An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. The issue involves bookmark creation in the "WebKit" component. It allows remote attackers to execute arbitrary code or spoof a bookmark by leveraging mishandling of links during drag-and-drop actions.

The version of Apple Safari installed on the remote macOS or Mac OS X host is prior to 10.1. It is, therefore, affected by multiple vulnerabilities:

  - An out-of-bounds read error exists in WebKit when     handling certain JavaScript code. An unauthenticated,     remote attacker can exploit this to cause a denial of     service condition or the disclosure of memory contents.
    (CVE-2016-9642)

  - A denial of service vulnerability exists in WebKit when     handling certain regular expressions. An     unauthenticated, remote attacker can exploit this, via a     specially crafted web page, to exhaust available memory     resources. (CVE-2016-9643)

  - Multiple information disclosure vulnerabilities exist     in WebKit when handling page loading due to improper     validation of certain input. An unauthenticated, remote     attacker can exploit these to disclose data     cross-origin. (CVE-2017-2364, CVE-2017-2367)

  - An unspecified state management flaw exists that allows     an unauthenticated, remote attacker to spoof the address     bar. (CVE-2017-2376)

  - A denial of service vulnerability exists in the Web     Inspector component when closing a window while the     debugger is paused. An unauthenticated, remote attacker     can exploit this to terminate the application.
    (CVE-2017-2377)

  - An unspecified flaw exists in WebKit when creating     bookmarks using drag-and-drop due to improper validation     of certain input. An unauthenticated, remote attacker     can exploit this, via a specially crafted link, to spoof     bookmarks or potentially execute arbitrary code.
    (CVE-2017-2378)

  - An information disclosure vulnerability exists in the     Login AutofFill component that allows a local attacker     to access keychain items. (CVE-2017-2385)

  - Multiple information disclosure vulnerabilities exist     in WebKit when handling unspecified exceptions or     elements. An unauthenticated, remote attacker can     exploit these, via specially crafted web content, to     disclose data cross-origin. (CVE-2017-2386,     CVE-2017-2479, CVE-2017-2480)

  - An unspecified flaw exists in the handling of HTTP     authentication that allows an unauthenticated, remote     attacker to disclose authentication sheets on arbitrary     websites or cause a denial of service condition.
    (CVE-2017-2389)

  - Multiple memory corruption issues exist in WebKit that     allow an unauthenticated, remote attacker to cause a     denial of service condition or the execution of     arbitrary code. (CVE-2017-2394, CVE-2017-2395,     CVE-2017-2396, CVE-2017-2433, CVE-2017-2454,     CVE-2017-2455, CVE-2017-2459, CVE-2017-2460,     CVE-2017-2464, CVE-2017-2465, CVE-2017-2466,     CVE-2017-2468, CVE-2017-2469, CVE-2017-2470,     CVE-2017-2476)

  - A memory corruption issue exists in WebKit within the     Web Inspector component due to improper validation of     certain input. An unauthenticated, remote attacker can     exploit this to cause a denial of service condition or     the execution of arbitrary code. (CVE-2017-2405)

  - An unspecified type confusion error exists that allows     an unauthenticated remote attacker to execute arbitrary     code by using specially crafted web content.
    (CVE-2017-2415)

  - A security bypass vulnerability exists in WebKit that     allows an unauthenticated, remote attacker to bypass the     Content Security Policy by using specially crafted web     content. (CVE-2017-2419)

  - An unspecified flaw exists in WebKit when handling     OpenGL shaders that allows an unauthenticated, remote     attacker to disclose process memory content by using     specially crafted web content. (CVE-2017-2424)

  - An information disclosure vulnerability exists in WebKit     JavaScript Bindings when handling page loading due to     unspecified logic flaws. An unauthenticated, remote     attacker can exploit this, via specially crafted web     content, to disclose data cross-origin. (CVE-2017-2442)

  - A memory corruption issue exists in WebKit within the     CoreGraphics component due to improper validation of     certain input. An unauthenticated, remote attacker can     exploit this, via specially crafted web content, to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2017-2444)

  - A universal cross-site scripting (XSS) vulnerability     exists in WebKit when handling frame objects due to     improper validation of certain input. An     unauthenticated, remote attacker can exploit this, via     specially crafted web content, to execute arbitrary     script code in a user's browser session. (CVE-2017-2445)

  - A flaw exists in WebKit due to non-strict mode functions     that are called from built-in strict mode scripts not     being properly restricted from calling sensitive native     functions. An unauthenticated, remote attacker can     exploit this, via specially crafted web content, to     execute arbitrary code. (CVE-2017-2446)

  - An out-of-bounds read error exists in WebKit when     handling the bound arguments array of a bound function.
    An unauthenticated, remote attacker can exploit this,     via specially crafted web content, to disclose memory     contents. (CVE-2017-2447)

  - An unspecified flaw exists in FaceTime prompt handling     due to improper validation of certain input. An     unauthenticated, remote attacker can exploit this to     spoof user interface elements. (CVE-2017-2453)

  - A use-after-free error exists in WebKit when handling     RenderBox objects. An unauthenticated, remote attacker     can exploit this, via specially crafted web content, to     dereference already freed memory, resulting in the     execution of arbitrary code. (CVE-2017-2463)

  - An unspecified use-after-free error exists in WebKit     that allows an unauthenticated, remote attacker, via     specially crafted web content, to dereference already     freed memory, resulting in the execution of arbitrary     code. (CVE-2017-2471)

  - A universal cross-site scripting (XSS) vulnerability     exists in WebKit when handling frames due to improper     validation of certain input. An unauthenticated, remote     attacker can exploit this, via specially crafted web     content, to execute arbitrary script code in a user's     browser session. (CVE-2017-2475)

  - A use-after-free error exists in WebKit when handling     ElementData objects. An unauthenticated, remote attacker     can exploit this, via specially crafted web content, to     dereference already freed memory, resulting in the     execution of arbitrary code. (CVE-2017-2481)

  - A use-after-free error exists in JavaScriptCore when     handling the String.replace() method. An     unauthenticated, remote attacker can exploit this to     deference already freed memory, resulting in the     execution of arbitrary code. (CVE-2017-2491)

  - A universal cross-site scripting (XSS) vulnerability     exists in JavaScriptCore due to an unspecified prototype     flaw. An unauthenticated, remote attacker can exploit     this, via a specially crafted web page, to execute     arbitrary code in a user's browser session.
    (CVE-2017-2492)

The version of Apple iOS running on the mobile device is prior to 10.3. It is, therefore, affected by multiple vulnerabilities in multiple components, the majority of which are remote code execution vulnerabilities. An unauthenticated, remote attacker can exploit these remote code execution vulnerabilities by convincing a user to visit a specially crafted website, resulting in the execution of arbitrary code in the context of the current user. The affected components are as follows :

  - Accounts
  - Audio
  - Carbon
  - CoreGraphics
  - CoreText
  - DataAccess
  - FontParser
  - HomeKit
  - HTTPProtocol
  - ImageIO
  - iTunes Store
  - JavaScriptCore
  - Kernel
  - Keyboards
  - libarchive
  - libc++abi
  - libxslt
  - Pasteboard
  - Phone
  - Profiles
  - Quick Look
  - Safari
  - Safari Reader
  - SafariViewController
  - Security
  - Siri
  - WebKit
  - WebKit JavaScript Bindings
  - WebKit Web Inspector

The version of iOS running on the mobile device is prior to 10.3, and is affected by multiple vulnerabilities :

 - An unspecified state management flaw exists that may allow a context-dependent attacker to spoof the address bar. No further details have been provided. (CVE-2017-2376)
 - An unspecified flaw exists in the handling of HTTP authentication. This may allow a context-dependent attacker to display authentication sheets on arbitrary web sites and cause a denial of service. (CVE-2017-2389)
 - A flaw exists in the password-protected PDF export feature that is triggered as a weak encryption algorithm is used. This may allow an attacker with access to a password-protected document to potentially disclose the document content. (CVE-2017-2391)
 - A flaw exists in the 'SecKeyRawVerify()' function that is triggered as parameters are not properly validated during the handling of cryptographic API calls. This may allow a remote attacker to have an empty signature be accepted as valid. (CVE-2017-2423)

Additional flaws exist in the following components :

 - Carbon (CVE-2017-2379)
 - CoreGraphics (CVE-2017-2417)
 - DataAccess (CVE-2017-2414)
 - FontParser (CVE-2017-2406, CVE-2017-2407)
 - iCloud (CVE-2017-2397)
 - ImageIO (CVE-2017-2416)
 - iTunes Store (CVE-2017-2412)
 - Kernel (CVE-2017-2398, CVE-2017-2401, CVE-2017-2490)
 - libarchive (CVE-2017-2390)
 - Pasteboard (CVE-2017-2399)
 - Quick Look (CVE-2017-2404)
 - Safari (CVE-2017-2384, CVE-2017-2393, CVE-2017-2400)
 - Webkit (CVE-2017-2367, CVE-2017-2378, CVE-2017-2386, CVE-2017-2394, CVE-2017-2395, CVE-2017-2396, CVE-2017-2405, CVE-2017-2415, CVE-2017-2419, CVE-2017-2424, CVE-2017-2433, CVE-2017-2442, CVE-2017-2445, CVE-2017-2446, CVE-2017-2447, CVE-2017-2454, CVE-2017-2455, CVE-2017-2459, CVE-2017-2460, CVE-2017-2464, CVE-2017-2465, CVE-2017-2466, CVE-2017-2468, CVE-2017-2469, CVE-2017-2470, CVE-2017-2471, CVE-2017-2476, CVE-2017-2481)

Versions of Safari prior to 10.1 are affected by multiple vulnerabilities :

 - An unspecified state management flaw exists that may allow a context-dependent attacker to spoof the address bar. No further details have been provided. (CVE-2017-2376)
 - An unspecified flaw exists in the handling of HTTP authentication. This may allow a context-dependent attacker to display authentication sheets on arbitrary web sites and cause a denial of service. (CVE-2017-2389)

Additional flaws exist in the following components :

 - AutofFill (CVE-2017-2385)
 - CoreGraphics (CVE-2017-2444)
 - FaceTime (2017-2453)
 - Kernel (CVE-2017-2490)
 - Webkit (CVE-2017-2367, CVE-2017-2378, CVE-2017-2386, CVE-2017-2394, CVE-2017-2395, CVE-2017-2396, CVE-2017-2405, CVE-2017-2415, CVE-2017-2419, CVE-2017-2424, CVE-2017-2433, CVE-2017-2442, CVE-2017-2445, CVE-2017-2446, CVE-2017-2447, CVE-2017-2454, CVE-2017-2455, CVE-2017-2459, CVE-2017-2460, CVE-2017-2464, CVE-2017-2465, CVE-2017-2466, CVE-2017-2468, CVE-2017-2469, CVE-2017-2470, CVE-2017-2471, CVE-2017-2476, CVE-2017-2481)

ID	Name	Product	Family	Severity
99167	macOS : Apple Safari < 10.1 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high
99127	Apple iOS < 10.3 Multiple Vulnerabilities	Nessus	Mobile Devices	critical
700034	Apple iOS < 10.3 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	high
700033	Safari < 10.1 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high

Detections

Analytics

CVE-2017-2378

high

Tenable Plugins

high

critical

high

high