製品・ソフトウェアに関する情報

JVN脆弱性詳細

複数の Apple 製品の FontParser コンポーネントにおける任意のコードを実行される脆弱性

Title	複数の Apple 製品の FontParser コンポーネントにおける任意のコードを実行される脆弱性
Summary	複数の Apple 製品の FontParser コンポーネントには、任意のコードを実行される、またはサービス運用妨害 (バッファオーバーフローおよびアプリケーションクラッシュ) 状態にされる脆弱性が存在します。
Possible impacts	リモートの攻撃者により、巧妙に細工されたフォントを介して、任意のコードを実行される、またはサービス運用妨害 (バッファオーバーフローおよびアプリケーションクラッシュ) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Oct. 24, 2016, midnight
Registration Date	March 1, 2017, 2:42 p.m.
Last Update	March 1, 2017, 2:42 p.m.

Affected System

アップル

Apple Mac OS X 10.12

iOS 10.1 未満 (iPad 第 4 世代以降)

iOS 10.1 未満 (iPhone 5 以降)

iOS 10.1 未満 (iPod touch 第 6 世代以降)

tvOS 10.0.1 未満 (Apple TV 第 4 世代)

watchOS 3.1 未満 (Apple Watch の全モデル) (HT207269)

watchOS 3.1.3 未満 (Apple Watch の全モデル) (HT207487)

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2016-4688	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4688
National Vulnerability Database (NVD)
2	CVE-2016-4688	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4688

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-119	https://jvndb.jvn.jp/ja/cwe/CWE-119.html

ベンダー情報

No	Name	URL
Apple
1	Apple security updates	https://support.apple.com/en-us/HT201222
Apple Mailing Lists
2	APPLE-SA-2016-10-24-1 iOS 10.1	https://lists.apple.com/archives/security-announce/2016/Oct/msg00000.html
3	APPLE-SA-2016-10-24-2 macOS Sierra 10.12.1	https://lists.apple.com/archives/security-announce/2016/Oct/msg00001.html
4	APPLE-SA-2016-10-24-4 tvOS 10.0.1	https://lists.apple.com/archives/security-announce/2016/Oct/msg00003.html
5	APPLE-SA-2016-10-24-5 watchOS 3.1	https://lists.apple.com/archives/security-announce/2016/Oct/msg00004.html
6	APPLE-SA-2017-01-23-3 watchOS 3.1.3	https://lists.apple.com/archives/security-announce/2017/Jan/msg00004.html
Apple Security Updates
7	HT207269	https://support.apple.com/en-us/HT207269
8	HT207270	https://support.apple.com/en-us/HT207270
9	HT207271	https://support.apple.com/en-us/HT207271
10	HT207275	https://support.apple.com/en-us/HT207275
11	HT207487	https://support.apple.com/en-us/HT207487
Apple セキュリティアップデート
12	HT207269	https://support.apple.com/ja-jp/HT207269
13	HT207270	https://support.apple.com/ja-jp/HT207270
14	HT207271	https://support.apple.com/ja-jp/HT207271
15	HT207275	https://support.apple.com/ja-jp/HT207275
16	HT207487	https://support.apple.com/ja-jp/HT207487

その他

No	Name	URL
JVN
1	JVNVU#90743185	http://jvn.jp/vu/JVNVU90743185/index.html
2	JVNVU#97915630	http://jvn.jp/vu/JVNVU97915630/index.html

Change Log

No	Changed Details	Date of change
0	[2017年03月01日] 掲載	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2016-4688

Summary	An issue was discovered in certain Apple products. iOS before 10.1 is affected. macOS before 10.12.1 is affected. tvOS before 10.0.1 is affected. watchOS before 3.1 is affected. watchOS before 3.1.3 is affected. The issue involves the "FontParser" component. It allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a crafted font.
Publication Date	Feb. 20, 2017, 5:59 p.m.
Registration Date	Jan. 26, 2021, 2:12 p.m.
Last Update	Nov. 21, 2024, 11:52 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:o:apple:tvos::::::::					10.0.1

Configuration2		or higher	or less	more than	less than
cpe:2.3:o:apple:mac_os_x::::::::					10.12.1

Configuration3		or higher	or less	more than	less than
cpe:2.3:o:apple:tvos::::::::					10.0.1

Configuration4		or higher	or less	more than	less than
cpe:2.3:o:apple:watchos::::::::					3.1.3

Related information, measures and tools

No	URL	タグ
1	http://www.securityfocus.com/bid/94572	Third Party Advisory VDB Entry
2	http://www.securityfocus.com/bid/94572	Third Party Advisory VDB Entry
3	http://www.securitytracker.com/id/1037469	Third Party Advisory VDB Entry
4	http://www.securitytracker.com/id/1037469	Third Party Advisory VDB Entry
5	https://support.apple.com/HT207269	Vendor Advisory
6	https://support.apple.com/HT207269	Vendor Advisory
7	https://support.apple.com/HT207270	Vendor Advisory
8	https://support.apple.com/HT207270	Vendor Advisory
9	https://support.apple.com/HT207271	Vendor Advisory
10	https://support.apple.com/HT207271	Vendor Advisory
11	https://support.apple.com/HT207275	Vendor Advisory
12	https://support.apple.com/HT207275	Vendor Advisory
13	https://support.apple.com/HT207487	Vendor Advisory
14	https://support.apple.com/HT207487	Vendor Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-119	バッファエラー	https://cwe.mitre.org/data/definitions/118.html