CVE-2017-2391

MEDIUM

Apple Products - Info Disclosure

Title source: llm

Description

An issue was discovered in certain Apple products. Pages before 6.1, Numbers before 4.1, and Keynote before 7.1 on macOS and Pages before 3.1, Numbers before 3.1, and Keynote before 3.1 on iOS are affected. The issue involves the "Export" component. It allows users to bypass iWork PDF password protection by leveraging use of 40-bit RC4.

References (5)

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/97126

[Vendor Advisory] https://support.apple.com/HT207595

[Third Party Advisory, VDB Entry] http://www.securitytracker.com/id/1038134

[Third Party Advisory, VDB Entry] http://www.securitytracker.com/id/1038135

[Third Party Advisory, VDB Entry] http://www.securitytracker.com/id/1038136

Scores

CVSS v3 5.3

EPSS 0.0012

EPSS Percentile 30.2%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Classification

CWE

CWE-326

Status published

Affected Products (7)

apple/keynote < 7.0.5

apple/numbers < 4.0.5

apple/pages < 6.0.5

apple/keynote < 3.0.5

apple/numbers < 3.0.5

apple/pages < 3.0.5

n/a/n/a

Timeline

Published Apr 02, 2017

Tracked Since Feb 18, 2026