CVE-2017-7160

HIGH

Safari < 11.0.2 - Remote Code Execution via Memory Corruption

Title source: llm

Description

An issue was discovered in certain Apple products. iOS before 11.2 is affected. Safari before 11.0.2 is affected. iCloud before 7.2 on Windows is affected. iTunes before 12.7.2 on Windows is affected. tvOS before 11.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.

References (6)

Core 6

Core References

Vendor Advisory x_refsource_confirm

https://support.apple.com/HT208327

Vendor Advisory x_refsource_confirm

https://support.apple.com/HT208334

Vendor Advisory x_refsource_confirm

https://support.apple.com/HT208324

Vendor Advisory x_refsource_confirm

https://support.apple.com/HT208326

Third Party Advisory vendor-advisory x_refsource_ubuntu

https://usn.ubuntu.com/3551-1/

Vendor Advisory x_refsource_confirm

https://support.apple.com/HT208328

Scores

CVSS v3 8.8

EPSS 0.0252

EPSS Percentile 82.9%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE

CWE-119

Status published

Products (8)

apple/icloud < 7.2

apple/iphone_os < 11.2

apple/itunes < 12.7.2

apple/safari < 11.0.2

apple/tvos < 11.2

apple/webkit

canonical/ubuntu_linux 16.04

canonical/ubuntu_linux 17.10

Published Dec 27, 2017

Tracked Since Feb 18, 2026