CVE-2017-14315

In Apple iOS 7 through 9, due to a BlueBorne flaw in the implementation of LEAP (Low Energy Audio Protocol), a large audio command can be sent to a targeted device and lead to a heap overflow with attacker-controlled data. Since the audio commands sent via LEAP are not properly validated, an attacker can use this overflow to gain full control of the device through the relatively high privileges of the Bluetooth stack in iOS. The attack bypasses Bluetooth access control; however, the default "Bluetooth On" value must be present in Settings.

• CWE-119

• http://seclists.org/fulldisclosure/2019/May/24
• http://www.securityfocus.com/bid/100816Third Party Advisory, VDB Entry
• https://seclists.org/bugtraq/2019/May/30
• https://support.apple.com/kb/HT210121
• https://www.armis.com/blueborneTechnical Description, Third Party Advisory
• http://seclists.org/fulldisclosure/2019/May/24
• http://www.securityfocus.com/bid/100816Third Party Advisory, VDB Entry
• https://seclists.org/bugtraq/2019/May/30
• https://support.apple.com/kb/HT210121
• https://www.armis.com/blueborneTechnical Description, Third Party Advisory

Published

Sep 12, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-1431IBM InfoSphere Streams 4.0, 4.1, and 4.2 is vulnerable to cr…
• CVE-2017-14310STDU Viewer 1.6.375 allows attackers to cause a denial of se…
• CVE-2017-14311The Winring0x32.sys driver in NetMechanica NetDecision 5.8.2…
• CVE-2017-14312Nagios Core through 4.3.4 initially executes /usr/sbin/nagio…
• CVE-2017-14313The shibboleth_login_form function in shibboleth.php in the …
• CVE-2017-14314Off-by-one error in the DrawImage function in magick/render.…
• CVE-2017-14316A parameter verification issue was discovered in Xen through…
• CVE-2017-14317A domain cleanup issue was discovered in the C xenstore daem…
• CVE-2017-14318An issue was discovered in Xen 4.5.x through 4.9.x. The func…
• CVE-2017-14319A grant unmapping issue was discovered in Xen through 4.9.x.…
• CVE-2017-14320Mirasvit Helpdesk MX before 1.5.3 might allow remote attacke…
• CVE-2017-14321Multiple cross-site scripting (XSS) vulnerabilities in the a…