Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.0

iOS versions before 8 XML parser can expose any file

CVE-2014-4374 · published 12 years ago
Summary

The NSXMLParser component in iOS versions prior to 8 can be tricked by specially crafted XML to read files stored on the device. This could allow someone who supplies malicious XML to view confidential data. Upgrade devices to iOS 8 or later, or stop processing untrusted XML, to eliminate the risk.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
apple mac_os_x <= 10.9.4
cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
apple iphone_os <= 7.1.2
7.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.1
7.1.1
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
Original advisory text
NSXMLParser in Foundation in Apple iOS before 8 allows attackers to read arbitrary files via XML data containing an external entity declaration in conjunction with an entity reference, related to a...
NSXMLParser in Foundation in Apple iOS before 8 allows attackers to read arbitrary files via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.0 Medium
Exploitation
2% chance of attack within 30 days
Timeline
Published18 Sep 2014
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2014-4374 · NVD
Track software like this
Free during beta