CVE-2017-1000121

CRITICAL 9.8CVE-2017-1000121 · Published 01/11/2017 · updated 17/06/2026

In short

CVE-2017-1000121 is a CRITICAL (CVSS 9.8) vulnerability affecting webkitgtk+ (webkitgtk).
Chance of exploitation in the next 30 days (EPSS): 1.2%, higher than 68.2% of all vulnerabilities.
Fix: update to 2.16.3 or later.

Package	Affected versions	Patched versions
webkitgtk+ webkitgtk	`< 2.16.3`	`2.16.3`

Description

The UNIX IPC layer in WebKit, including WebKitGTK+ prior to 2.16.3, does not properly validate message size metadata, allowing a compromised secondary process to trigger an integer overflow and subsequent buffer overflow in the UI process. This vulnerability does not affect Apple products.

References

trac.webkit.org/changeset/217126/webkit · Patch
webkitgtk.org/security/WSA-2017-0007.html · Vendor Advisory

More vulnerabilities in webkitgtk+

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

webkitgtk+

webkitgtk

< 2.16.3

2.16.3

More vulnerabilities in webkitgtk+

See all →