PT-2017-7819 · Apple · Safari Technology Preview

Kamil Frankowicz · Published 2017-04-03 · Updated 2017-04-11 · CVE-2016-10222

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Safari Technology Preview Release 18

Description The issue allows remote attackers to cause a denial of service, resulting in a segmentation violation and application crash, via crafted JavaScript code. This is due to a "type confusion" in the JSON.stringify function.

Recommendations For Safari Technology Preview Release 18, consider avoiding the use of the JSON.stringify function with untrusted input until a patch is available. As a temporary workaround, restrict the execution of crafted JavaScript code to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2016-10222

Affected Products

Safari Technology Preview

References · 7

• https://ubuntu.com/security/CVE-2016-10222 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-10222 · Security Note
• https://osv.dev/vulnerability/CVE-2016-10222 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-10222 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-10222 · Security Note
• https://bugs.webkit.org/show_bug.cgi?id=164123 · Note
• http://trac.webkit.org/changeset/208123 · Note