CVE-2017-2404

EUVD-2017-11587
An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves the "Quick Look" component. It allows remote attackers to trigger telephone calls to arbitrary numbers via a tel: URL in a PDF document, as exploited in the wild in October 2016.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 77%
Affected Products (NVD)
VendorProductVersion
appleiphone_os
𝑥
≤ 10.2.1
𝑥
= Vulnerable software versions
References
http://www.securityfocus.com/bid/97138
http://www.securitytracker.com/id/1038139
https://support.apple.com/HT207617
https://www.engadget.com/2017/03/31/apple-fixes-ios-loophole-911-overload/
http://www.securityfocus.com/bid/97138
http://www.securitytracker.com/id/1038139
https://support.apple.com/HT207617
https://www.engadget.com/2017/03/31/apple-fixes-ios-loophole-911-overload/