CVE-2017-1000121
CriticalSummary
The UNIX IPC layer in WebKit, including WebKitGTK+ prior to 2.16.3, does not properly validate message size metadata, allowing a compromised secondary process to trigger an integer overflow and subsequent buffer overflow in the UI process.
Risk Assessment
This vulnerability may lead to unauthorized memory access and potential execution of malicious code in the context of the UI process, posing a security threat to the application.
Recommendation
It is recommended to update WebKit to version 2.16.3 or later to mitigate this vulnerability.
Original NVD description (English source)
The UNIX IPC layer in WebKit, including WebKitGTK+ prior to 2.16.3, does not properly validate message size metadata, allowing a compromised secondary process to trigger an integer overflow and subsequent buffer overflow in the UI process. This vulnerability does not affect Apple products.