CVE-2017-5949 JavaScriptCore in WebKit, as distributed in Safari Technology Preview Release 22, allows remote attackers to cause a denial of service (heap-based out-of-bounds write and application crash) or possibl...
CriticalCVSS 9.8
EPSS 1.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
JavaScriptCore in WebKit, as distributed in Safari Technology Preview Release 22, allows remote attackers to cause a denial of service (heap-based out-of-bounds write and application crash) or possibly have unspecified other impact via crafted JavaScript code that triggers access to red-zone memory locations, related to jit/ThunkGenerators.cpp, llint/LowLevelInterpreter32_64.asm, and llint/LowLevelInterpreter64.asm.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apple Safari | = 22 | No fix listed |
| ubuntu/qtwebkit-opensource-src(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/qtwebkit-opensource-src(Ubuntu:22.04) | All versions | No fix listed |
References
- Ubuntu CVE tracker vendor-advisory
- www.cve.org
- 97298 third-party-advisory vdb-entry
- bugs.webkit.org issue-tracking third-party-advisory
- trac.webkit.org issue-tracking third-party-advisory