Exploitation Summary
EIP tracks 1 public exploit for CVE-2017-7056. PoCs published by Google Security Research.
AI-analyzed exploit summary This PoC exploits a bug in JavaScriptCore's ArgumentsEliminationPhase where uninitialized values and incorrect length are exposed in the arguments object due to improper handling of the varargs limit condition. The exploit triggers the vulnerability through a loop and sleep mechanism to force the buggy state.
Description
An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCloud before 6.2.2 on Windows is affected. iTunes before 12.6.2 on Windows is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
Exploits (1)
This PoC exploits a bug in JavaScriptCore's ArgumentsEliminationPhase where uninitialized values and incorrect length are exposed in the arguments object due to improper handling of the varargs limit condition. The exploit triggers the vulnerability through a loop and sleep mechanism to force the buggy state.
References (8)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H