Advisory

APPLE-SA-2015-09-16-3

Patch, Vendor Advisory

http://support.apple.com/kb/HT204941

Vendor Advisory

http://support.apple.com/kb/HT204942

Vendor Advisory

http://www.ibtimes.co.uk/apple-ios-bug-sees-message-app-crash-iphone-reboot-simply-by-receiving-message-1503083

http://www.reddit.com/r/apple/comments/37e8c1/malicious_text_message/

Exploit

http://www.reddit.com/r/apple/comments/37enow/about_the_latest_iphone_security_vulnerability/

http://www.reddit.com/r/explainlikeimfive/comments/37edde/eli5_how_that_text_you_can_send_to_friends_turns/

Exploit

75491

1032408

http://zanzebek.com/a-simple-text-message-can-ruin-any-iphone/

Exploit

https://ghostbin.com/paste/zws9m

https://support.apple.com/HT205221

Vendor Advisory

Stay updated

ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.

Get in touch

If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.