Webkit Cross Site Scripting and Arbitrary Code Execution Vulnerabilities
BID:98473
Info
Webkit Cross Site Scripting and Arbitrary Code Execution Vulnerabilities
| Bugtraq ID: | 98473 |
| Class: | Input Validation Error |
| CVE: |
CVE-2017-2504 CVE-2017-2505 CVE-2017-2515 CVE-2017-2525 CVE-2017-2531 CVE-2017-6980 CVE-2017-2536 CVE-2017-2549 CVE-2017-2499 |
| Remote: | Yes |
| Local: | No |
| Published: | May 15 2017 12:00AM |
| Updated: | Jun 08 2017 09:02AM |
| Credit: | lokihardt of Google Project Zero, Kai Kang (4B5F5F4B) of Tencent’s Xuanwu Lab (tencent.com) working with Trend Micro’s Zero Day Initiative, Samuel Groß and Niklas Baumstark working with Trend Micro's Zero Day Initiative and George Dan (@t |
| Vulnerable: |
Gentoo Linux Apple tvOS 10.1.1 Apple tvOS 10.0.1 Apple tvOS 9.2.2 Apple tvOS 9.2.1 Apple tvOS 9.1.1 Apple tvOS 9.2 Apple tvOS 9.1 Apple tvOS 9.0 Apple tvOS 10.2 Apple tvOS 10.1 Apple tvOS 10 Apple Safari 10.0.1 Apple Safari 5.1.6 Apple Safari 5.1.5 Apple Safari 5.0.6 Apple Safari 4.0.4 Apple Safari 4.0.3 Apple Safari 4.0.2 Apple Safari 4.0.1 Apple Safari 3.2.3 Apple Safari 2.0.4 Apple Safari 2.0.3 Apple Safari 2.0.2 Apple Safari 2.0.1 Apple Safari 1.3.2 Apple Safari 1.3.1 Apple Safari 1.3 Apple Safari 1.2.3 Apple Safari 1.2.2 Apple Safari 1.2.1 Apple Safari 1.2 Apple Safari 1.1 Apple Safari 1.0 Apple Safari 5.1.7 Apple Safari 5.1.4 Apple Safari 5.1.3 Apple Safari 5.1.2 Apple Safari 5.1.1 Apple Safari 5.1 Apple Safari 5.0.5 Apple Safari 5.0.4 Apple Safari 5.0.3 Apple Safari 5.0.2 Apple Safari 5.0.1 Apple Safari 5.0 Apple Safari 4.1.3 Apple Safari 4.1.2 Apple Safari 4.1.1 Apple Safari 4.1 Apple Safari 4.0 Apple Safari 4 Apple Safari 3.2 Apple Safari 3.1 Apple Safari 3 Apple Safari 10.1 Apple Safari 10.0.3 Apple Safari 10.0.2 Apple Safari 10 Apple iOS 5 0 Apple iOS 4 0 Apple iOS 3 0 Apple iOS 10.2.1 Apple iOS 10.0.1 Apple iOS 9.3.4 Apple iOS 9.3.3 Apple iOS 9.3.2 Apple iOS 9.3.1 Apple iOS 9.2.1 Apple iOS 9.0.2 Apple iOS 9.0.1 Apple iOS 8.4.1 Apple iOS 7.2 Apple iOS 7.0.6 Apple iOS 7.0.5 Apple iOS 7.0.3 Apple iOS 7.0.2 Apple iOS 7.0.1 Apple iOS 6.3.1 Apple iOS 6.1.6 Apple iOS 6.1.4 Apple iOS 6.1.3 Apple iOS 4.2.1 Apple iOS 4.0.2 Apple iOS 4.0.1 Apple iOS 3.2.2 Apple iOS 3.2.1 Apple iOS 9.3.5 Apple iOS 9.3 Apple iOS 9.2 Apple iOS 9.1 Apple iOS 9 Apple iOS 8.4 Apple iOS 8.3 Apple iOS 8.2 Apple iOS 8.1.3 Apple iOS 8.1.2 Apple iOS 8.1.1 Apple iOS 8.1 Apple iOS 8 Apple iOS 7.1.2 Apple iOS 7.1.1 Apple iOS 7.1 Apple iOS 7.0.4 Apple iOS 7 Apple iOS 6.1 Apple iOS 6.0.2 Apple iOS 6.0.1 Apple iOS 6 Apple iOS 5.1.1 Apple iOS 5.1 Apple iOS 5.0.1 Apple iOS 5 Apple iOS 4.3.5 Apple iOS 4.3.4 Apple iOS 4.3.3 Apple iOS 4.3.2 Apple iOS 4.3.1 Apple iOS 4.3 Apple iOS 4.2.9 Apple iOS 4.2.8 Apple iOS 4.2.7 Apple iOS 4.2.6 Apple iOS 4.2.5 Apple iOS 4.2.10 Apple iOS 4.2 Apple iOS 4.1 Apple iOS 4 Apple iOS 3.2 Apple iOS 3.1 Apple iOS 3.0 Apple iOS 2.0 Apple iOS 10.3.1 Apple iOS 10.3 Apple iOS 10.2 Apple iOS 10.1 Apple iOS 10 |
| Not Vulnerable: |
Apple tvOS 10.2.1 Apple Safari 10.1.1 Apple iOS 10.3.2 |
Discussion
Webkit Cross Site Scripting and Arbitrary Code Execution Vulnerabilities
Webkit is prone to cross-site scripting and arbitrary-code execution vulnerabilities.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and steal cookie-based authentication credentials or execute arbitrary code within the context of the vulnerable application.
Webkit is prone to cross-site scripting and arbitrary-code execution vulnerabilities.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and steal cookie-based authentication credentials or execute arbitrary code within the context of the vulnerable application.
Exploit / POC
Webkit Cross Site Scripting and Arbitrary Code Execution Vulnerabilities
Attackers can exploit these issues with a browser. To exploit a cross-site scripting issue, an attacker must entice an unsuspecting user to follow a malicious URI.
Attackers can exploit these issues with a browser. To exploit a cross-site scripting issue, an attacker must entice an unsuspecting user to follow a malicious URI.
Solution / Fix
Webkit Cross Site Scripting and Arbitrary Code Execution Vulnerabilities
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Webkit Cross Site Scripting and Arbitrary Code Execution Vulnerabilities
References:
References:
- Apple Home Page (Apple)
- Apple iOS Homepage (Apple)
- Apple Safari Homepage (Apple)
- Apple tvOS - Homepage (Apple)