ID CVE-2017-7006
Summary An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct a timing side-channel attack to bypass the Same Origin Policy and obtain sensitive information via a crafted web site that uses SVG filters.
References
Vulnerable Configurations
  • Apple Safari
    cpe:2.3:a:apple:safari
  • Apple Safari 1.0
    cpe:2.3:a:apple:safari:1.0
  • Apple Safari 1.0 Beta
    cpe:2.3:a:apple:safari:1.0:beta
  • Apple Safari 1.0 Beta2
    cpe:2.3:a:apple:safari:1.0:beta2
  • Apple Safari 1.0.0
    cpe:2.3:a:apple:safari:1.0.0
  • Apple Safari 1.0.0b1
    cpe:2.3:a:apple:safari:1.0.0b1
  • Apple Safari 1.0.0b2
    cpe:2.3:a:apple:safari:1.0.0b2
  • Apple Safari 1.0.1
    cpe:2.3:a:apple:safari:1.0.1
  • Apple Safari 1.0.2
    cpe:2.3:a:apple:safari:1.0.2
  • Apple Safari 1.0.3
    cpe:2.3:a:apple:safari:1.0.3
  • Apple Safari 1.0.3 85.8
    cpe:2.3:a:apple:safari:1.0.3:85.8
  • Apple Safari 1.0.3 85.8.1
    cpe:2.3:a:apple:safari:1.0.3:85.8.1
  • Apple Safari 1.0b1 for Mac OS X
    cpe:2.3:a:apple:safari:1.0b1:-:mac
  • Apple Safari 1.1
    cpe:2.3:a:apple:safari:1.1
  • Apple Safari 1.1.0
    cpe:2.3:a:apple:safari:1.1.0
  • Apple Safari 1.1.1
    cpe:2.3:a:apple:safari:1.1.1
  • Apple Safari 1.2
    cpe:2.3:a:apple:safari:1.2
  • Apple Safari 1.2.0
    cpe:2.3:a:apple:safari:1.2.0
  • Apple Safari 1.2.1
    cpe:2.3:a:apple:safari:1.2.1
  • Apple Safari 1.2.2
    cpe:2.3:a:apple:safari:1.2.2
  • Apple Safari 1.2.3
    cpe:2.3:a:apple:safari:1.2.3
  • Apple Safari 1.2.4
    cpe:2.3:a:apple:safari:1.2.4
  • Apple Safari 1.2.5
    cpe:2.3:a:apple:safari:1.2.5
  • Apple Safari 1.3
    cpe:2.3:a:apple:safari:1.3
  • Apple Safari 1.3.0
    cpe:2.3:a:apple:safari:1.3.0
  • Apple Safari 1.3.1
    cpe:2.3:a:apple:safari:1.3.1
  • Apple Safari 1.3.2
    cpe:2.3:a:apple:safari:1.3.2
  • Apple Safari 1.3.2 312.5
    cpe:2.3:a:apple:safari:1.3.2:312.5
  • Apple Safari 1.3.2 312.6
    cpe:2.3:a:apple:safari:1.3.2:312.6
  • Apple Safari 2
    cpe:2.3:a:apple:safari:2
  • Apple Safari 2.0
    cpe:2.3:a:apple:safari:2.0
  • Apple Safari 2.0.0
    cpe:2.3:a:apple:safari:2.0.0
  • Apple Safari 2.0.1
    cpe:2.3:a:apple:safari:2.0.1
  • Apple Safari 2.0.2
    cpe:2.3:a:apple:safari:2.0.2
  • Apple Safari 2.0.3
    cpe:2.3:a:apple:safari:2.0.3
  • Apple Safari 2.0.3 417.8
    cpe:2.3:a:apple:safari:2.0.3:417.8
  • Apple Safari 2.0.3 417.9
    cpe:2.3:a:apple:safari:2.0.3:417.9
  • Apple Safari 2.0.3 417.9.2
    cpe:2.3:a:apple:safari:2.0.3:417.9.2
  • Apple Safari 2.0.3 417.9.3
    cpe:2.3:a:apple:safari:2.0.3:417.9.3
  • Apple Safari 2.0.4
    cpe:2.3:a:apple:safari:2.0.4
  • Apple Safari 2.0.4 for Mac OS X
    cpe:2.3:a:apple:safari:2.0.4:-:mac
  • Apple Safari 3
    cpe:2.3:a:apple:safari:3
  • Apple Safari 3.0
    cpe:2.3:a:apple:safari:3.0
  • Apple Safari 3.0.0
    cpe:2.3:a:apple:safari:3.0.0
  • Apple Safari 3.0.0 for Mac OS X
    cpe:2.3:a:apple:safari:3.0.0:-:mac
  • Apple Safari 3.0.0b
    cpe:2.3:a:apple:safari:3.0.0b
  • Apple Safari 3.0.0b for Windows
    cpe:2.3:a:apple:safari:3.0.0b:-:windows
  • Apple Safari 3.0.1
    cpe:2.3:a:apple:safari:3.0.1
  • Apple Safari 3.0.1 for Mac OS X
    cpe:2.3:a:apple:safari:3.0.1:-:mac
  • Apple Safari 3.0.1 Beta
    cpe:2.3:a:apple:safari:3.0.1:beta
  • Apple Safari 3.0.1b
    cpe:2.3:a:apple:safari:3.0.1b
  • Apple Safari 3.0.1b for Windows
    cpe:2.3:a:apple:safari:3.0.1b:-:windows
  • Apple Safari 3.0.2
    cpe:2.3:a:apple:safari:3.0.2
  • Apple Safari 3.0.2 for Mac OS X
    cpe:2.3:a:apple:safari:3.0.2:-:mac
  • Apple Safari 3.0.2b
    cpe:2.3:a:apple:safari:3.0.2b
  • Apple Safari 3.0.2b for Windows
    cpe:2.3:a:apple:safari:3.0.2b:-:windows
  • Apple Safari 3.0.3
    cpe:2.3:a:apple:safari:3.0.3
  • Apple Safari 3.0.3 for Mac OS X
    cpe:2.3:a:apple:safari:3.0.3:-:mac
  • Apple Safari 3.0.3b
    cpe:2.3:a:apple:safari:3.0.3b
  • Apple Safari 3.0.3b for Windows
    cpe:2.3:a:apple:safari:3.0.3b:-:windows
  • Apple Safari 3.0.4
    cpe:2.3:a:apple:safari:3.0.4
  • Apple Safari 3.0.4 for Mac OS X
    cpe:2.3:a:apple:safari:3.0.4:-:mac
  • Apple Safari 3.0.4b
    cpe:2.3:a:apple:safari:3.0.4b
  • Apple Safari 3.0.4b for Windows
    cpe:2.3:a:apple:safari:3.0.4b:-:windows
  • Apple Safari 3.1.0
    cpe:2.3:a:apple:safari:3.1.0
  • Apple Safari 3.1.0 for Mac OS X
    cpe:2.3:a:apple:safari:3.1.0:-:mac
  • Apple Safari 3.1.0b
    cpe:2.3:a:apple:safari:3.1.0b
  • Apple Safari 3.1.0b for Windows
    cpe:2.3:a:apple:safari:3.1.0b:-:windows
  • Apple Safari 3.1.1
    cpe:2.3:a:apple:safari:3.1.1
  • Apple Safari 3.1.1b for Windows
    cpe:2.3:a:apple:safari:3.1.1b:-:windows
  • Apple Safari 3.1.2
    cpe:2.3:a:apple:safari:3.1.2
  • Apple Safari 3.1.2b for Windows
    cpe:2.3:a:apple:safari:3.1.2b:-:windows
  • Apple Safari 3.2.0
    cpe:2.3:a:apple:safari:3.2.0
  • Apple Safari 3.2.0b for Windows
    cpe:2.3:a:apple:safari:3.2.0b:-:windows
  • Apple Safari 3.2.1
    cpe:2.3:a:apple:safari:3.2.1
  • Apple Safari 3.2.1b for Windows
    cpe:2.3:a:apple:safari:3.2.1b:-:windows
  • Apple Safari 3.2.2
    cpe:2.3:a:apple:safari:3.2.2
  • Apple Safari 3.2.2b for Windows
    cpe:2.3:a:apple:safari:3.2.2b:-:windows
  • Apple Safari 4.0
    cpe:2.3:a:apple:safari:4.0
  • Apple Safari 4 Beta
    cpe:2.3:a:apple:safari:4.0:beta
  • Apple Safari 4.0.0b
    cpe:2.3:a:apple:safari:4.0.0b
  • Apple Safari 4.0.1
    cpe:2.3:a:apple:safari:4.0.1
  • Apple Safari 4.0.2
    cpe:2.3:a:apple:safari:4.0.2
  • Apple Safari 4.0.3
    cpe:2.3:a:apple:safari:4.0.3
  • Apple Safari 4.0.4
    cpe:2.3:a:apple:safari:4.0.4
  • Apple Safari 4.0.5
    cpe:2.3:a:apple:safari:4.0.5
  • Apple Safari 4.1
    cpe:2.3:a:apple:safari:4.1
  • Apple Safari 4.1.1
    cpe:2.3:a:apple:safari:4.1.1
  • Apple Safari 4.1.2
    cpe:2.3:a:apple:safari:4.1.2
  • Apple Safari 5.0
    cpe:2.3:a:apple:safari:5.0
  • Apple Safari 5.0.1
    cpe:2.3:a:apple:safari:5.0.1
  • Apple Safari 5.0.2
    cpe:2.3:a:apple:safari:5.0.2
  • Apple Safari 5.0.4
    cpe:2.3:a:apple:safari:5.0.4
  • Apple Safari 5.0.5
    cpe:2.3:a:apple:safari:5.0.5
  • Apple Safari 5.0.6
    cpe:2.3:a:apple:safari:5.0.6
  • Apple Safari 5.1
    cpe:2.3:a:apple:safari:5.1
  • Apple Safari 5.1.1
    cpe:2.3:a:apple:safari:5.1.1
  • Apple Safari 5.1.2
    cpe:2.3:a:apple:safari:5.1.2
  • Apple Safari 5.1.3
    cpe:2.3:a:apple:safari:5.1.3
  • Apple Safari 5.1.4
    cpe:2.3:a:apple:safari:5.1.4
  • Apple Safari 5.1.5
    cpe:2.3:a:apple:safari:5.1.5
  • Apple Safari 5.1.6
    cpe:2.3:a:apple:safari:5.1.6
  • Apple Safari 5.1.7
    cpe:2.3:a:apple:safari:5.1.7
  • Apple Safari 6.0
    cpe:2.3:a:apple:safari:6.0
  • Apple Safari 6.0.1
    cpe:2.3:a:apple:safari:6.0.1
  • Apple Safari 6.0.2
    cpe:2.3:a:apple:safari:6.0.2
  • Apple Safari 6.0.3
    cpe:2.3:a:apple:safari:6.0.3
  • Apple Safari 6.0.4
    cpe:2.3:a:apple:safari:6.0.4
  • Apple Safari 6.0.5
    cpe:2.3:a:apple:safari:6.0.5
  • Apple Safari 6.1
    cpe:2.3:a:apple:safari:6.1
  • Apple Safari 6.1.1
    cpe:2.3:a:apple:safari:6.1.1
  • Apple Safari 6.1.2
    cpe:2.3:a:apple:safari:6.1.2
  • Apple Safari 6.1.3
    cpe:2.3:a:apple:safari:6.1.3
  • Apple Safari 6.1.4
    cpe:2.3:a:apple:safari:6.1.4
  • Apple Safari 6.1.5
    cpe:2.3:a:apple:safari:6.1.5
  • Apple Safari 6.2.4
    cpe:2.3:a:apple:safari:6.2.4
  • Apple Safari 6.2.5
    cpe:2.3:a:apple:safari:6.2.5
  • Apple Safari 6.2.6
    cpe:2.3:a:apple:safari:6.2.6
  • Apple Safari 6.2.8
    cpe:2.3:a:apple:safari:6.2.8
  • Apple Safari 7.0
    cpe:2.3:a:apple:safari:7.0
  • Apple Safari 7.0.1
    cpe:2.3:a:apple:safari:7.0.1
  • Apple Safari 7.0.2
    cpe:2.3:a:apple:safari:7.0.2
  • Apple Safari 7.0.3
    cpe:2.3:a:apple:safari:7.0.3
  • Apple Safari 7.0.4
    cpe:2.3:a:apple:safari:7.0.4
  • Apple Safari 7.0.5
    cpe:2.3:a:apple:safari:7.0.5
  • Apple Safari 7.1
    cpe:2.3:a:apple:safari:7.1
  • Apple Safari 7.1.4
    cpe:2.3:a:apple:safari:7.1.4
  • Apple Safari 7.1.5
    cpe:2.3:a:apple:safari:7.1.5
  • Apple Safari 7.1.6
    cpe:2.3:a:apple:safari:7.1.6
  • Apple Safari 7.1.8
    cpe:2.3:a:apple:safari:7.1.8
  • Apple Safari 8.0
    cpe:2.3:a:apple:safari:8.0
  • Apple Safari 8.0.4
    cpe:2.3:a:apple:safari:8.0.4
  • Apple Safari 8.0.5
    cpe:2.3:a:apple:safari:8.0.5
  • Apple Safari 8.0.6
    cpe:2.3:a:apple:safari:8.0.6
  • Apple Safari 8.0.8
    cpe:2.3:a:apple:safari:8.0.8
  • Apple Safari 9.0.1
    cpe:2.3:a:apple:safari:9.0.1
  • Apple Safari 9.0.2
    cpe:2.3:a:apple:safari:9.0.2
  • Apple Safari 9.0.3
    cpe:2.3:a:apple:safari:9.0.3
  • Apple Safari 9.1
    cpe:2.3:a:apple:safari:9.1
  • Apple Safari 9.1.1
    cpe:2.3:a:apple:safari:9.1.1
  • Apple Safari 9.1.3
    cpe:2.3:a:apple:safari:9.1.3
  • Apple Safari 10.0.3
    cpe:2.3:a:apple:safari:10.0.3
  • Apple Safari 10.1
    cpe:2.3:a:apple:safari:10.1
  • Apple Safari 10.1.1
    cpe:2.3:a:apple:safari:10.1.1
  • Apple iPhone OS 1.0.0
    cpe:2.3:o:apple:iphone_os:1.0.0
  • Apple iPhone OS 1.0.0 iPhone
    cpe:2.3:o:apple:iphone_os:1.0.0:-:iphone
  • Apple iPhone OS 1.0.1
    cpe:2.3:o:apple:iphone_os:1.0.1
  • Apple iPhone OS 1.0.1 iPhone
    cpe:2.3:o:apple:iphone_os:1.0.1:-:iphone
  • Apple iPhone OS 1.0.2
    cpe:2.3:o:apple:iphone_os:1.0.2
  • Apple iPhone OS 1.0.2 iPhone
    cpe:2.3:o:apple:iphone_os:1.0.2:-:iphone
  • Apple iPhone OS 1.1.0
    cpe:2.3:o:apple:iphone_os:1.1.0
  • Apple iPhone OS 1.1.0 iPhone
    cpe:2.3:o:apple:iphone_os:1.1.0:-:iphone
  • Apple iPhone OS 1.1.0 iPodTouch
    cpe:2.3:o:apple:iphone_os:1.1.0:-:ipodtouch
  • Apple iPhone OS 1.1.1
    cpe:2.3:o:apple:iphone_os:1.1.1
  • Apple iPhone OS 1.1.1 iPhone
    cpe:2.3:o:apple:iphone_os:1.1.1:-:iphone
  • Apple iPhone OS 1.1.1 iPodTouch
    cpe:2.3:o:apple:iphone_os:1.1.1:-:ipodtouch
  • Apple iPhone OS 1.1.2
    cpe:2.3:o:apple:iphone_os:1.1.2
  • Apple iPhone OS 1.1.2 iPhone
    cpe:2.3:o:apple:iphone_os:1.1.2:-:iphone
  • Apple iPhone OS 1.1.2 iPodTouch
    cpe:2.3:o:apple:iphone_os:1.1.2:-:ipodtouch
  • Apple iPhone OS 1.1.3
    cpe:2.3:o:apple:iphone_os:1.1.3
  • Apple iPhone OS 1.1.3 iPhone
    cpe:2.3:o:apple:iphone_os:1.1.3:-:iphone
  • Apple iPhone OS 1.1.3 iPodTouch
    cpe:2.3:o:apple:iphone_os:1.1.3:-:ipodtouch
  • Apple iPhone OS 1.1.4
    cpe:2.3:o:apple:iphone_os:1.1.4
  • Apple iPhone OS 1.1.4 iPhone
    cpe:2.3:o:apple:iphone_os:1.1.4:-:iphone
  • Apple iPhone OS 1.1.4 iPodTouch
    cpe:2.3:o:apple:iphone_os:1.1.4:-:ipodtouch
  • Apple iPhone OS 1.1.5
    cpe:2.3:o:apple:iphone_os:1.1.5
  • Apple iPhone OS 1.1.5 iPhone
    cpe:2.3:o:apple:iphone_os:1.1.5:-:iphone
  • Apple iPhone OS 1.1.5 iPodTouch
    cpe:2.3:o:apple:iphone_os:1.1.5:-:ipodtouch
  • Apple iPhone OS 2.0
    cpe:2.3:o:apple:iphone_os:2.0
  • Apple iPhone OS 2.0.0
    cpe:2.3:o:apple:iphone_os:2.0.0
  • Apple iPhone OS 2.0.0 iPhone
    cpe:2.3:o:apple:iphone_os:2.0.0:-:iphone
  • Apple iPhone OS 2.0.0 iPodTouch
    cpe:2.3:o:apple:iphone_os:2.0.0:-:ipodtouch
  • Apple iPhone OS 2.0.1
    cpe:2.3:o:apple:iphone_os:2.0.1
  • Apple iPhone OS 2.0.1
    cpe:2.3:o:apple:iphone_os:2.0.1:-:iphone
  • Apple iPhone OS 2.0.1 iPodTouch
    cpe:2.3:o:apple:iphone_os:2.0.1:-:ipodtouch
  • Apple iPhone OS 2.0.2
    cpe:2.3:o:apple:iphone_os:2.0.2
  • Apple iPhone OS 2.0.2 iPhone
    cpe:2.3:o:apple:iphone_os:2.0.2:-:iphone
  • Apple iPhone OS 2.0.2 iPodTouch
    cpe:2.3:o:apple:iphone_os:2.0.2:-:ipodtouch
  • Apple iPhone OS 2.1
    cpe:2.3:o:apple:iphone_os:2.1
  • Apple iPhone OS 2.1 iPhone
    cpe:2.3:o:apple:iphone_os:2.1:-:iphone
  • Apple iPhone OS 2.1 iPodTouch
    cpe:2.3:o:apple:iphone_os:2.1:-:ipodtouch
  • Apple iPhone OS 2.1.1
    cpe:2.3:o:apple:iphone_os:2.1.1
  • Apple iPhone OS 2.2
    cpe:2.3:o:apple:iphone_os:2.2
  • Apple iPhone OS 2.2 iPhone
    cpe:2.3:o:apple:iphone_os:2.2:-:iphone
  • Apple iPhone OS 2.2 iPodTouch
    cpe:2.3:o:apple:iphone_os:2.2:-:ipodtouch
  • Apple iPhone OS 2.2.1
    cpe:2.3:o:apple:iphone_os:2.2.1
  • Apple iPhone OS 2.2.1 iPhone
    cpe:2.3:o:apple:iphone_os:2.2.1:-:iphone
  • Apple iPhone OS 2.2.1 iPodTouch
    cpe:2.3:o:apple:iphone_os:2.2.1:-:ipodtouch
  • Apple iPhone OS 3.0
    cpe:2.3:o:apple:iphone_os:3.0
  • Apple iPhone OS 3.0 iPhone
    cpe:2.3:o:apple:iphone_os:3.0:-:iphone
  • Apple iPhone OS 3.0 iPodTouch
    cpe:2.3:o:apple:iphone_os:3.0:-:ipodtouch
  • Apple iPhone OS 3.0.1
    cpe:2.3:o:apple:iphone_os:3.0.1
  • Apple iPhone OS 3.0.1 iPhone
    cpe:2.3:o:apple:iphone_os:3.0.1:-:iphone
  • Apple iPhone OS 3.0.1 iPodTouch
    cpe:2.3:o:apple:iphone_os:3.0.1:-:ipodtouch
  • Apple iPhone OS 3.1
    cpe:2.3:o:apple:iphone_os:3.1
  • Apple iPhone OS 3.1 for iPod Touch
    cpe:2.3:o:apple:iphone_os:3.1:-:-:-:-:ipod_touch
  • Apple iPhone OS 3.1 iPhone
    cpe:2.3:o:apple:iphone_os:3.1:-:iphone
  • Apple iPhone OS 3.1 iPodTouch
    cpe:2.3:o:apple:iphone_os:3.1:-:ipodtouch
  • Apple iPhone OS 3.1.1 for iPod Touch
    cpe:2.3:o:apple:iphone_os:3.1.1:-:-:-:-:ipod_touch
  • Apple iPhone OS 3.1.2
    cpe:2.3:o:apple:iphone_os:3.1.2
  • Apple iPhone OS 3.1.2 iPhone
    cpe:2.3:o:apple:iphone_os:3.1.2:-:iphone
  • Apple iPhone OS 3.1.2 iPodTouch
    cpe:2.3:o:apple:iphone_os:3.1.2:-:ipodtouch
  • Apple iPhone OS 3.1.3
    cpe:2.3:o:apple:iphone_os:3.1.3
  • Apple iPhone OS 3.1.3 iPhone
    cpe:2.3:o:apple:iphone_os:3.1.3:-:iphone
  • Apple iPhone OS 3.1.3 iPodTouch
    cpe:2.3:o:apple:iphone_os:3.1.3:-:ipodtouch
  • Apple iPhone OS 3.2
    cpe:2.3:o:apple:iphone_os:3.2
  • Apple iPhone OS 3.2 iPhone
    cpe:2.3:o:apple:iphone_os:3.2:-:iphone
  • Apple iPhone OS 3.2 iPodTouch
    cpe:2.3:o:apple:iphone_os:3.2:-:ipodtouch
  • Apple iPhone OS 3.2.1
    cpe:2.3:o:apple:iphone_os:3.2.1
  • Apple iPhone OS 3.2.1:-:ipad
    cpe:2.3:o:apple:iphone_os:3.2.1:-:ipad
  • Apple iPhone OS 3.2.2
    cpe:2.3:o:apple:iphone_os:3.2.2
  • Apple iPhone OS 4.0
    cpe:2.3:o:apple:iphone_os:4.0
  • Apple iPhone OS 4.0 iPhone
    cpe:2.3:o:apple:iphone_os:4.0:-:iphone
  • Apple iPhone OS 4.0 iPodTouch
    cpe:2.3:o:apple:iphone_os:4.0:-:ipodtouch
  • Apple iPhone OS 4.0.1
    cpe:2.3:o:apple:iphone_os:4.0.1
  • Apple iPhone OS 4.0.1 iPhone
    cpe:2.3:o:apple:iphone_os:4.0.1:-:iphone
  • Apple iPhone OS 4.0.1 iPodTouch
    cpe:2.3:o:apple:iphone_os:4.0.1:-:ipodtouch
  • Apple iPhone OS 4.0.2
    cpe:2.3:o:apple:iphone_os:4.0.2
  • Apple iPhone OS 4.1
    cpe:2.3:o:apple:iphone_os:4.1
  • Apple iPhone OS 4.2.1
    cpe:2.3:o:apple:iphone_os:4.2.1
  • Apple iPhone OS 4.2.5
    cpe:2.3:o:apple:iphone_os:4.2.5
  • Apple iPhone OS 4.2.8
    cpe:2.3:o:apple:iphone_os:4.2.8
  • Apple iPhone OS 4.3.0
    cpe:2.3:o:apple:iphone_os:4.3.0
  • Apple iPhone OS 4.3.1
    cpe:2.3:o:apple:iphone_os:4.3.1
  • Apple iPhone OS 4.3.2
    cpe:2.3:o:apple:iphone_os:4.3.2
  • Apple iPhone OS 4.3.3
    cpe:2.3:o:apple:iphone_os:4.3.3
  • Apple iPhone OS 4.3.5
    cpe:2.3:o:apple:iphone_os:4.3.5
  • Apple iPhone OS 4.3.5 iPad
    cpe:2.3:o:apple:iphone_os:4.3.5:-:ipad
  • Apple iPhone OS 4.3.5 iPodTouch
    cpe:2.3:o:apple:iphone_os:4.3.5:-:ipodtouch
  • Apple iPhone OS 5.0
    cpe:2.3:o:apple:iphone_os:5.0
  • Apple iPhone OS 5.0 iPad
    cpe:2.3:o:apple:iphone_os:5.0:-:ipad
  • Apple iPhone OS 5.0 iPhone
    cpe:2.3:o:apple:iphone_os:5.0:-:iphone
  • Apple iPhone OS 5.0iPod touch
    cpe:2.3:o:apple:iphone_os:5.0:-:ipodtouch
  • Apple iPhone OS 5.0.1
    cpe:2.3:o:apple:iphone_os:5.0.1
  • Apple iPhone OS 5.0.1 iPad
    cpe:2.3:o:apple:iphone_os:5.0.1:-:ipad
  • Apple iPhone OS 5.0.1 iPhone
    cpe:2.3:o:apple:iphone_os:5.0.1:-:iphone
  • Apple iPhone OS 5.0.1 iPod touch
    cpe:2.3:o:apple:iphone_os:5.0.1:-:ipodtouch
  • Apple iPhone OS 5.1
    cpe:2.3:o:apple:iphone_os:5.1
  • Apple iPhone OS 5.1.1
    cpe:2.3:o:apple:iphone_os:5.1.1
  • Apple iPhone OS 6.0
    cpe:2.3:o:apple:iphone_os:6.0
  • Apple iPhone OS 6.0.1
    cpe:2.3:o:apple:iphone_os:6.0.1
  • Apple iPhone OS 6.0.2
    cpe:2.3:o:apple:iphone_os:6.0.2
  • Apple iPhone OS 6.1
    cpe:2.3:o:apple:iphone_os:6.1
  • Apple iPhone OS 6.1.2
    cpe:2.3:o:apple:iphone_os:6.1.2
  • Apple iPhone OS 6.1.3
    cpe:2.3:o:apple:iphone_os:6.1.3
  • Apple iPhone OS 6.1.4
    cpe:2.3:o:apple:iphone_os:6.1.4
  • Apple iPhone OS 6.1.5
    cpe:2.3:o:apple:iphone_os:6.1.5
  • Apple iPhone OS 6.1.6
    cpe:2.3:o:apple:iphone_os:6.1.6
  • Apple iPhone OS 7.0
    cpe:2.3:o:apple:iphone_os:7.0
  • Apple iPhone OS 7.0.1
    cpe:2.3:o:apple:iphone_os:7.0.1
  • Apple iPhone OS 7.0.2
    cpe:2.3:o:apple:iphone_os:7.0.2
  • Apple iPhone OS 7.0.3
    cpe:2.3:o:apple:iphone_os:7.0.3
  • Apple iPhone OS 7.0.4
    cpe:2.3:o:apple:iphone_os:7.0.4
  • Apple iPhone OS 7.0.5
    cpe:2.3:o:apple:iphone_os:7.0.5
  • Apple iPhone OS 7.0.6
    cpe:2.3:o:apple:iphone_os:7.0.6
  • Apple iPhone OS 7.1
    cpe:2.3:o:apple:iphone_os:7.1
  • Apple iPhone OS 7.1.1
    cpe:2.3:o:apple:iphone_os:7.1.1
  • Apple iPhone OS 7.1.2
    cpe:2.3:o:apple:iphone_os:7.1.2
  • Apple iPhone OS 8.0
    cpe:2.3:o:apple:iphone_os:8.0
  • Apple iPhone OS 8.0.1
    cpe:2.3:o:apple:iphone_os:8.0.1
  • Apple iPhone OS 8.0.2
    cpe:2.3:o:apple:iphone_os:8.0.2
  • Apple iPhone OS 8.1
    cpe:2.3:o:apple:iphone_os:8.1
  • Apple iPhone OS 8.1.2
    cpe:2.3:o:apple:iphone_os:8.1.2
  • Apple iPhone OS 8.1.3
    cpe:2.3:o:apple:iphone_os:8.1.3
  • Apple iPhone OS 8.2
    cpe:2.3:o:apple:iphone_os:8.2
  • Apple iPhone OS 8.3
    cpe:2.3:o:apple:iphone_os:8.3
  • Apple iPhone OS 8.4.1
    cpe:2.3:o:apple:iphone_os:8.4.1
  • Apple iPhone OS 9.0
    cpe:2.3:o:apple:iphone_os:9.0
  • Apple iPhone OS 9.0.1
    cpe:2.3:o:apple:iphone_os:9.0.1
  • Apple iPhone OS 9.0.2
    cpe:2.3:o:apple:iphone_os:9.0.2
  • Apple iPhone OS 9.1
    cpe:2.3:o:apple:iphone_os:9.1
  • Apple iPhone OS 9.2
    cpe:2.3:o:apple:iphone_os:9.2
  • Apple iPhone OS 9.2.1
    cpe:2.3:o:apple:iphone_os:9.2.1
  • Apple iPhone OS 9.3
    cpe:2.3:o:apple:iphone_os:9.3
  • Apple iPhone OS 9.3.1
    cpe:2.3:o:apple:iphone_os:9.3.1
  • Apple iPhone OS 9.3.2
    cpe:2.3:o:apple:iphone_os:9.3.2
  • Apple iPhone OS 9.3.3
    cpe:2.3:o:apple:iphone_os:9.3.3
  • Apple iPhone OS 9.3.4
    cpe:2.3:o:apple:iphone_os:9.3.4
  • Apple iPhone OS 9.3.5
    cpe:2.3:o:apple:iphone_os:9.3.5
  • Apple iPhone OS 10.0
    cpe:2.3:o:apple:iphone_os:10.0
  • Apple iPhone OS 10.0.1
    cpe:2.3:o:apple:iphone_os:10.0.1
  • Apple iPhone OS 10.0.2
    cpe:2.3:o:apple:iphone_os:10.0.2
  • Apple iPhone OS 10.0.3
    cpe:2.3:o:apple:iphone_os:10.0.3
  • Apple iPhone OS 10.1
    cpe:2.3:o:apple:iphone_os:10.1
  • Apple iPhone OS 10.1.1
    cpe:2.3:o:apple:iphone_os:10.1.1
  • Apple iPhone OS 10.2
    cpe:2.3:o:apple:iphone_os:10.2
  • Apple iPhone OS 10.2.1
    cpe:2.3:o:apple:iphone_os:10.2.1
  • Apple iPhone OS 10.3
    cpe:2.3:o:apple:iphone_os:10.3
  • Apple iPhone OS 10.3.1
    cpe:2.3:o:apple:iphone_os:10.3.1
  • Apple iPhone OS 10.3.2
    cpe:2.3:o:apple:iphone_os:10.3.2
  • Apple tvOS 1.0.0
    cpe:2.3:o:apple:tvos:1.0.0
  • Apple tvOS 1.1.0
    cpe:2.3:o:apple:tvos:1.1.0
  • Apple tvOS 2.0.0
    cpe:2.3:o:apple:tvos:2.0.0
  • Apple tvOS 2.0.1
    cpe:2.3:o:apple:tvos:2.0.1
  • Apple tvOS 2.0.2
    cpe:2.3:o:apple:tvos:2.0.2
  • Apple tvOS 2.1.0
    cpe:2.3:o:apple:tvos:2.1.0
  • Apple tvOS 2.2.0
    cpe:2.3:o:apple:tvos:2.2.0
  • Apple tvOS 2.3.0
    cpe:2.3:o:apple:tvos:2.3.0
  • Apple tvOS 2.3.1
    cpe:2.3:o:apple:tvos:2.3.1
  • Apple tvOS 2.4.0
    cpe:2.3:o:apple:tvos:2.4.0
  • Apple tvOS 3.0.0
    cpe:2.3:o:apple:tvos:3.0.0
  • Apple tvOS 3.0.1
    cpe:2.3:o:apple:tvos:3.0.1
  • Apple tvOS 3.0.2
    cpe:2.3:o:apple:tvos:3.0.2
  • Apple tvOS 4.1.0
    cpe:2.3:o:apple:tvos:4.1.0
  • Apple tvOS 4.1.1
    cpe:2.3:o:apple:tvos:4.1.1
  • Apple tvOS 4.2.0
    cpe:2.3:o:apple:tvos:4.2.0
  • Apple tvOS 4.2.1
    cpe:2.3:o:apple:tvos:4.2.1
  • Apple tvOS 4.2.2
    cpe:2.3:o:apple:tvos:4.2.2
  • Apple tvOS 4.3.0
    cpe:2.3:o:apple:tvos:4.3.0
  • Apple tvOS 4.4.0
    cpe:2.3:o:apple:tvos:4.4.0
  • Apple tvOS 4.4.2
    cpe:2.3:o:apple:tvos:4.4.2
  • Apple tvOS 4.4.3
    cpe:2.3:o:apple:tvos:4.4.3
  • Apple tvOS 4.4.4
    cpe:2.3:o:apple:tvos:4.4.4
  • Apple tvOS 5.0.0
    cpe:2.3:o:apple:tvos:5.0.0
  • Apple tvOS 5.0.1
    cpe:2.3:o:apple:tvos:5.0.1
  • Apple tvOS 5.0.2
    cpe:2.3:o:apple:tvos:5.0.2
  • Apple tvOS 5.1.0
    cpe:2.3:o:apple:tvos:5.1.0
  • Apple tvOS 5.1.1
    cpe:2.3:o:apple:tvos:5.1.1
  • Apple tvOS 5.2.0
    cpe:2.3:o:apple:tvos:5.2.0
  • Apple tvOS 6.0
    cpe:2.3:o:apple:tvos:6.0
  • Apple tvOS 6.0.1
    cpe:2.3:o:apple:tvos:6.0.1
  • Apple tvOS 6.0.2
    cpe:2.3:o:apple:tvos:6.0.2
  • Apple tvOS 6.1
    cpe:2.3:o:apple:tvos:6.1
  • Apple tvOS 6.1.1
    cpe:2.3:o:apple:tvos:6.1.1
  • Apple tvOS 6.1.2
    cpe:2.3:o:apple:tvos:6.1.2
  • Apple tvOS 6.2
    cpe:2.3:o:apple:tvos:6.2
  • Apple tvOS 6.2.1
    cpe:2.3:o:apple:tvos:6.2.1
  • Apple tvOS 7.0
    cpe:2.3:o:apple:tvos:7.0
  • Apple tvOS 7.0.1
    cpe:2.3:o:apple:tvos:7.0.1
  • Apple tvOS 7.0.3
    cpe:2.3:o:apple:tvos:7.0.3
  • Apple tvOS 7.1
    cpe:2.3:o:apple:tvos:7.1
  • Apple tvOS 9.0
    cpe:2.3:o:apple:tvos:9.0
  • Apple tvOS 9.0.1
    cpe:2.3:o:apple:tvos:9.0.1
  • Apple tvOS 9.1
    cpe:2.3:o:apple:tvos:9.1
  • Apple tvOS 9.1.1
    cpe:2.3:o:apple:tvos:9.1.1
  • Apple tvOS 9.2
    cpe:2.3:o:apple:tvos:9.2
  • Apple tvOS 9.2.1
    cpe:2.3:o:apple:tvos:9.2.1
  • Apple tvOS 9.2.2
    cpe:2.3:o:apple:tvos:9.2.2
  • Apple tvOS 10.0
    cpe:2.3:o:apple:tvos:10.0
  • Apple tvOS 10.0.1
    cpe:2.3:o:apple:tvos:10.0.1
  • Apple tvOS 10.1
    cpe:2.3:o:apple:tvos:10.1
  • Apple tvOS 10.1.1
    cpe:2.3:o:apple:tvos:10.1.1
  • Apple tvOS 10.2
    cpe:2.3:o:apple:tvos:10.2
  • Apple tvOS 10.2.1
    cpe:2.3:o:apple:tvos:10.2.1
  • Apple WebKit
    cpe:2.3:a:apple:webkit
CVSS
Base: 2.6
Impact:
Exploitability:
CWE CWE-361
CAPEC
  • Session Credential Falsification through Forging
    An attacker creates a false but functional session credential in order to gain or usurp access to a service. Session credentials allow users to identify themselves to a service after an initial authentication without needing to resend the authentication information (usually a username and password) with every message. If an attacker is able to forge valid session credentials they may be able to bypass authentication or piggy-back off some other authenticated user's session. This attack differs from Reuse of Session IDs and Session Sidejacking attacks in that in the latter attacks an attacker uses a previous or existing credential without modification while, in a forging attack, the attacker must create their own credential, although it may be based on previously observed credentials.
  • Session Fixation
    The attacker induces a client to establish a session with the target software using a session identifier provided by the attacker. Once the user successfully authenticates to the target software, the attacker uses the (now privileged) session identifier in their own transactions. This attack leverages the fact that the target software either relies on client-generated session identifiers or maintains the same session identifiers after privilege elevation.
nessus via4
  • NASL family FreeBSD Local Security Checks
    NASL id FREEBSD_PKG_0F66B901715C11E7AD1FBCAEC565249C.NASL
    description The Webkit gtk team reports : Please reference CVE/URL list for details
    last seen 2018-11-13
    modified 2018-11-10
    plugin id 101966
    published 2017-07-26
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=101966
    title FreeBSD : webkit2-gtk3 -- multiple vulnerabilities (0f66b901-715c-11e7-ad1f-bcaec565249c)
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_SAFARI10_1_2.NASL
    description The version of Apple Safari installed on the remote macOS or Mac OS X host is prior to 10.1.2. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists in the WebKit component due to improper handling of SVG filters. An unauthenticated, remote attacker can exploit this, via a timing side-channel attack, to disclose sensitive cross-domain information. (CVE-2017-7006) - An unspecified flaw exists that allows an unauthenticated, remote attacker to spoof the address bar via a specially crafted website. (CVE-2017-7011) - Multiple memory corruption issues exists in the 'WebKit Web Inspector' component due to improper validation of input. An unauthenticated, remote attacker can exploit these issues, via a specially crafted web page, to execute arbitrary code. (CVE-2017-7012) - Multiple memory corruption issues exist in the WebKit component due to improper validation of input. An unauthenticated, remote attacker can exploit these issues, via a specially crafted web page, to execute arbitrary code. (CVE-2017-7018, CVE-2017-7020, CVE-2017-7030, CVE-2017-7034, CVE-2017-7037, CVE-2017-7039, CVE-2017-7040, CVE-2017-7041, CVE-2017-7042, CVE-2017-7043, CVE-2017-7046, CVE-2017-7048, CVE-2017-7049, CVE-2017-7052, CVE-2017-7055, CVE-2017-7056, CVE-2017-7061) - A memory corruption issue exists in the 'WebKit Page Loading' component due to improper validation of input. An unauthenticated, remote attacker can exploit this, via a specially crafted web page, to execute arbitrary code. (CVE-2017-7019) - Multiple cross-site scripting (XSS) vulnerabilities exist in the WebKit component in the DOMParser due to improper validation of user-supplied input before returning it to users. An unauthenticated, remote attacker can exploit these issue, via a specially crafted URL, to execute arbitrary script code in a user's browser session. (CVE-2017-7038, CVE-2017-7059) - A denial of service vulnerability exists in the Safari Printing component. An unauthenticated, remote attacker can exploit this, via a specially crafted web page, to create an infinite number of print dialogs. (CVE-2017-7060) - An unspecified memory initialization flaw exists in WebKit. A local attacker can exploit this, via a specially crafted application, to disclose restricted memory. (CVE-2017-7064)
    last seen 2019-02-21
    modified 2018-07-14
    plugin id 101931
    published 2017-07-24
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=101931
    title macOS : Apple Safari < 10.1.2 Multiple Vulnerabilities
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-201710-14.NASL
    description The remote host is affected by the vulnerability described in GLSA-201710-14 (WebKitGTK+: Multiple Vulnerabilities) Multiple vulnerabilities have been discovered in WebkitGTK+. Please review the references below for details. Impact : A remote attacker could execute arbitrary code, cause a Denial of Service condition, bypass intended memory-read restrictions, conduct a timing side-channel attack to bypass the Same Origin Policy, obtain sensitive information, or spoof the address bar. Workaround : There is no known workaround at this time.
    last seen 2019-02-21
    modified 2018-01-26
    plugin id 103849
    published 2017-10-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=103849
    title GLSA-201710-14 : WebKitGTK+: Multiple Vulnerabilities
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2018-118.NASL
    description This update for webkit2gtk3 fixes the following issues : Update to version 2.18.5 : + Disable SharedArrayBuffers from Web API. + Reduce the precision of 'high' resolution time to 1ms. + bsc#1075419 - Security fixes: includes improvements to mitigate the effects of Spectre and Meltdown (CVE-2017-5753 and CVE-2017-5715). Update to version 2.18.4 : + Make WebDriver implementation more spec compliant. + Fix a bug when trying to remove cookies before a web process is spawned. + WebKitWebDriver process no longer links to libjavascriptcoregtk. + Fix several memory leaks in GStreamer media backend. + bsc#1073654 - Security fixes: CVE-2017-13866, CVE-2017-13870, CVE-2017-7156, CVE-2017-13856. Update to version 2.18.3 : + Improve calculation of font metrics to prevent scrollbars from being shown unnecessarily in some cases. + Fix handling of null capabilities in WebDriver implementation. + Security fixes: CVE-2017-13798, CVE-2017-13788, CVE-2017-13803. Update to version 2.18.2 : + Fix rendering of arabic text. + Fix a crash in the web process when decoding GIF images. + Fix rendering of wind in Windy.com. + Fix several crashes and rendering issues. Update to version 2.18.1 : + Improve performance of GIF animations. + Fix garbled display in GMail. + Fix rendering of several material design icons when using the web font. + Fix flickering when resizing the window in Wayland. + Prevent default kerberos authentication credentials from being used in ephemeral sessions. + Fix a crash when webkit_web_resource_get_data() is cancelled. + Correctly handle touchmove and touchend events in WebKitWebView. + Fix the build with enchant 2.1.1. + Fix the build in HPPA and Alpha. + Fix several crashes and rendering issues. + Security fixes: CVE-2017-7081, CVE-2017-7087, CVE-2017-7089, CVE-2017-7090, CVE-2017-7091, CVE-2017-7092, CVE-2017-7093, CVE-2017-7094, CVE-2017-7095, CVE-2017-7096, CVE-2017-7098, CVE-2017-7099, CVE-2017-7100, CVE-2017-7102, CVE-2017-7104, CVE-2017-7107, CVE-2017-7109, CVE-2017-7111, CVE-2017-7117, CVE-2017-7120, CVE-2017-7142. - Enable gold linker on s390/s390x on SLE15/Tumbleweed. This update was imported from the SUSE:SLE-12-SP2:Update update project.
    last seen 2019-02-21
    modified 2018-05-25
    plugin id 106549
    published 2018-02-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=106549
    title openSUSE Security Update : webkit2gtk3 (openSUSE-2018-118) (Meltdown) (Spectre)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2018-0219-1.NASL
    description This update for webkit2gtk3 fixes the following issues: Update to version 2.18.5 : + Disable SharedArrayBuffers from Web API. + Reduce the precision of 'high' resolution time to 1ms. + bsc#1075419 - Security fixes: includes improvements to mitigate the effects of Spectre and Meltdown (CVE-2017-5753 and CVE-2017-5715). Update to version 2.18.4 : + Make WebDriver implementation more spec compliant. + Fix a bug when trying to remove cookies before a web process is spawned. + WebKitWebDriver process no longer links to libjavascriptcoregtk. + Fix several memory leaks in GStreamer media backend. + bsc#1073654 - Security fixes: CVE-2017-13866, CVE-2017-13870, CVE-2017-7156, CVE-2017-13856. Update to version 2.18.3 : + Improve calculation of font metrics to prevent scrollbars from being shown unnecessarily in some cases. + Fix handling of null capabilities in WebDriver implementation. + Security fixes: CVE-2017-13798, CVE-2017-13788, CVE-2017-13803. Update to version 2.18.2 : + Fix rendering of arabic text. + Fix a crash in the web process when decoding GIF images. + Fix rendering of wind in Windy.com. + Fix several crashes and rendering issues. Update to version 2.18.1 : + Improve performance of GIF animations. + Fix garbled display in GMail. + Fix rendering of several material design icons when using the web font. + Fix flickering when resizing the window in Wayland. + Prevent default kerberos authentication credentials from being used in ephemeral sessions. + Fix a crash when webkit_web_resource_get_data() is cancelled. + Correctly handle touchmove and touchend events in WebKitWebView. + Fix the build with enchant 2.1.1. + Fix the build in HPPA and Alpha. + Fix several crashes and rendering issues. + Security fixes: CVE-2017-7081, CVE-2017-7087, CVE-2017-7089, CVE-2017-7090, CVE-2017-7091, CVE-2017-7092, CVE-2017-7093, CVE-2017-7094, CVE-2017-7095, CVE-2017-7096, CVE-2017-7098, CVE-2017-7099, CVE-2017-7100, CVE-2017-7102, CVE-2017-7104, CVE-2017-7107, CVE-2017-7109, CVE-2017-7111, CVE-2017-7117, CVE-2017-7120, CVE-2017-7142. - Enable gold linker on s390/s390x on SLE15/Tumbleweed. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 106370
    published 2018-01-26
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=106370
    title SUSE SLED12 / SLES12 Security Update : webkit2gtk3 (SUSE-SU-2018:0219-1) (Meltdown) (Spectre)
refmap via4
bid 99886
confirm
gentoo GLSA-201710-14
sectrack 1038950
Last major update 20-07-2017 - 12:29
Published 20-07-2017 - 12:29
Last modified 25-03-2019 - 12:29
Back to Top