| Vulnerability Name: | CVE-2017-2446 (CCN-124045) | ||||||||||||||||||||||||||||||||||||||||||||
| Assigned: | 2016-12-01 | ||||||||||||||||||||||||||||||||||||||||||||
| Published: | 2017-03-28 | ||||||||||||||||||||||||||||||||||||||||||||
| Updated: | 2019-10-03 | ||||||||||||||||||||||||||||||||||||||||||||
| Summary: | An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code via a crafted web site that leverages the mishandling of strict mode functions. | ||||||||||||||||||||||||||||||||||||||||||||
| CVSS v3 Severity: | 8.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) 7.9 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C)
5.7 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C)
| ||||||||||||||||||||||||||||||||||||||||||||
| CVSS v2 Severity: | 6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
| ||||||||||||||||||||||||||||||||||||||||||||
| Vulnerability Type: | CWE-noinfo | ||||||||||||||||||||||||||||||||||||||||||||
| Vulnerability Consequences: | Gain Access | ||||||||||||||||||||||||||||||||||||||||||||
| References: | Source: MITRE Type: CNA CVE-2017-2446 Source: BID Type: Third Party Advisory, VDB Entry 97130 Source: CCN Type: BID-97130 WebKit Multiple Security Vulnerabilities Source: SECTRACK Type: UNKNOWN 1038137 Source: MISC Type: UNKNOWN https://bugs.chromium.org/p/project-zero/issues/detail?id=1032 Source: MISC Type: UNKNOWN https://doar-e.github.io/blog/2018/07/14/cve-2017-2446-or-jscjsglobalobjectishavingabadtime/ Source: XF Type: UNKNOWN apple-safari-cve20172446-code-exec(124045) Source: CCN Type: Packet Storm Security [03-29-2017] Safari Function.caller Modification Source: CCN Type: Packet Storm Security [03-29-2017] Safari DateTimeFormat.format Type Confusion Source: GENTOO Type: UNKNOWN GLSA-201706-15 Source: CCN Type: Apple security document HT207600 About the security content of Safari 10.1 Source: CONFIRM Type: Vendor Advisory https://support.apple.com/HT207600 Source: CONFIRM Type: Vendor Advisory https://support.apple.com/HT207601 Source: CONFIRM Type: Vendor Advisory https://support.apple.com/HT207617 Source: EXPLOIT-DB Type: EXPLOIT Offensive Security Exploit Database [03-27-2017] Source: EXPLOIT-DB Type: UNKNOWN 41741 Source: EXPLOIT-DB Type: EXPLOIT Offensive Security Exploit Database [03-27-2017] Source: EXPLOIT-DB Type: UNKNOWN 41742 | ||||||||||||||||||||||||||||||||||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||||||||||||||||||||||||||||||||||||||
| Oval Definitions | |||||||||||||||||||||||||||||||||||||||||||||
| |||||||||||||||||||||||||||||||||||||||||||||
| BACK | |||||||||||||||||||||||||||||||||||||||||||||