Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2017-2491 — Use After Free in Apple Iphone OS

CWE-416 — Use After Free6 documents4 sources
Severity
8.8HIGHNVD
EPSS
21.7%
top 4.25%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
4
Apple Iphone OSApple IOSApple Safari+1 more
Timeline
PublishedJun 27
Latest updateMay 13

Description

Use after free vulnerability in the String.replace method JavaScriptCore in Apple Safari in iOS before 10.3 allows remote attackers to execute arbitrary code via a crafted web page, or a crafted file.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages4 packages

▶Appleapple/safari10.1
▶NVDapple/iphone_os10.2.1
▶Appleapple/ios10.3
▶Appleapple/tvos10.2

🔴Vulnerability Details

1
GHSA
GHSA-v5gq-732w-q78g: Use after free vulnerability in the String↗2022-05-13
▶

💥Exploits & PoCs

1
Exploit-DB
Apple Safari 10.0.3 - 'JSC::CachedCall' Use-After-Free↗2017-05-04
▶

📋Vendor Advisories

3
Apple
CVE-2017-2491: Safari 10.1↗2017-03-27
▶
Apple
CVE-2017-2491: iOS 10.3↗2017-03-27
▶
Apple
CVE-2017-2491: tvOS 10.2↗2017-03-27
▶