CVE-2015-7018

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-6976, CVE-2015-6977, CVE-2015-6978, CVE-2015-6990, CVE-2015-6991, CVE-2015-6993, CVE-2015-7008, CVE-2015-7009, and CVE-2015-7010.

Metrics

CVSS 2.0 6.8/10AV:N/AC:M/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.apple.com/archives/security-announce/2015/Oct/msg00002.htmlVendor Advisory
http://lists.apple.com/archives/security-announce/2015/Oct/msg00005.htmlVendor Advisory
http://www.securityfocus.com/bid/77263
http://www.securitytracker.com/id/1033931
https://support.apple.com/HT205370Vendor Advisory
https://support.apple.com/HT205375Vendor Advisory
http://lists.apple.com/archives/security-announce/2015/Oct/msg00002.htmlVendor Advisory
http://lists.apple.com/archives/security-announce/2015/Oct/msg00005.htmlVendor Advisory
http://www.securityfocus.com/bid/77263
http://www.securitytracker.com/id/1033931
https://support.apple.com/HT205370Vendor Advisory
https://support.apple.com/HT205375Vendor Advisory

Timeline

Published: Oct 23, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-70195.6The NVIDIA driver in the Graphics Drivers subsystem in Apple OS X before 10.11.1 allows local users to obtain sensitive information from ker CVE-2015-70205.6The NVIDIA driver in the Graphics Drivers subsystem in Apple OS X before 10.11.1 allows local users to obtain sensitive information from ker CVE-2015-70217.2The Graphics Drivers subsystem in Apple OS X before 10.11.1 allows local users to gain privileges or cause a denial of service (kernel memor CVE-2015-70224.3The Telephony subsystem in Apple iOS before 9.1 allows attackers to obtain sensitive call-status information via a crafted app.CVE-2015-70235.8CFNetwork in Apple iOS before 9.1 and OS X before 10.11.1 does not properly consider the uppercase-versus-lowercase distinction during cooki CVE-2015-70246.7Untrusted search path vulnerability in Apple OS X before 10.11.1 allows local users to bypass intended Gatekeeper restrictions and gain priv CVE-2015-70299.8Apple AirPort Base Station Firmware before 7.6.7 and 7.7.x before 7.7.7 misparses DNS data, which allows remote attackers to execute arbitra CVE-2015-70307.5The Swift implementation in Apple Xcode before 7.1 mishandles type conversion, which has unspecified impact and attack vectors.CVE-2015-70315.0The Web Service component in Apple OS X Server before 5.0.15 omits an unspecified HTTP header configuration, which allows remote attackers t CVE-2015-70324.3The Apple iWork application before 2.6 for iOS, Apple Keynote before 6.6, Apple Pages before 5.6, and Apple Numbers before 3.6 allow remote CVE-2015-70336.8The Apple iWork application before 2.6 for iOS, Apple Keynote before 6.6, Apple Pages before 5.6, and Apple Numbers before 3.6 allow remote CVE-2015-70346.8The Apple iWork application before 2.6 for iOS and Apple Pages before 5.6 allow remote attackers to execute arbitrary code or cause a denial