Memory corruption in Apple Safari - CVE-2017-13866

Vulnerability identifier: #VU9670

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-13866

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error when handling malicious input. A remote attacker can trick the victim into loading a specially crafted web content, trigger memory corruption in the WebKit component and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability may result in system compromise.

Apple Safari
Gentoo Linux
Ubuntu
Fedora
webkit2gtk (Alpine package)
webkitgtk4
iCloud for Windows
iTunes

Update to version 11.0.2.

webkit2gtk (Alpine package) - update to 2.18.4-r0
webkitgtk4 - addressed in versions 2.18.4-1.fc26, 2.18.4-1.fc27

• https://support.apple.com/en-us/HT208324

• Remote code execution in Apple Safari
• Multiple vulnerabilities in Apple iCloud
• Multiple vulnerabilities in Apple iTunes
• Ubuntu update for WebKitGTK+
• Gentoo update for WebkitGTK+
• Memory corruption in webkit2gtk (Alpine package)
• Fedora 27 update for webkitgtk4
• Fedora 26 update for webkitgtk4