Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.1

Safari, iOS, and tvOS can run hidden web code

CVE-2017-2492 · published 8 years ago
Summary

Versions of Safari, iOS and tvOS that use an older JavaScript engine let a specially crafted web page run unauthorized scripts in the browser. This could let attackers display false information or steal data from users who visit the page. Update the devices to the latest software releases to close the gap.

What to do
  • Update apple safari to version 10.1 or later.
  • Update apple iphone_os to version 10.3 or later.
  • Update apple tvos to version 10.2 or later.
Affected software
VendorProductAffected versions
apple safari < 10.1
cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
apple iphone_os < 10.3
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
apple tvos < 10.2
cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
Original advisory text
An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the "JavaScriptCore" component. It a...
An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the "JavaScriptCore" component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via a crafted web site that triggers prototype mishandling.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
6.1 Medium
Exploitation
1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published3 Apr 2018
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2017-2492 · NVD
Track software like this
Free during beta