CVE-2017-5949 — Out-of-bounds Write in Apple Safari

CWE-787 — Out-of-bounds Write3 documents3 sources
Severity
9.8CRITICALNVD
EPSS
1.8%
top 17.11%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Apple Safari
Timeline
PublishedApr 3
Latest updateMay 17

Description

JavaScriptCore in WebKit, as distributed in Safari Technology Preview Release 22, allows remote attackers to cause a denial of service (heap-based out-of-bounds write and application crash) or possibly have unspecified other impact via crafted JavaScript code that triggers access to red-zone memory locations, related to jit/ThunkGenerators.cpp, llint/LowLevelInterpreter32_64.asm, and llint/LowLevelInterpreter64.asm.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages1 packages

▶NVDapple/safari22

🔴Vulnerability Details

2
GHSA
GHSA-4c7j-5rpp-4x8h: JavaScriptCore in WebKit, as distributed in Safari Technology Preview Release 22, allows remote attackers to cause a denial of service (heap-based out↗2022-05-17
▶
OSV
CVE-2017-5949: JavaScriptCore in WebKit, as distributed in Safari Technology Preview Release 22, allows remote attackers to cause a denial of service (heap-based out↗2017-04-03
▶
CVE-2017-5949 — Out-of-bounds Write in Apple Safari | cvebase