High severity · published Feb 20, 2017
CVE-2017-2374
An issue was discovered in certain Apple products
7.8
CVSS
1.5%
EPSS
No
On KEV
Description
An issue was discovered in certain Apple products. GarageBand before 10.1.6 is affected. The issue involves the "Projects" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted GarageBand project file.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GA
Garageband · Apple
through 10.1.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-2374
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-2374
www.securityfocus.com
http://www.securityfocus.com/bid/96171
www.securitytracker.com
http://www.securitytracker.com/id/1037868
www.talosintelligence.com
http://www.talosintelligence.com/reports/TALOS-2017-0275/
Vendor Advisory
https://support.apple.com/HT207518
More from Garageband
8.8
CVE-2017-2372
An issue was discovered in certain Apple products
7.8
CVE-2024-44142
The issue was addressed with improved bounds checks
7.8
CVE-2023-42867
This issue was addressed with improved validation of the process entitlement and Team ID
7.8
CVE-2024-23300
A use-after-free issue was addressed with improved memory management
7.8
CVE-2022-22664
An out-of-bounds read was addressed with improved bounds checking