CVE-2017-2392 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Apple Safari

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer6 documents6 sources
Severity
7.8HIGHNVD
EPSS
0.3%
top 44.45%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Debian Webkit2gtkApple Safari
Timeline
PublishedApr 2
Latest updateMay 17

Description

An issue was discovered in certain Apple products. Safari before 10.1 is affected. The issue involves the "WebKit" component. It allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted app.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages3 packages

▶NVDapple/safari10.0.3
▶Appleapple/safari10.1
▶debiandebian/webkit2gtk< webkit2gtk 2.14.6-1 (bookworm)

🔴Vulnerability Details

2
GHSA
GHSA-hh9g-3rwm-66hx: An issue was discovered in certain Apple products↗2022-05-17
▶
OSV
CVE-2017-2392: An issue was discovered in certain Apple products↗2017-04-02
▶

📋Vendor Advisories

3
Ubuntu
WebKitGTK+ vulnerabilities↗2017-04-10
▶
Apple
CVE-2017-2392: Safari 10.1↗2017-03-27
▶
Debian
CVE-2017-2392: webkit2gtk - An issue was discovered in certain Apple products. Safari before 10.1 is affecte...↗2017
▶