CVE-2014-1297

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-04-02 · updated 2026-06-17
Weakness: CWE-20

Description

WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, does not properly validate WebProcess IPC messages, which allows remote attackers to bypass a sandbox protection mechanism and read arbitrary files by leveraging WebProcess access.

Affected products

Apple Safari: through 6.1.2; 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5 (+5)

References

http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html
http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html

Get alerted when CVE-2014-1297 or the next vulnerability affects your stack