CVE-2017-2404

An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves the "Quick Look" component. It allows remote attackers to trigger telephone calls to arbitrary numbers via a tel: URL in a PDF document, as exploited in the wild in October 2016.
Open Redirect
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
3.3 LOW
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 67%
Affected Products (NVD)
VendorProductVersion
appleiphone_os
𝑥
≤ 10.2.1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://www.securityfocus.com/bid/97138
http://www.securitytracker.com/id/1038139
https://support.apple.com/HT207617
https://www.engadget.com/2017/03/31/apple-fixes-ios-loophole-911-overload/
http://www.securityfocus.com/bid/97138
http://www.securitytracker.com/id/1038139
https://support.apple.com/HT207617
https://www.engadget.com/2017/03/31/apple-fixes-ios-loophole-911-overload/