CVE Vulnerabilities

CVE-2017-2463

Use After Free

Published: Apr 02, 2017 | Modified: Apr 20, 2025
CVSS 3.x
8.8
HIGH
Source:
NVD
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.x
6.8 MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:P
RedHat/V2
RedHat/V3
Ubuntu
MEDIUM

An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. iCloud before 6.2 on Windows is affected. iTunes before 12.6 on Windows is affected. tvOS before 10.2 is affected. The issue involves the WebKit component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.

Weakness

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory “belongs” to the code that operates on the new pointer.

Affected Software

Name Vendor Start Version End Version
Icloud Apple * 6.2 (excluding)
Itunes Apple * 12.6 (excluding)
Qtwebkit Ubuntu eoan *
Qtwebkit-opensource-src Ubuntu artful *
Qtwebkit-opensource-src Ubuntu bionic *
Qtwebkit-opensource-src Ubuntu cosmic *
Qtwebkit-opensource-src Ubuntu devel *
Qtwebkit-opensource-src Ubuntu disco *
Qtwebkit-opensource-src Ubuntu eoan *
Qtwebkit-opensource-src Ubuntu esm-apps/bionic *
Qtwebkit-opensource-src Ubuntu esm-apps/focal *
Qtwebkit-opensource-src Ubuntu esm-apps/jammy *
Qtwebkit-opensource-src Ubuntu esm-apps/noble *
Qtwebkit-opensource-src Ubuntu esm-infra/xenial *
Qtwebkit-opensource-src Ubuntu focal *
Qtwebkit-opensource-src Ubuntu groovy *
Qtwebkit-opensource-src Ubuntu hirsute *
Qtwebkit-opensource-src Ubuntu impish *
Qtwebkit-opensource-src Ubuntu jammy *
Qtwebkit-opensource-src Ubuntu kinetic *
Qtwebkit-opensource-src Ubuntu lunar *
Qtwebkit-opensource-src Ubuntu mantic *
Qtwebkit-opensource-src Ubuntu noble *
Qtwebkit-opensource-src Ubuntu trusty *
Qtwebkit-opensource-src Ubuntu upstream *
Qtwebkit-opensource-src Ubuntu xenial *
Qtwebkit-opensource-src Ubuntu yakkety *
Qtwebkit-opensource-src Ubuntu zesty *
Qtwebkit-source Ubuntu artful *
Qtwebkit-source Ubuntu bionic *
Qtwebkit-source Ubuntu cosmic *
Qtwebkit-source Ubuntu disco *
Qtwebkit-source Ubuntu esm-apps/bionic *
Qtwebkit-source Ubuntu esm-apps/xenial *
Qtwebkit-source Ubuntu precise *
Qtwebkit-source Ubuntu trusty *
Qtwebkit-source Ubuntu xenial *
Qtwebkit-source Ubuntu yakkety *
Qtwebkit-source Ubuntu zesty *
Webkit Ubuntu precise *
Webkitgtk Ubuntu artful *
Webkitgtk Ubuntu bionic *
Webkitgtk Ubuntu cosmic *
Webkitgtk Ubuntu esm-apps/bionic *
Webkitgtk Ubuntu esm-apps/xenial *
Webkitgtk Ubuntu trusty *
Webkitgtk Ubuntu xenial *
Webkitgtk Ubuntu yakkety *
Webkitgtk Ubuntu zesty *

Potential Mitigations

References