Every CVE Search/ Get API key

CVE-2017-7038

A DOMParser XSS issue was discovered in certain Apple products. iOS before 10.3.3 is affected....

6.1 MediumPublic exploitFix available

A DOMParser XSS issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit" component.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

2.91%Up 1.9 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 6.1

A DOMParser XSS issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit" component.

Record
CVE-2017-7038
CVSS 3.0
6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness
CWE-79
Updated
2026-11-02
CVE List No score

A DOMParser XSS issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit" component.

Record
CVE-2017-7038
Updated
2026-11-02
EUVDEUVD-2017-16076 No score

A DOMParser XSS issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit" component.

Record
EUVD-2017-16076
Updated
2026-11-03
GitHub AdvisoriesGHSA-rfrj-gh87-vc65 6.1

A DOMParser XSS issue was discovered in certain Apple products. iOS before 10.3.3 is affected....

A DOMParser XSS issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit" component.

Record
GHSA-rfrj-gh87-vc65
CVSS 3.0
6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV 6.1

A DOMParser XSS issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit" component.

Record
CVE-2017-7038
CVSS 3.0
6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2017-7038 6.1

A DOMParser XSS issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit" component.

Record
DEBIAN-CVE-2017-7038
CVSS 3.0
6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2017-7038 6.1

A DOMParser XSS issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit" component.

Record
UBUNTU-CVE-2017-7038
CVSS 3.0
6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVSUSE-SU-2018:0219-1 No score

Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues:

Update to version 2.18.5:

  • Disable SharedArrayBuffers from Web API.
  • Reduce the precision of 'high' resolution time to 1ms.
  • bsc#1075419 - Security fixes: includes improvements to mitigate the effects of Spectre and Meltdown (CVE-2017-5753 and CVE-2017-5715).

Update to version 2.18.4:

  • Make WebDriver implementation more spec compliant.
  • Fix a bug when trying to remove cookies before a web process is spawned.
  • WebKitWebDriver process no longer links to libjavascriptcoregtk.
  • Fix several memory leaks in GStreamer media backend.
  • bsc#1073654 - Security fixes: CVE-2017-13866, CVE-2017-13870, CVE-2017-7156, CVE-2017-13856.

Update to version 2.18.3:

  • Improve calculation of font metrics to prevent scrollbars from being shown unnecessarily in some cases.
  • Fix handling of null capabilities in WebDriver implementation.
  • Security fixes: CVE-2017-13798, CVE-2017-13788, CVE-2017-13803.

Update to version 2.18.2:

  • Fix rendering of arabic text.
  • Fix a crash in the web process when decoding GIF images.
  • Fix rendering of wind in Windy.com.
  • Fix several crashes and rendering issues.

Update to version 2.18.1:

  • Improve performance of GIF animations.
  • Fix garbled display in GMail.
  • Fix rendering of several material design icons when using the web font.
  • Fix flickering when resizing the window in Wayland.
  • Prevent default kerberos authentication credentials from being used in ephemeral sessions.
  • Fix a crash when webkit_web_resource_get_data() is cancelled.
  • Correctly handle touchmove and touchend events in WebKitWebView.
  • Fix the build with enchant 2.1.1.
  • Fix the build in HPPA and Alpha.
  • Fix several crashes and rendering issues.
  • Security fixes: CVE-2017-7081, CVE-2017-7087, CVE-2017-7089, CVE-2017-7090, CVE-2017-7091, CVE-2017-7092, CVE-2017-7093, CVE-2017-7094, CVE-2017-7095, CVE-2017-7096, CVE-2017-7098, CVE-2017-7099, CVE-2017-7100, CVE-2017-7102, CVE-2017-7104, CVE-2017-7107, CVE-2017-7109, CVE-2017-7111, CVE-2017-7117, CVE-2017-7120, CVE-2017-7142.
  • Enable gold linker on s390/s390x on SLE15/Tumbleweed.
Record
SUSE-SU-2018:0219-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
webkit2gtk
Debian:12
 before 2.16.3-2
2.16.3-2
webkit2gtk
Debian:13
 before 2.16.3-2
2.16.3-2
webkit2gtk
Debian:14
 before 2.16.3-2
2.16.3-2
webkit2gtk3
SUSE:Linux Enterprise Desktop 12 SP2
 before 2.18.5-2.18.1
2.18.5-2.18.1
webkit2gtk3
SUSE:Linux Enterprise Desktop 12 SP3
 before 2.18.5-2.18.1
2.18.5-2.18.1
webkit2gtk3
SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2
 before 2.18.5-2.18.1
2.18.5-2.18.1
webkit2gtk3
SUSE:Linux Enterprise Software Development Kit 12 SP2
 before 2.18.5-2.18.1
2.18.5-2.18.1
webkit2gtk3
SUSE:Linux Enterprise Software Development Kit 12 SP3
 before 2.18.5-2.18.1
2.18.5-2.18.1
webkit2gtk3
SUSE:Linux Enterprise Server 12 SP2
 before 2.18.5-2.18.1
2.18.5-2.18.1
webkit2gtk3
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
 before 2.18.5-2.18.1
2.18.5-2.18.1
Show 13 moreShow less
Affected packages
PackageAffectedFixed
webkit2gtk3
SUSE:Linux Enterprise Server 12 SP3
 before 2.18.5-2.18.1
2.18.5-2.18.1
webkit2gtk3
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
 before 2.18.5-2.18.1
2.18.5-2.18.1
webkit2gtk3
SUSE:Linux Enterprise Workstation Extension 12 SP2
 before 2.18.5-2.18.1
2.18.5-2.18.1
webkit2gtk3
SUSE:Linux Enterprise Workstation Extension 12 SP3
 before 2.18.5-2.18.1
2.18.5-2.18.1
qtwebkit-opensource-src
Ubuntu:16.04:LTS
 All versions, plus listed versions
5.4.2+dfsg-1ubuntu2.15.5.1+dfsg-2ubuntu1
 None known
qtwebkit-source
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.3.2-0ubuntu102.3.2-0ubuntu11
 None known
webkitgtk
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.4.9-2ubuntu22.4.10-0ubuntu12.4.11-0ubuntu0.1
 None known
qtwebkit-opensource-src
Ubuntu:18.04:LTS
 All versions, plus listed versions
5.9.1+dfsg-5ubuntu15.9.1+dfsg-5ubuntu35.212.0~alpha2-5build25.212.0~alpha2-5build45.212.0~alpha2-75.212.0~alpha2-7build25.212.0~alpha2-7ubuntu1
 None known
qtwebkit-source
Ubuntu:18.04:LTS
 All versions, plus listed versions
2.3.2-0ubuntu13
 None known
webkitgtk
Ubuntu:18.04:LTS
 All versions, plus listed versions
2.4.11-32.4.11-3ubuntu22.4.11-3ubuntu3
 None known
qtwebkit-opensource-src
Ubuntu:20.04:LTS
 All versions, plus listed versions
5.212.0~alpha3-35.212.0~alpha3-55.212.0~alpha3-65.212.0~alpha3-75.212.0~alpha4-15.212.0~alpha4-1ubuntu15.212.0~alpha4-1ubuntu25.212.0~alpha4-1ubuntu2.1
 None known
qtwebkit-opensource-src
Ubuntu:22.04:LTS
 All versions, plus listed versions
5.212.0~alpha4-125.212.0~alpha4-135.212.0~alpha4-145.212.0~alpha4-14build15.212.0~alpha4-14ubuntu25.212.0~alpha4-15ubuntu1
 None known
qtwebkit-opensource-src
Ubuntu:24.04:LTS
 All versions, plus listed versions
5.212.0~alpha4-335.212.0~alpha4-33build15.212.0~alpha4-345.212.0~alpha4-34ubuntu35.212.0~alpha4-34ubuntu45.212.0~alpha4-36
 None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubansjdnakjdnajkd/CVE-2017-70382017-12-06

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-7038 is a medium vulnerability (CVSS 6.1) in Apple Safari, published July 20, 2017. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.91%, the 87th percentile. Fixed in webkit2gtk 2.16.3-2.

References

Show 103 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open