CVE-2017-7161 Command injection in n/a
Remote attackers can execute arbitrary code in Apple Safari via command injection in the Web Inspector component.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2017-7161?
CVE-2017-7161 is a high-severity command injection vulnerability in Apple Safari, published on 3 Apr 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
An issue was discovered in certain Apple products. Safari before 11.0.2 is affected. The issue involves the "WebKit Web Inspector" component. It allows remote attackers to execute arbitrary code via special characters that trigger command injection.
Weakness: CWE-77
Which versions are affected by CVE-2017-7161?
It affects 2 products.
Products include Apple Safari, Canonical Ubuntu Linux.
How do I fix CVE-2017-7161?
Upgrade to a fixed version.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2017-7161 being exploited?
There is no known exploitation of CVE-2017-7161 in the wild and no public exploit code.
Other vulnerabilities in Apple Safari
Sources
Also known as DEBIAN-CVE-2017-7161, GHSA-fqwp-42q8-85r2, UBUNTU-CVE-2017-7161.