Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2017-2362: iOS, Safari, tvOS allow remote code execution via WebKit

CVE-2017-2362 · published 9 years ago

Summary

iPhone, iPad, Safari browsers, and Apple TV running older software can be tricked by a malicious web page to run unwanted code or crash. Updating to iOS 10.2.1 or later, Safari 10.0.3 or later, and tvOS 10.1.1 or later fixes the issue.

What to do

Update canonical webkit2gtk to version 2.14.5-0ubuntu0.16.04.1.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	apple	iphone_os	<= 10.2.0 `cpe:2.3:o:apple:iphone_os::::::::`
–	apple	safari	<= 10.0.2 `cpe:2.3:a:apple:safari::::::::`
–	apple	apple_tv	10.1.0 `cpe:2.3:o:apple:apple_tv:10.1.0:::::::*`
Ubuntu:16.04:LTS	canonical	webkit2gtk	< 2.14.5-0ubuntu0.16.04.1 Fix: upgrade to 2.14.5-0ubuntu0.16.04.1
Ubuntu:16.04:LTS	canonical	qtwebkit-opensource-src	All versions
Ubuntu:16.04:LTS	canonical	qtwebkit-source	All versions
Ubuntu:16.04:LTS	canonical	webkitgtk	All versions

Original advisory text

An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0.3 is affected. tvOS before 10.1.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.

References

https://ubuntu.com/security/CVE-2017-2362 Third Party Advisory
https://webkitgtk.org/security/WSA-2017-0002.html Third Party Advisory
https://ubuntu.com/security/notices/USN-3200-1 Vendor Advisory
https://www.cve.org/CVERecord?id=CVE-2017-2362 Third Party Advisory
http://www.securityfocus.com/bid/95727 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1037668
https://security.gentoo.org/glsa/201706-15
https://support.apple.com/HT207482 Vendor Advisory
https://support.apple.com/HT207484 Vendor Advisory
https://support.apple.com/HT207485 Vendor Advisory
https://www.exploit-db.com/exploits/41213/

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

8.8 High

Exploitation

6% chance of attack within 30 days

Type

CWE-119Buffer Overflow

Timeline

Published16 Feb 2017

Updated22 Oct 2026

First seen29 Sep 2026

Sources

CVE-2017-2362 · NVD

UBUNTU-CVE-2017-2362 · OSV

Track software like this

Free during beta