CVE-2007-3944
Multiple heap-based buffer overflows in the Perl Compatible Regular Expressions (PCRE) library in the JavaScript engine in WebKit in Apple Safari 3 Beta before Update 3.0.3, and iPhone before 1.0.1, allow remote attackers to execute arbitrary code via…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (6.53%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Multiple heap-based buffer overflows in the Perl Compatible Regular Expressions (PCRE) library in the JavaScript engine in WebKit in Apple Safari 3 Beta before Update 3.0.3, and iPhone before 1.0.1, allow remote attackers to execute arbitrary code via certain JavaScript regular expressions. NOTE: this issue was originally reported only for MobileSafari on the iPhone. NOTE: it is not clear whether this stems from an issue in the original distribution of PCRE, which might already have a separate CVE identifier.
- CVSS 2.0
- 9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C
- EPSS
- 6.53% probability · 93th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-119
- Affected
- apple/safari · apple/webkit · apple/iphone os
- Source
- cve@mitre.org
References
- http://docs.info.apple.com/article.html?artnum=306173
- http://docs.info.apple.com/article.html?artnum=306174
- http://secunia.com/advisories/26287Vendor Advisory
- http://www.nytimes.com/2007/07/23/technology/23iphone.html?_r=1&adxnnl=1&adxnnlx=1185163364-1OTsRJvbylLamj17FY2wnw&oref=slogin
- http://www.securityevaluators.com/iphone/
- http://www.securityevaluators.com/iphone/exploitingiphone.pdf
- http://www.securityfocus.com/bid/25002
- http://www.securitytracker.com/id?1018439
- http://www.vupen.com/english/advisories/2007/2730Vendor Advisory
- http://www.vupen.com/english/advisories/2007/2731Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/35577
- http://docs.info.apple.com/article.html?artnum=306173
- http://docs.info.apple.com/article.html?artnum=306174
- http://secunia.com/advisories/26287Vendor Advisory
- http://www.nytimes.com/2007/07/23/technology/23iphone.html?_r=1&adxnnl=1&adxnnlx=1185163364-1OTsRJvbylLamj17FY2wnw&oref=slogin
- http://www.securityevaluators.com/iphone/
- http://www.securityevaluators.com/iphone/exploitingiphone.pdf
- http://www.securityfocus.com/bid/25002
- http://www.securitytracker.com/id?1018439
- http://www.vupen.com/english/advisories/2007/2730Vendor Advisory
- http://www.vupen.com/english/advisories/2007/2731Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/35577
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.