CVE-2017-7038

Vulnerability

A DOM parser cross-site scripting (XSS) issue exists in the WebKit component of certain Apple products. It affects iOS versions before 10.3.3, Safari versions before 10.1.2, and tvOS versions before 10.2.2 [1][2][3]. The vulnerability can be triggered when the browser parses maliciously crafted web content, leading to unexpected behavior.

Exploitation

An attacker must trick the user into visiting a malicious website or serving compromised web content that exploits the DOM parsing flaw. No further authentication or special network position is required beyond standard web browsing [1][2][3]. The exact attack vector involves the DOMParser API mishandling certain input, allowing script injection.

Impact

Successful exploitation may cause unexpected application termination or arbitrary code execution, potentially leading to full compromise of the affected device [1][2]. The impact ranges from denial of service to arbitrary code execution depending on the targeted product and version.

Mitigation

Apple released fixes with iOS 10.3.3, Safari 10.1.2, and tvOS 10.2.2 on July 19, 2017 [1][2][3]. Users should update to these or later versions. For WebKitGTK+ users on Linux, Gentoo's GLSA advises upgrading to at least version 2.16.6 [4].