CVE-2017-17821 Memory corruption in n/a
Remote attackers can cause denial of service or potentially execute code via a buffer overflow in WebKit's FastBitVector implementation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-17821?
CVE-2017-17821 is a critical memory corruption vulnerability in Apple Safari, published on 21 Dec 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
WTF/wtf/FastBitVector.h in WebKit, as distributed in Safari Technology Preview Release 46, allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact because it calls the FastBitVectorWordOwner::resizeSlow function (in WTF/wtf/FastBitVector.cpp) for a purpose other than initializing a bitvector size, and resizeSlow mishandles cases where the old array length is greater than the new array length.
Weakness: CWE-119
Which versions are affected by CVE-2017-17821?
It affects 1 product.
Products include Apple Safari.
How do I fix CVE-2017-17821?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2017-17821 being exploited?
There is no known exploitation of CVE-2017-17821 in the wild and no public exploit code.
Other vulnerabilities in Apple Safari
Sources
Also known as DEBIAN-CVE-2017-17821, GHSA-353g-x49j-hjg7, UBUNTU-CVE-2017-17821.