CVE-2017-2391

MEDIUM

Pages, Numbers, Keynote < 6.1/4.1/7.1 (macOS) & < 3.1 (iOS) - Weak Export Encryption

Title source: llm
STIX 2.1

Description

An issue was discovered in certain Apple products. Pages before 6.1, Numbers before 4.1, and Keynote before 7.1 on macOS and Pages before 3.1, Numbers before 3.1, and Keynote before 3.1 on iOS are affected. The issue involves the "Export" component. It allows users to bypass iWork PDF password protection by leveraging use of 40-bit RC4.

References (5)

Core 5
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1038135
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1038134
Vendor Advisory x_refsource_confirm
https://support.apple.com/HT207595
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1038136
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/97126

Scores

CVSS v3 5.3
EPSS 0.0096
EPSS Percentile 56.8%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Details

CWE
CWE-326
Status published
Products (6)
apple/keynote < 3.0.5
apple/keynote < 7.0.5
apple/numbers < 3.0.5
apple/numbers < 4.0.5
apple/pages < 3.0.5
apple/pages < 6.0.5
Published Apr 02, 2017
Tracked Since Feb 18, 2026