CVE-2016-10222
HighSummary
In JavaScriptCore in WebKit, included in Safari Technology Preview Release 18, there is a vulnerability that allows remote attackers to cause a denial of service through crafted JavaScript code. This issue involves 'type confusion' in the JSON.stringify function, leading to segmentation violation and application crash.
Risk Assessment
This vulnerability may lead to application crashes, potentially disrupting service availability for users. A remote attacker could exploit this flaw to destabilize the system.
Recommendation
It is recommended to update to the latest version of Safari to mitigate this vulnerability. Additionally, monitoring and restricting the execution of unknown JavaScript code in web applications is advised.
Other vulnerabilities in JavaScriptCore w WebKit
See all- CVE-2016-10226High
JavaScriptCore in WebKit, as distributed in Safari Technology Preview Release 18, allows remote attackers to cause a denial of service via crafted JavaScript code mishandled in the operatorString function, leading to bitfield out-of-bounds read and application crash.
- CVE-2017-5949Critical
JavaScriptCore in WebKit, as distributed in Safari Technology Preview Release 22, allows remote attackers to cause a denial of service through heap-based out-of-bounds write, leading to application crash. The attack can be executed via crafted JavaScript code that triggers access to red-zone memory locations.
Original NVD description (English source)
runtime/JSONObject.cpp in JavaScriptCore in WebKit, as distributed in Safari Technology Preview Release 18, allows remote attackers to cause a denial of service (segmentation violation and application crash) via crafted JavaScript code that triggers a "type confusion" in the JSON.stringify function.