NVD Vulnerability Detail

CVE-2017-2372

Summary	An issue was discovered in certain Apple products. GarageBand before 10.1.5 is affected. Logic Pro X before 10.3 is affected. The issue involves the "Projects" component, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted GarageBand project file.
Publication Date	Feb. 20, 2017, 5:59 p.m.
Registration Date	Jan. 26, 2021, 1:22 p.m.
Last Update	Nov. 21, 2024, 12:23 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:apple:logic_pro_x::::::::			10.2.4

Configuration2		or higher	or less	more than	less than
cpe:2.3:a:apple:garageband::::::::			10.1.4

Related information, measures and tools

No	URL	タグ
1	http://www.securityfocus.com/bid/95627	Third Party Advisory VDB Entry
2	http://www.securityfocus.com/bid/95627	Third Party Advisory VDB Entry
3	http://www.securitytracker.com/id/1037627
4	http://www.securitytracker.com/id/1037627
5	http://www.talosintelligence.com/reports/TALOS-2016-0262/
6	http://www.talosintelligence.com/reports/TALOS-2016-0262/
7	https://support.apple.com/HT207476	Vendor Advisory
8	https://support.apple.com/HT207476	Vendor Advisory
9	https://support.apple.com/HT207477	Vendor Advisory
10	https://support.apple.com/HT207477	Vendor Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-119	バッファエラー	https://cwe.mitre.org/data/definitions/118.html

JVN Vulnerability Information

Apple GarageBand および Logic Pro X の脆弱性に対するアップデート

Title	Apple GarageBand および Logic Pro X の脆弱性に対するアップデート
Summary	Apple から GarageBand および Logic Pro X 向けのアップデートが公開されました。
Possible impacts	細工された GarageBand プロジェクトファイルを開くことで、任意のコードが実行される可能性があります。
Solution	[アップデートする] Apple が提供する情報をもとに最新版へアップデートしてください。
Publication Date	Jan. 19, 2017, midnight
Registration Date	Jan. 23, 2017, 4:35 p.m.
Last Update	Jan. 23, 2017, 4:35 p.m.

Affected System

アップル

GarageBand 10.1.5 より前のバージョン

Logic Pro X 10.3 より前のバージョン

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2017-2372	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2372
National Vulnerability Database (NVD)
2	CVE-2017-2372	https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-2372

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-119	https://jvndb.jvn.jp/ja/cwe/CWE-119.html

ベンダー情報

No	Name	URL
Apple Security Updates
1	HT207476 (About the security content of Logic Pro X 10.3)	https://support.apple.com/en-us/HT207476
2	HT207477 (About the security content of GarageBand 10.1.5)	https://support.apple.com/en-us/HT207477
Apple セキュリティアップデート
3	HT207476	https://support.apple.com/ja-jp/HT207476
4	HT207477	https://support.apple.com/ja-jp/HT207477

その他

No	Name	URL
JVN
1	JVNVU#90290095	http://jvn.jp/cert/JVNVU90290095

Change Log

No	Changed Details	Date of change
0	[2017年01月23日] 掲載 [2017年03月06日] CVSS による深刻度：内容を更新 CWE による脆弱性タイプ一覧：CWE-ID を追加参考情報：National Vulnerability Database (NVD) (CVE-2017-2372) を追加	Feb. 17, 2018, 10:37 a.m.