CVE-2017-5949
CriticalSummary
JavaScriptCore in WebKit, as distributed in Safari Technology Preview Release 22, allows remote attackers to cause a denial of service through heap-based out-of-bounds write, leading to application crash. The attack can be executed via crafted JavaScript code that triggers access to red-zone memory locations.
Risk Assessment
The organization may experience application downtime and potential unspecified security impacts. Exploitation of this vulnerability could lead to serious availability issues.
Recommendation
It is recommended to update Safari to the latest version to minimize the risk associated with this vulnerability. Additionally, monitoring and limiting the use of JavaScript in web applications is advised.
Other vulnerabilities in JavaScriptCore w WebKit
See all- CVE-2016-10226High
JavaScriptCore in WebKit, as distributed in Safari Technology Preview Release 18, allows remote attackers to cause a denial of service via crafted JavaScript code mishandled in the operatorString function, leading to bitfield out-of-bounds read and application crash.
- CVE-2016-10222High
In JavaScriptCore in WebKit, included in Safari Technology Preview Release 18, there is a vulnerability that allows remote attackers to cause a denial of service through crafted JavaScript code. This issue involves 'type confusion' in the JSON.stringify function, leading to segmentation violation and application crash.
Original NVD description (English source)
JavaScriptCore in WebKit, as distributed in Safari Technology Preview Release 22, allows remote attackers to cause a denial of service (heap-based out-of-bounds write and application crash) or possibly have unspecified other impact via crafted JavaScript code that triggers access to red-zone memory locations, related to jit/ThunkGenerators.cpp, llint/LowLevelInterpreter32_64.asm, and llint/LowLevelInterpreter64.asm.