CVE-2017-7160: Buffer Overflow

Q: What is the vulnerability ID for this issue?

The vulnerability ID is CVE-2017-7160.

Q: What is the severity of CVE-2017-7160?

The severity of CVE-2017-7160 is high, with a severity value of 8.8.

Q: Which Apple products are affected by CVE-2017-7160?

iOS before 11.2, Safari before 11.0.2, iCloud before 7.2 on Windows, iTunes before 12.7.2 on Windows, and tvOS before 11.2 are affected by CVE-2017-7160.

Q: What is the component involved in CVE-2017-7160?

The component involved in CVE-2017-7160 is WebKit.

Q: Are there any remediation steps available for CVE-2017-7160?

Yes, there are remediation steps available. Please refer to the provided references for more information.

Published Dec 2, 2017

Updated

An issue was discovered in certain Apple products. iOS before 11.2 is affected. Safari before 11.0.2 is affected. iCloud before 7.2 on Windows is affected. iTunes before 12.7.2 on Windows is affected. tvOS before 11.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.

Other sources

WebKit. Multiple memory corruption issues were addressed with improved memory handling.

Credit

Yuan Deng(Ant), an anonymous researcher, Jeonghoon Shin, Tencent Keen Security Lab@@keen_lab(Trend Micro), Richard Zhu (fluorescence)(Trend Micro)

Affected Software

16 affected componentsFixes available

Apple tvOS<11.2

11.2

Apple iTunes for Windows<12.7.2

12.7.2

Apple iOS<11.2

11.2

Apple Safari<11.0.2

Apple iPhone OS<11.2

Apple tvOS<11.2

Apple iCloud<7.2

Apple iTunes<12.7.2

Microsoft Windows

Canonical Ubuntu Linux=16.04

Canonical Ubuntu Linux=17.10

Apple WebKit

All of the following

Any of the following

Apple iCloud<7.2

Apple iTunes<12.7.2

Microsoft Windows

debian/webkit2gtk

2.44.2-1~deb11u12.50.4-1~deb11u12.50.4-1~deb12u12.50.4-1~deb13u12.50.5-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade tvOS to a version that resolves this vulnerability.
Fixed in 11.2
Upgrade
Upgrade iTunes to a version that resolves this vulnerability.
Fixed in 12.7.2
Upgrade
Upgrade Apple iOS and iPadOS to a version that resolves this vulnerability.
Fixed in 11.2
Upgrade
Upgrade debian/webkit2gtk to a version that resolves this vulnerability.
Fixed in 2.44.2-1~deb11u1Fixed in 2.50.4-1~deb11u1Fixed in 2.50.4-1~deb12u1Fixed in 2.50.4-1~deb13u1Fixed in 2.50.5-1
Upgrade
Upgrade Safari to a version that resolves this vulnerability.
Fixed in 11.0.2
Upgrade
Upgrade iCloud for Windows to a version that resolves this vulnerability.
Fixed in 7.2
Upgrade
Upgrade iOS to a version that resolves this vulnerability.
Fixed in 11.2
Upgrade
Upgrade iTunes for Windows to a version that resolves this vulnerability.
Fixed in 12.7.2

Event History

Dec 25, 2017

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Dec 27, 2017

Data Sourced

via NVD·05:08 PM

DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

What is the vulnerability ID for this issue?

The vulnerability ID is CVE-2017-7160.

What is the severity of CVE-2017-7160?