CVE-2017-2371: Input Validation

Q: What is the severity of CVE-2017-2371?

CVE-2017-2371 has a medium severity level due to its potential to be exploited by remote attackers.

Q: Who is affected by CVE-2017-2371?

CVE-2017-2371 affects Apple iOS versions prior to 10.2.1.

Q: How do I fix CVE-2017-2371?

To fix CVE-2017-2371, upgrade your iOS device to version 10.2.1 or later.

Q: What component is involved in CVE-2017-2371?

CVE-2017-2371 involves the WebKit component which handles web content in Apple devices.

Q: What type of attack does CVE-2017-2371 allow?

CVE-2017-2371 allows remote attackers to launch blocking popups through crafted web content.

Published Jan 23, 2017

Updated

WebKit. An issue existed in the handling of blocking popups. This was addressed through improved input validation.

Other sources

An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. The issue involves the "WebKit" component, which allows remote attackers to launch popups via a crafted web site.

Credit

lokihardt(Google Project Zero)

Affected Software

2 affected componentsFixes available

Apple iOS and iPadOS<10.2.1

10.2.1

iPhone OS<10.2.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apple iOS and iPadOS to a version that resolves this vulnerability.
Fixed in 10.2.1

Event History

Feb 20, 2017

CVE Published

via MITRE·08:35 AM

Data Sourced

via MITRE·08:35 AM

Description

Data Sourced

via NVD·08:59 AM

DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

HT207482

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is the severity of CVE-2017-2371?