WebKit CVE-2017-7071 Use-After-Free Remote Code Execution Vulnerability
BID:100613
CVE-2017-7071 |Info
WebKit CVE-2017-7071 Use-After-Free Remote Code Execution Vulnerability
| Bugtraq ID: | 100613 |
| Class: | Failure to Handle Exceptional Conditions |
| CVE: |
CVE-2017-7071 |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 23 2017 12:00AM |
| Updated: | Aug 23 2017 12:00AM |
| Credit: | Kai Kang(a.k.a 4B5F5F4B) of Tencent's Xuanwu LAB |
| Vulnerable: |
WebKit Open Source Project WebKit 0 Apple Safari 10.0.1 Apple Safari 9.1.3 Apple Safari 9.1.2 Apple Safari 9.1.1 Apple Safari 9.0.3 Apple Safari 9.0.2 Apple Safari 9.0.1 Apple Safari 8.0.8 Apple Safari 8.0.6 Apple Safari 8.0.5 Apple Safari 8.0.4 Apple Safari 8.0.1 Apple Safari 7.1.8 Apple Safari 7.1.6 Apple Safari 7.1.5 Apple Safari 7.1.4 Apple Safari 7.1.1 Apple Safari 7.1 Apple Safari 7.0.6 Apple Safari 7.0.3 Apple Safari 7.0.1 Apple Safari 6.2.8 Apple Safari 6.2.6 Apple Safari 6.2.5 Apple Safari 6.2.4 Apple Safari 6.2.1 Apple Safari 6.1.6 Apple Safari 6.1.3 Apple Safari 6.1.1 Apple Safari 6.0.5 Apple Safari 6.0.4 Apple Safari 6.0.3 Apple Safari 6.0.2 Apple Safari 6.0.1 Apple Safari 5.1.10 Apple Safari 5.1.6 Apple Safari 5.1.5 Apple Safari 5.0.6 Apple Safari 4.0.5 Apple Safari 4.0.4 Apple Safari 4.0.3 Apple Safari 4.0.2 Apple Safari 4.0.1 Apple Safari 3.2.3 Apple Safari 3.1.2 Apple Safari 3.1.1 Apple Safari 2.0.4 Apple Safari 2.0.3 Apple Safari 2.0.2 Apple Safari 2.0.1 Apple Safari 1.3.2 Apple Safari 1.3.1 Apple Safari 1.3 Apple Safari 1.2.3 Apple Safari 1.2.2 Apple Safari 1.2.1 Apple Safari 1.2 Apple Safari 1.1 Apple Safari 1.0 Apple Safari 9.1 Apple Safari 9 Apple Safari 8.0.7 Apple Safari 8.0.3 Apple Safari 8.0.2 Apple Safari 8.0 Apple Safari 7.1.7 Apple Safari 7.1.3 Apple Safari 7.1.2 Apple Safari 7.1 Apple Safari 7.0.5 Apple Safari 7.0.4 Apple Safari 7.0.2 Apple Safari 6.2.7 Apple Safari 6.2.3 Apple Safari 6.2.2 Apple Safari 6.2 Apple Safari 6.1.5 Apple Safari 6.1.4 Apple Safari 6.1.2 Apple Safari 6.1 Apple Safari 6.0 Apple Safari 5.34 Apple Safari 5.33 Apple Safari 5.31 Apple Safari 5.1.7 Apple Safari 5.1.4 Apple Safari 5.1.3 Apple Safari 5.1.2 Apple Safari 5.1.1 Apple Safari 5.1 Apple Safari 5.0.5 Apple Safari 5.0.4 Apple Safari 5.0.3 Apple Safari 5.0.2 Apple Safari 5.0.1 Apple Safari 5.0 Apple Safari 4.31 Apple Safari 4.30 Apple Safari 4.28 Apple Safari 4.1.3 Apple Safari 4.1.2 Apple Safari 4.1.1 Apple Safari 4.1 Apple Safari 4.0 Apple Safari 4 Apple Safari 3.52 Apple Safari 3.2 Apple Safari 3.1 Apple Safari 3 Apple Safari 10.0.3 Apple Safari 10.0.2 Apple Safari 10 |
| Not Vulnerable: |
Apple Safari 10.1 |
Discussion
WebKit CVE-2017-7071 Use-After-Free Remote Code Execution Vulnerability
WebKit is prone to a remote code-execution vulnerability.
An attacker can exploit this issue to execute arbitrary code in the context of the user running the affected application. Failed exploit attempts will result in a denial-of-service condition.
WebKit is prone to a remote code-execution vulnerability.
An attacker can exploit this issue to execute arbitrary code in the context of the user running the affected application. Failed exploit attempts will result in a denial-of-service condition.
References
WebKit CVE-2017-7071 Use-After-Free Remote Code Execution Vulnerability
References:
References:
- Safari Homepage (Apple)
- Webkit Homepage (WebKit)
- About the security content of Safari 10.1 (Apple)
- ZDI-17-714: Apple Safari HTMLSlotElement Use-After-Free Remote Code Execution Vu (TippingPoint Zero Day Initiative)