CVE-2017-14315 Details
Description
In Apple iOS 7 through 9, due to a BlueBorne flaw in the implementation of LEAP (Low Energy Audio Protocol), a large audio command can be sent to a targeted device and lead to a heap overflow with attacker-controlled data. Since the audio commands sent via LEAP are not properly validated, an attacker can use this overflow to gain full control of the device through the relatively high privileges of the Bluetooth stack in iOS. The attack bypasses Bluetooth access control; however, the default "Bluetooth On" value must be present in Settings.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://seclists.org/fulldisclosure/2019/May/24 | CVE | |
| https://seclists.org/bugtraq/2019/May/30 | CVE | |
| https://support.apple.com/kb/HT210121 | CVE | |
| https://www.armis.com/blueborne | CVE | Technical DescriptionThird Party Advisory |
| http://www.securityfocus.com/bid/100816 | CVE | Third Party AdvisoryVDB Entry |
| http://seclists.org/fulldisclosure/2019/May/24 | [email protected] | |
| https://seclists.org/bugtraq/2019/May/30 | [email protected] | |
| https://support.apple.com/kb/HT210121 | [email protected] | |
| https://www.armis.com/blueborne | [email protected] | Technical DescriptionThird Party Advisory |
| http://www.securityfocus.com/bid/100816 | [email protected] | Third Party AdvisoryVDB Entry |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-119 | Improper Restriction of Operations within the Bounds of a Memory Buffer | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| apple iphone os | 7.0 7.0.1 7.0.2 7.0.3 7.0.4 7.0.5 7.0.6 7.1 7.1.1 7.1.2 8.0 8.0.1 8.0.2 8.1 8.1.2 8.1.3 8.2 8.4.1 9.0 9.0.1 9.0.2 9.1 9.2 9.2.1 9.3 9.3.1 9.3.2 9.3.3 9.3.4 9.3.5 |
CPE
Remediation
| |
Change History
9 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| May 13, 2026 | CVE Status Change | [email protected] |
| Nov 21, 2024 | CVE Modified | CVE |
| May 14, 2024 | CVE Modified | [email protected] |
| May 14, 2019 | CVE Modified | [email protected] |
| May 14, 2019 | CVE Modified | [email protected] |
| May 13, 2019 | CVE Modified | [email protected] |
| Sep 21, 2017 | Initial Analysis | [email protected] |
| Sep 16, 2017 | CVE Modified | [email protected] |