PT-2017-7823 · Apple · Safari Technology Preview

Kamil Frankowicz · Published 2017-04-03 · Updated 2017-04-11 · CVE-2016-10226

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Safari Technology Preview Release 18

Description The issue allows remote attackers to cause a denial of service, resulting in an application crash, via crafted JavaScript code. This is related to the mishandling of code in the operatorString function, and involves files such as MacroAssemblerARM64.h, MacroAssemblerX86Common.h, and WasmB3IRGenerator.cpp.

Recommendations For Safari Technology Preview Release 18, consider avoiding the execution of crafted JavaScript code until a fix is available. As a temporary workaround, restricting JavaScript execution may help minimize the risk of exploitation.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2016-10226

Affected Products

Safari Technology Preview

References · 7

• https://cve.org/CVERecord?id=CVE-2016-10226 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-10226 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-10226 · Security Note
• https://osv.dev/vulnerability/CVE-2016-10226 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-10226 · Vendor Advisory
• https://bugs.webkit.org/show_bug.cgi?id=165091 · Note
• https://trac.webkit.org/changeset/209295 · Note