CVE-2017-5949

Critical

Published: 03/04/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

JavaScriptCore in WebKit, as distributed in Safari Technology Preview Release 22, allows remote attackers to cause a denial of service through heap-based out-of-bounds write, leading to application crash. The attack can be executed via crafted JavaScript code that triggers access to red-zone memory locations.

Risk Assessment

The organization may experience application downtime and potential unspecified security impacts. Exploitation of this vulnerability could lead to serious availability issues.

Recommendation

It is recommended to update Safari to the latest version to minimize the risk associated with this vulnerability. Additionally, monitoring and limiting the use of JavaScript in web applications is advised.

Original NVD description (English source)

JavaScriptCore in WebKit, as distributed in Safari Technology Preview Release 22, allows remote attackers to cause a denial of service (heap-based out-of-bounds write and application crash) or possibly have unspecified other impact via crafted JavaScript code that triggers access to red-zone memory locations, related to jit/ThunkGenerators.cpp, llint/LowLevelInterpreter32_64.asm, and llint/LowLevelInterpreter64.asm.