PT-2017-7819 · Apple · Safari Technology Preview

Kamil Frankowicz · Publicado 2017-04-03 · Atualizado 2017-04-11 · CVE-2016-10222

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Safari Technology Preview Release 18

Description The issue allows remote attackers to cause a denial of service, resulting in a segmentation violation and application crash, via crafted JavaScript code. This is due to a "type confusion" in the JSON.stringify function.

Recommendations For Safari Technology Preview Release 18, consider avoiding the use of the JSON.stringify function with untrusted input until a patch is available. As a temporary workaround, restrict the execution of crafted JavaScript code to minimize the risk of exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2016-10222

Produtos afetados

Safari Technology Preview

Referências · 7

• https://bugs.webkit.org/show_bug.cgi?id=164123 · Nota
• https://ubuntu.com/security/CVE-2016-10222 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2016-10222 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-10222 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-10222 · Aviso do Fabricante
• http://trac.webkit.org/changeset/208123 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-10222 · Nota de Segurança