CVE-2017-7061

published 2017-07-20

CVE-2017-7061: An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCloud before 6.2.2 on Windows is affected…

Priority P2 63 high 8.8 CVSS 3.0

AV N AC L PR N UI R S U C H I H A H

EXPLOIT

An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCloud before 6.2.2 on Windows is affected. iTunes before 12.6.2 on Windows is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.

Affected

11 ranges

Vendor	Product	Version range	Fixed in
apple	icloud	< 6.2.2	6.2.2
apple	icloud_for_windows	—	—
apple	ios	—	—
apple	iphone_os	< 10.3.3	10.3.3
apple	itunes	< 12.6.2	12.6.2
apple	itunes_12.6.2_for_windows	—	—
apple	safari	< 10.1.2	10.1.2
apple	safari	—	—
apple	tvos	< 10.2.2	10.2.2
apple	tvos	—	—
debian	webkit2gtk	< webkit2gtk 2.16.6-1 (bookworm)	webkit2gtk 2.16.6-1 (bookworm)

Detection & IOCs extracted from sources · hover to see the quote

command let o = {}; for (let i in {xx: 0}) { for (let j = 0; j < 2; j++) { o[i]; i = new Uint32Array([0, 1, 0x777777, 0, 0]); } }↗

• → Look for JavaScript triggering the WebKit JSC BytecodeGenerator::emitGetByVal incorrect optimization: a for-in loop over an object with a string key, containing a nested loop that re-assigns the loop variable to a typed array (e.g., Uint32Array) after an indexed property access — this is the PoC pattern for the type confusion. ↗
• → The vulnerability is triggered when op_get_direct_pname (a fast-path opcode intended only for string indexes) is incorrectly emitted for a for-in loop variable that is subsequently reassigned to a non-string type inside a nested loop, causing a type confusion in WebKit JSC bytecode generation. ↗
• → The type confusion arises specifically when a for-in loop variable is invalidated inside a nested loop: the ForInContext isValid() check is bypassed because invalidation only fires on direct reassignment outside the nested loop scope, allowing op_get_direct_pname to be used when the index is no longer a string. ↗
• → Delivery vector is a crafted web page; detections should cover malicious web content delivered to WebKit-based browsers (Safari, iOS WebView, tvOS, iCloud/iTunes on Windows) that contains the for-in / nested-loop / Uint32Array reassignment pattern. ↗

• · The PoC magic constant 0x777777 inside the Uint32Array initializer is specific to the published proof-of-concept and may not appear in weaponized exploits; real-world payloads will likely vary the array contents. ↗
• · Affected products span multiple platforms (iOS <10.3.3, Safari <10.1.2, iCloud for Windows <6.2.2, iTunes for Windows <12.6.2, tvOS <10.2.2); detection rules should not be scoped to a single platform. ↗

CVSS provenance

nvd v3.0 8.8 HIGH CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

nvd v2.0 6.8 MEDIUM AV:N/AC:M/Au:N/C:P/I:P/A:P

osv 8.8 HIGH

vendor_debian 8.8 LOW

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-119