CVE-2017-2445
An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10...
CVE-2017-2445 is a medium vulnerability (CVSS 6.1) in Apple Safari, published April 1, 2017. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 4.27%, the 91st percentile. Fixed in webkit2gtk 2.16.3-2.
- Severity
- 6.1 MediumCVSS 3.0, NVD
- Exploit chance
- 4.27%EPSS, 91st percentile
- Exploitation
- None known1 public exploit
- Fixed in
2.16.3-2webkit2gtk +13 more
Description
An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via crafted frame objects.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
webkit2gtkDebian:12 | before 2.16.3-2 | 2.16.3-2 |
webkit2gtkDebian:13 | before 2.16.3-2 | 2.16.3-2 |
webkit2gtkDebian:14 | before 2.16.3-2 | 2.16.3-2 |
webkit2gtkUbuntu:16.04:LTS | before 2.16.1-0ubuntu0.16.04.1, plus listed versions 2.8.5+dfsg1-32.10.3+dfsg1-12.10.4+dfsg1-12.10.5-12.10.6-1 Show 7 moreShow less2.10.6-1ubuntu12.10.8-1ubuntu12.10.9-1ubuntu12.12.5-0ubuntu0.16.04.12.14.2-0ubuntu0.16.04.12.14.3-0ubuntu0.16.04.12.14.5-0ubuntu0.16.04.1 | 2.16.1-0ubuntu0.16.04.1 |
qtwebkit-opensource-srcUbuntu:16.04:LTS | All versions, plus listed versions 5.4.2+dfsg-1ubuntu2.15.5.1+dfsg-2ubuntu1 | None known |
qtwebkit-sourceUbuntu:16.04:LTS | All versions, plus listed versions 2.3.2-0ubuntu102.3.2-0ubuntu11 | None known |
webkitgtkUbuntu:16.04:LTS | All versions, plus listed versions 2.4.9-2ubuntu22.4.10-0ubuntu12.4.11-0ubuntu0.1 | None known |
qtwebkit-opensource-srcUbuntu:18.04:LTS | All versions, plus listed versions 5.9.1+dfsg-5ubuntu15.9.1+dfsg-5ubuntu35.212.0~alpha2-5build25.212.0~alpha2-5build45.212.0~alpha2-75.212.0~alpha2-7build25.212.0~alpha2-7ubuntu1 | None known |
qtwebkit-sourceUbuntu:18.04:LTS | All versions, plus listed versions 2.3.2-0ubuntu13 | None known |
webkitgtkUbuntu:18.04:LTS | All versions, plus listed versions 2.4.11-32.4.11-3ubuntu22.4.11-3ubuntu3 | None known |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
qtwebkit-opensource-srcUbuntu:20.04:LTS | All versions, plus listed versions 5.212.0~alpha3-35.212.0~alpha3-55.212.0~alpha3-65.212.0~alpha3-75.212.0~alpha4-15.212.0~alpha4-1ubuntu15.212.0~alpha4-1ubuntu25.212.0~alpha4-1ubuntu2.1 | None known |
qtwebkit-opensource-srcUbuntu:22.04:LTS | All versions, plus listed versions 5.212.0~alpha4-125.212.0~alpha4-135.212.0~alpha4-145.212.0~alpha4-14build15.212.0~alpha4-14ubuntu25.212.0~alpha4-15ubuntu1 | None known |
qtwebkit-opensource-srcUbuntu:24.04:LTS | All versions, plus listed versions 5.212.0~alpha4-335.212.0~alpha4-33build15.212.0~alpha4-345.212.0~alpha4-34ubuntu35.212.0~alpha4-34ubuntu45.212.0~alpha4-36 | None known |
webkit2gtkUbuntu:16.04:LTS From an advisory covering 34 CVEs | before 2.16.1-0ubuntu0.16.04.1, plus listed versions 2.8.5+dfsg1-32.10.3+dfsg1-12.10.4+dfsg1-12.10.5-12.10.6-1 Show 7 moreShow less2.10.6-1ubuntu12.10.8-1ubuntu12.10.9-1ubuntu12.12.5-0ubuntu0.16.04.12.14.2-0ubuntu0.16.04.12.14.3-0ubuntu0.16.04.12.14.5-0ubuntu0.16.04.1 | 2.16.1-0ubuntu0.16.04.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Apple WebKit 10.0.2 (12602.3.12.0.1) - 'disconnectSubframes' Universal Cross-Site Scripting | 2017-04-04 |
What each source reports
NVD Score used
An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via crafted frame objects.
- Record
CVE-2017-2445- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE ListNo score
An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via crafted frame objects.
- Record
CVE-2017-2445- Updated
- 2026-11-02
EUVDEUVD-2017-11628No score
An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via crafted frame objects.
- Record
EUVD-2017-11628- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5wgh-fpph-9qhm
An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10...
An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via crafted frame objects.
- Record
GHSA-5wgh-fpph-9qhm- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via crafted frame objects.
- Record
CVE-2017-2445- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-2445
An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via crafted frame objects.
- Record
DEBIAN-CVE-2017-2445- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-2445
An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via crafted frame objects.
- Record
UBUNTU-CVE-2017-2445- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVUSN-3257-1No score
webkit2gtk vulnerabilities
A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary code execution.
- Record
USN-3257-1- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
securitytracker.com/id/1038137
support.apple.com/HT207601
securityfocus.com/bid/97130
security.gentoo.org/glsa/201706-15
Show 41 moreShow less
exploit-db.com/exploits/41802
nvd.nist.gov/vuln/detail/CVE-2017-2445
github.com/advisories/GHSA-5wgh-fpph-9qhm
security-tracker.debian.org/tracker/CVE-2017-2445
ubuntu.com/security/CVE-2017-2445
webkitgtk.org/security/WSA-2017-0003.html
cve.org/CVERecord?id=CVE-2017-2445