CVE-2016-9642

What it actually does

Out-of-bounds heap read in JavaScriptCore causes a denial-of-service crash when processing a crafted JavaScript file.

Why it matters to the business

Applications or browsers using the affected WebKit engine can be crashed by malicious scripts, leading to service disruption and loss of availability for users who open untrusted content.

How an attack unfolds

An attacker creates a specially crafted JavaScript file that triggers an out-of-bounds read during parsing or execution in JavaScriptCore; the victim is tricked into opening the file locally or via a web page, resulting in an application crash.

How to fix it

Upgrade WebKit to a version released after February 2017 that resolves the heap-read issue; where updates are unavailable, sandbox or restrict execution of untrusted JavaScript.

How to confirm the fix worked

Confirm the WebKit version is newer than the vulnerable release and test that crafted JavaScript files no longer cause crashes in JavaScriptCore.

Typical attack path

1. Attacker crafts malicious JavaScript file exploiting the out-of-bounds read
2. Attacker delivers the file via web page, email attachment, or download link
3. Victim opens the file or visits the page using a vulnerable WebKit-based application
4. JavaScriptCore processes the input and crashes due to the memory corruption

How to detect it

Review application crash logs and JavaScript execution traces for repeated out-of-bounds read faults when processing untrusted .js files; no widespread exploitation artifacts are known.

What your security team should do

• Apply available WebKit updates immediately across all affected products
• Restrict execution of untrusted JavaScript files in browsers and embedded WebKit components
• Monitor for application crashes when processing JavaScript content as a potential indicator of attempted exploitation