^{CVE-2017-13884:}WebKit Memory Corruption Vulnerability in Apple Products (CVE-2017-13884)

Overview

This vulnerability (CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer) affects the WebKit browser engine used across multiple Apple products. When exploited, an attacker can create a specially crafted website that, when visited by a victim, could trigger memory corruption in WebKit. This corruption could lead to arbitrary code execution within the context of the affected application or cause the application to crash, resulting in denial of service. The vulnerability impacts a wide range of Apple's ecosystem, including mobile devices, desktop browsers, and media applications on both Apple and Windows platforms.

Remediation

Users should update their devices and applications to the following versions or later:

• iOS: Update to version 11.2 or later
• Safari: Update to version 11.0.2 or later
• iCloud for Windows: Update to version 7.2 or later
• iTunes for Windows: Update to version 12.7.2 or later
• tvOS: Update to version 11.2 or later
• watchOS: Update to version 4.2 or later

Updates can be installed through the standard update mechanisms for each product:

• iOS devices: Settings > General > Software Update
• Safari: Apple menu > App Store > Updates
• iCloud/iTunes for Windows: Open the application and check for updates or download the latest version from Apple's website
• Apple TV: Settings > System > Software Updates
• Apple Watch: Using the Watch app on a paired iPhone

References

1. Apple Security Updates for iOS 11.2: https://support.apple.com/HT208324
2. Apple Security Updates for Safari 11.0.2: https://support.apple.com/HT208325
3. Apple Security Updates for iCloud 7.2 for Windows: https://support.apple.com/HT208326
4. Apple Security Updates for iTunes 12.7.2 for Windows: https://support.apple.com/HT208327
5. Apple Security Updates for tvOS 11.2: https://support.apple.com/HT208328
6. Apple Security Updates for watchOS 4.2: https://support.apple.com/HT208334
7. Ubuntu Security Notice USN-3551-1: https://usn.ubuntu.com/3551-1/