var-201006-1237
Vulnerability from variot
Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to inject arbitrary web script or HTML via vectors related to a malformed URL. Apple Safari of WebKit Contains a cross-site scripting vulnerability.By any third party Web Script or HTML May be inserted. Safari is prone to multiple security vulnerabilities that have been addressed in Apple security advisory APPLE-SA-2010-06-07-1. Attackers can exploit these issues by enticing an unsuspecting user into visiting a malicious webpage. Successful attacks may result in information-disclosure, remote code-execution, denial-of-service, or other consequences. This BID is being retired. The following individual records exist to better document the issues: 40642 WebKit 'removeChild()' Remote Code Execution Vulnerability 40644 WebKit HTML Button Use After Free Remote Code Execution Vulnerability 40645 WebKit Marquee Event 'SelectionController' Remote Code Execution Vulnerability 40646 WebKit Editable Containers Remote Code Execution Vulnerability 40647 WebKit Option Element 'ContentEditable' Attribute Remote Code Execution Vulnerability 40649 WebKit 'ConditionEventListener' Remote Code Execution Vulnerability 40650 WebKit 'DOCUMENT_POSITION_DISCONNECTED' Attribute Remote Code Execution Vulnerability 40652 WebKit SVG 'RadialGradient' Attribute Remote Code Execution Vulnerability 40653 WebKit IBM1147 Character Set Text Transform Remote Code Execution Vulnerability 40654 WebKit Option Recursive Use Element Remote Code Execution Vulnerability 40655 WebKit 'first-letter' CSS Style Remote Code Execution Vulnerability 40656 WebKit SVG 'use' Element Remote Code Execution Vulnerability 40657 WebKit SVG 'use' Element Remote Code Execution Vulnerability 40658 WebKit Caption Element Handling Remote Code Execution Vulnerability 40659 WebKit Custom Vertical Positioning Remote Code Execution Vulnerability 40660 WebKit Dragging or Pasting Cross Domain Scripting Vulnerability 40661 WebKit Use After Free Remote Code Execution Vulnerability 40662 WebKit Hover Event Handling Remote Code Execution Vulnerability 40663 WebKit DOM Range Objects Remote Code Execution Vulnerability 40665 WebKit 'Node.normalize' Method Remote Code Execution Vulnerability 40665 WebKit 'Node.normalize' Method Remote Code Execution Vulnerability 40666 WebKit 'removeChild' DOM Method Remote Code Execution Vulnerability 40667 WebKit HTML Document Subtrees Remote Code Execution Vulnerability 40668 WebKit 'libxml' Context Handling Remote Code Execution Vulnerability 40669 Webkit UTF-7 Cross-Site Scripting Vulnerability 40670 WebKit Fonts Handling Remote Code Execution Vulnerability 40671 WebKit HTML Tables Remote Code Execution Vulnerability 40672 WebKit CSS-Styled HTML Handling Remote Code Execution Vulnerability 40673 Apple Safari PDF Handling Remote Code Execution Vulnerability 40674 Apple Safari Window Management Remote Code Execution Vulnerability 40675 Webkit HTML Document Fragments Cross Site Scripting Vulnerability 40697 WebKit Integer Truncation TCP Port Information Disclosure Vulnerability 40698 WebKit Keyboard Focus Cross Domain Information Disclosure Vulnerability 40704 Apple Safari Authentication Data URI Spoofing Vulnerability 40705 WebKit IRC Port Blacklist Information Disclosure Vulnerability 40707 Webkit DOM Constructor Object Cross Site Scripting Vulnerability 40710 WebKit 'frame.src' Validation Cross Site Scripting Vulnerability 40714 WebKit SVG Image Pattern Cross Domain Security Bypass Vulnerability 40717 WebKit Empty Hostname URI Handling Cross Site Scripting Vulnerability 40726 Webkit 'textarea' Element Cross-Site Scripting Vulnerability 40727 WebKit Cascading Stylesheets 'HREF' Information Disclosure Vulnerability 40732 WebKit HTTP Redirects Information Disclosure Vulnerability 40733 WebKit NTLM Credentials Information Disclosure Vulnerability 40750 WebKit HTTPS Redirect Information Disclosure Vulnerability 40752 WebKit HTTP URI Clipboard Information Disclosure Vulnerability 40753 WebKit Local Storage and Web SQL Database Directory Traversal Vulnerability 40754 WebKit 'execCommand()' Function Clipboard Overwrite Security Weakness 40756 WebKit ':visited' CSS Pseudo-class Information Disclosure Vulnerability. WebKit is prone to a cross-site scripting vulnerability because it fails to adequately sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of a targeted site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. Remote attackers can inject arbitrary web scripts and HTML with the help of specially crafted URL-related vectors. ----------------------------------------------------------------------
Secunia CSI integrated with Microsoft WSUS and Microsoft SCCM for 3rd party Patch Management
Free webinars
http://secunia.com/vulnerability_scanning/corporate/webinars/
TITLE: Apple Safari Multiple Vulnerabilities
SECUNIA ADVISORY ID: SA40105
VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/40105/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=40105
RELEASE DATE: 2010-06-09
DISCUSS ADVISORY: http://secunia.com/advisories/40105/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)
http://secunia.com/advisories/40105/
ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=40105
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION: Some vulnerabilities have been reported in Apple Safari, which can be exploited by malicious people to bypass certain security restrictions, disclose sensitive information, conduct spoofing or cross-site scripting attacks, and potentially compromise a user's system.
1) An error when processing ColorSync profiles embedded in a specially crafted image can be exploited to potentially execute arbitrary code.
This is related to vulnerability #2 in: SA36096
2) The browser follows links containing arbitrary user information without warning, which can be exploited to facilitate phishing attacks via specially crafted URLs.
3) A use-after-free error when handling PDF files can be exploited to potentially execute arbitrary code.
4) An error in WebKit when handling clipboard URLs can be exploited to disclose sensitive files if a user is tricked into dragging or pasting links or images to a malicious website.
6) An error in WebKit when handling UTF-7 encoded text can be exploited to leave an HTML quoted string unterminated and facilitate cross-site scripting attacks.
7) An input sanitation error in WebKit when handling Local Storage and Web SQL databases can be exploited to create database files in arbitrary directories via directory traversal attacks.
8) A use-after-free error in WebKit when rendering HTML buttons can be exploited to potentially execute arbitrary code.
9) A use-after-free error in WebKit when handling attribute manipulations can be exploited to potentially execute arbitrary code.
10) An error in WebKit when handling HTML document fragments can be exploited to execute arbitrary JavaScript code in a legitimate context processing foreign HTML fragments.
11) An error in WebKit when handling keyboard focus can be exploited to deliver key press events intended for a different frame.
12) An error in WebKit when handling DOM constructor objects can be exploited to conduct cross-site scripting attacks.
13) A use-after-free error in WebKit when handling the removal of container elements can be exploited to potentially execute arbitrary code.
14) A use-after-free error in WebKit when rendering a selection at the time of a layout change can be exploited to potentially execute arbitrary code.
15) An error in WebKit when handling ordered list insertions can be exploited to corrupt memory and potentially execute arbitrary code.
16) An uninitialised memory access error in WebKit when handling selection changes on form input elements can be exploited to potentially execute arbitrary code.
17) A use-after-free error in WebKit when handling caption elements can be exploited to potentially execute arbitrary code.
18) A use-after-free error in WebKit when handling the ":first-letter" pseudo-element in cascading stylesheets can be exploited to potentially execute arbitrary code.
19) A double-free error in WebKit when handling event listeners in SVG documents can be exploited to potentially execute arbitrary code.
20) An uninitialised memory access error in WebKit when handling "use" elements in SVG documents can be exploited to potentially execute arbitrary code.
21) A use-after-free error in WebKit when handling SVG documents with multiple "use" elements can be exploited to potentially execute arbitrary code.
22) An error in WebKit when handling nested "use" elements in SVG documents can be exploited to corrupt memory and potentially execute arbitrary code.
23) A use-after-free error in WebKit when handling CSS run-ins can be exploited to potentially execute arbitrary code.
24) A use-after-free error in WebKit when handling HTML elements with custom vertical positioning can be exploited to potentially execute arbitrary code.
25) An error exists in WebKit when visiting HTTPS websites redirecting to HTTP websites. This can be exploited to disclose potentially sensitive information contained in the HTTPS URL by reading the "Referer" header.
26) An integer truncation error in WebKit when handling TCP requests can be exploited to pass arbitrary data to arbitrary TCP ports.
27) An error in WebKit when processing connections to IRC ports can be exploited to send arbitrary data to arbitrary IRC servers.
28) A use-after-free error in WebKit when handling hover events can be exploited to potentially execute arbitrary code.
29) An error in WebKit can be exploited to read NTLM credentials that are incorrectly transmitted in plain-text via Man-in-the-Middle (MitM) attacks.
30) A use-after-free error in WebKit when handling the "removeChild" DOM method can be exploited to potentially execute arbitrary code.
31) An error in WebKit when handling libxml contexts can be exploited to potentially execute arbitrary code.
32) An error in WebKit when handling a canvas with an SVG image pattern can be exploited to load and capture an image from another website.
33) An error in WebKit when rendering CSS-styled HTML content with multiple ":after" pseudo-selectors can be exploited to corrupt memory and potentially execute arbitrary code.
34) An error in WebKit when handling the "src" attribute of a frame element can be exploited to facilitate cross-site scripting attacks.
35) A use-after-free error in WebKit when handling drag and drop operations can be exploited to potentially execute arbitrary code.
36) An error in the implementation of the JavaScript "execCommand" function can be exploited to modify the contents of the clipboard.
38) A use-after-free error in WebKit when handling DOM "Range" objects can be exploited to potentially execute arbitrary code.
39) A use-after-free error in WebKit when handling the "Node.normalize()" method can be exploited to potentially execute arbitrary code.
40) A use-after-free error in WebKit when rendering HTML document subtrees can be exploited to potentially execute arbitrary code.
42) An error in WebKit when visiting a website which redirects form submissions to a redirecting website can be exploited disclose submitted data.
43) A type checking error in WebKit when handling text nodes can be exploited to potentially execute arbitrary code.
44) A use-after-free error in WebKit when handling fonts can be exploited to potentially execute arbitrary code.
45) An error in WebKit when handling HTML tables can be exploited to trigger an out-of-bounds memory access and potentially execute arbitrary code.
46) An error in WebKit when handling the CSS ":visited" pseudo-class can be exploited to disclose visited websites.
SOLUTION: Update to version 4.1 (available only for Mac OS X v10.4 systems) or upgrade to version 5.0.
PROVIDED AND/OR DISCOVERED BY: 37) Michal Zalewski
The vendor also credits: 1) Chris Evans of the Google Security Team, and Andrzej Dyjak 2) Abhishek Arya of Google 3) Borja Marcos of Sarenet 4) Eric Seidel of Google 5) Paul Stone of Context Information Security 6) Masahiro Yamada 8) Matthieu Bonetti of Vupen 9) Ralf Philipp Weinmann working with TippingPoint's Zero Day Initiative 10, 41) Eduardo Vela Nava (sirdarckcat) of Google 11) Michal Zalewski of Google 12) Gianni "gf3" Chiappetta of Runlevel6 13, 15, 16, 18, 19, 20, 21, 23, 43) wushi of team509, working with TippingPoint's Zero Day Initiative 14) wushi and Z of team509, working with TippingPoint's Zero Day Initiative 17) regenrecht working with iDefense 22, 31) Aki Helin of OUSPG 24) Ojan Vafai of Google 25) Colin Percival of Tarsnap 28) Dave Bowker 30) Mark Dowd of Azimuth Security 32) Chris Evans of Google 33, 45) wushi of team509 34) Sergey Glazunov 35) kuzzcc, and Skylined of Google Chrome Security Team 38) Yaar Schnitman of Google 39) Mark Dowd 40) James Robinson of Google 42) Marc Worrell of WhatWebWhat
ORIGINAL ADVISORY: Apple: http://support.apple.com/kb/HT4196
Michal Zalewski: http://lcamtuf.blogspot.com/2010/06/safari-tale-of-betrayal-and-revenge.html
OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
DEEP LINKS: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
EXPLOIT: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
. ----------------------------------------------------------------------
Secure your corporate defenses and reduce complexity in handling vulnerability threats with the new Secunia Vulnerability Intelligence Manager (VIM).
For more information: SA40257 SA41328 SA42151 SA42312
SOLUTION: Upgrade to iOS 4.2 (downloadable and installable via iTunes). Belated, but here are some recent bugs that you guys might find interesting:
1) DOM reference fuzzer, originally developed in 2008, crashed every browser on the market back then:
http://lcamtuf.blogspot.com/2010/06/announcing-reffuzz-2yo-fuzzer.html
Several of the bugs triggered by the fuzzer were rediscovered independently in the two years it took vendors to investigate; most notably, looks like the winning Pwn2own bug is a duplicate of this. The release of Microsoft MS10-035 and Apple APPLE-SA-2010-06-21-1 probably fixes the last of the known exploitable issues triggered by this tool. Probably not a great argument in favor of limited disclosure.
2) Safari SOP bypass (CVE-2010-0544) - the story is amusing by the virtue of spanning more than one decade:
http://lcamtuf.blogspot.com/2010/06/safari-tale-of-betrayal-and-revenge.html
3) Address bar spoofing in Firefox (CVE-2010-1206):
http://lcamtuf.blogspot.com/2010/06/yeah-about-that-address-bar-thing.html
4) Some more fun with selective mid-keystroke focus redirection in WebKit-based browsers (CVE-2010-1422):
http://lcamtuf.blogspot.com/2010/06/curse-of-inverse-strokejacking.html
[ Original post on this topic: http://seclists.org/fulldisclosure/2010/Mar/232 ]
Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ . Some have an unknown impact and others can be exploited by malicious people to bypass certain security restrictions, disclose sensitive information, or compromise a user's system.
For more information: SA37931 SA40105
4) One unspecified vulnerability with an unknown impact has been reported in WebKit included in iTunes. No further information is currently available.
5) Two vulnerabilities in WebKit can be exploited by malicious people to compromise a user's system.
For more information see vulnerability #14 and 15 in: SA40257
SOLUTION: Update to version 9.2.
PROVIDED AND/OR DISCOVERED BY: 1) The vendor credits Chris Evans of the Google Security Team and Andrzej Dyjak. 2) The vendor credits Kevin Finisterre, digitalmunition.com. 4) Reported by the vendor
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201006-1237",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "safari",
"scope": "eq",
"trust": 2.2,
"vendor": "apple",
"version": "4.0.4"
},
{
"model": "safari",
"scope": "eq",
"trust": 2.2,
"vendor": "apple",
"version": "4.0.3"
},
{
"model": "safari",
"scope": "eq",
"trust": 2.2,
"vendor": "apple",
"version": "4.0.2"
},
{
"model": "safari",
"scope": "eq",
"trust": 2.2,
"vendor": "apple",
"version": "4.0.1"
},
{
"model": "safari",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "4.0.0b"
},
{
"model": "safari",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "4.0"
},
{
"model": "safari",
"scope": "eq",
"trust": 1.4,
"vendor": "apple",
"version": "4"
},
{
"model": "safari",
"scope": "eq",
"trust": 1.2,
"vendor": "apple",
"version": "4.0.5"
},
{
"model": "webkit",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "*"
},
{
"model": "safari",
"scope": "lte",
"trust": 1.0,
"vendor": "apple",
"version": "4.0.5"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "v10.4.11"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "v10.5.8"
},
{
"model": "mac os x server",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "v10.4.11"
},
{
"model": "mac os x server",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "v10.5.8"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "2.0 to 3.1.3"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "3.2 to 3.2.2 (ipad for )"
},
{
"model": "ios for ipod touch",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "2.1 to 3.1.3"
},
{
"model": "ipad",
"scope": null,
"trust": 0.8,
"vendor": "apple",
"version": null
},
{
"model": "iphone",
"scope": null,
"trust": 0.8,
"vendor": "apple",
"version": null
},
{
"model": "ipod touch",
"scope": null,
"trust": 0.8,
"vendor": "apple",
"version": null
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "9"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "5"
},
{
"model": "safari for windows",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "4.0.5"
},
{
"model": "safari for windows",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "4.0.4"
},
{
"model": "safari for windows",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "4.0.3"
},
{
"model": "safari for windows",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "4.0.2"
},
{
"model": "safari for windows",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "4"
},
{
"model": "safari beta",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "4"
},
{
"model": "safari for windows",
"scope": "ne",
"trust": 0.6,
"vendor": "apple",
"version": "5.0"
},
{
"model": "safari",
"scope": "ne",
"trust": 0.6,
"vendor": "apple",
"version": "5.0"
},
{
"model": "safari",
"scope": "ne",
"trust": 0.6,
"vendor": "apple",
"version": "4.1"
},
{
"model": "webkit",
"scope": null,
"trust": 0.6,
"vendor": "apple",
"version": null
},
{
"model": "open source project webkit r52833",
"scope": null,
"trust": 0.3,
"vendor": "webkit",
"version": null
},
{
"model": "open source project webkit r52401",
"scope": null,
"trust": 0.3,
"vendor": "webkit",
"version": null
},
{
"model": "open source project webkit r51295",
"scope": null,
"trust": 0.3,
"vendor": "webkit",
"version": null
},
{
"model": "open source project webkit r38566",
"scope": null,
"trust": 0.3,
"vendor": "webkit",
"version": null
},
{
"model": "open source project webkit",
"scope": "eq",
"trust": 0.3,
"vendor": "webkit",
"version": "0"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.0.2"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.0.1.8"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.0.1"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.0"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.1"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "8.2"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "8.1"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "8.0.2.20"
},
{
"model": "itunes",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "8.0"
},
{
"model": "ipod touch",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.1.3"
},
{
"model": "ipod touch",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.1.2"
},
{
"model": "ipod touch",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.1.1"
},
{
"model": "ipod touch",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.2.1"
},
{
"model": "ipod touch",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.0.2"
},
{
"model": "ipod touch",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.0.1"
},
{
"model": "ipod touch",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.0"
},
{
"model": "ipod touch",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.2"
},
{
"model": "ipod touch",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.1"
},
{
"model": "ipod touch",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.0"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.1.3"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.1.2"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.0.1"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.2.1"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.0.2"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.0.1"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.1"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.0"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.2"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.1"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.0"
},
{
"model": "ipad",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.2.1"
},
{
"model": "ipad",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.2.2"
},
{
"model": "ipad",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.2"
},
{
"model": "ipad",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "0"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.0.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.0.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.2.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.2.1"
},
{
"model": "ios beta",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.2"
},
{
"model": "itunes",
"scope": "ne",
"trust": 0.3,
"vendor": "apple",
"version": "9.2"
},
{
"model": "ios",
"scope": "ne",
"trust": 0.3,
"vendor": "apple",
"version": "4.2"
},
{
"model": "ios",
"scope": "ne",
"trust": 0.3,
"vendor": "apple",
"version": "4"
}
],
"sources": [
{
"db": "BID",
"id": "40620"
},
{
"db": "BID",
"id": "40717"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001576"
},
{
"db": "CNNVD",
"id": "CNNVD-201006-139"
},
{
"db": "NVD",
"id": "CVE-2010-0544"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:apple:mac_os_x",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:apple:mac_os_x_server",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:apple:iphone_os",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:apple:iphone_os_for_ipod_touch",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:apple:ipad",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:apple:iphone",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:apple:ipod_touch",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:apple:itunes",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:apple:safari",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2010-001576"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Apple; Abhihek Arya of Google, Inc.; Borja Marcos of Sarenet; Eric Seidel of Google, Inc.; Paul Stone of Context Information Security; Masahiro Yamada; Matthieu Bonetti of VUPEN Vulnerability Research Team; Ralf Philipp Weinmann working with TippingPoint\u0027",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201006-139"
}
],
"trust": 0.6
},
"cve": "CVE-2010-0544",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "CVE-2010-0544",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "VHN-43149",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:N/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2010-0544",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2010-0544",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-201006-139",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-43149",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-43149"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001576"
},
{
"db": "CNNVD",
"id": "CNNVD-201006-139"
},
{
"db": "NVD",
"id": "CVE-2010-0544"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to inject arbitrary web script or HTML via vectors related to a malformed URL. Apple Safari of WebKit Contains a cross-site scripting vulnerability.By any third party Web Script or HTML May be inserted. Safari is prone to multiple security vulnerabilities that have been addressed in Apple security advisory APPLE-SA-2010-06-07-1. \nAttackers can exploit these issues by enticing an unsuspecting user into visiting a malicious webpage. Successful attacks may result in information-disclosure, remote code-execution, denial-of-service, or other consequences. \nThis BID is being retired. The following individual records exist to better document the issues:\n40642 WebKit \u0027removeChild()\u0027 Remote Code Execution Vulnerability\n40644 WebKit HTML Button Use After Free Remote Code Execution Vulnerability\n40645 WebKit Marquee Event \u0027SelectionController\u0027 Remote Code Execution Vulnerability\n40646 WebKit Editable Containers Remote Code Execution Vulnerability\n40647 WebKit Option Element \u0027ContentEditable\u0027 Attribute Remote Code Execution Vulnerability\n40649 WebKit \u0027ConditionEventListener\u0027 Remote Code Execution Vulnerability\n40650 WebKit \u0027DOCUMENT_POSITION_DISCONNECTED\u0027 Attribute Remote Code Execution Vulnerability\n40652 WebKit SVG \u0027RadialGradient\u0027 Attribute Remote Code Execution Vulnerability\n40653 WebKit IBM1147 Character Set Text Transform Remote Code Execution Vulnerability\n40654 WebKit Option Recursive Use Element Remote Code Execution Vulnerability\n40655 WebKit \u0027first-letter\u0027 CSS Style Remote Code Execution Vulnerability\n40656 WebKit SVG \u0027use\u0027 Element Remote Code Execution Vulnerability\n40657 WebKit SVG \u0027use\u0027 Element Remote Code Execution Vulnerability\n40658 WebKit Caption Element Handling Remote Code Execution Vulnerability\n40659 WebKit Custom Vertical Positioning Remote Code Execution Vulnerability\n40660 WebKit Dragging or Pasting Cross Domain Scripting Vulnerability\n40661 WebKit Use After Free Remote Code Execution Vulnerability\n40662 WebKit Hover Event Handling Remote Code Execution Vulnerability\n40663 WebKit DOM Range Objects Remote Code Execution Vulnerability\n40665 WebKit \u0027Node.normalize\u0027 Method Remote Code Execution Vulnerability\n40665 WebKit \u0027Node.normalize\u0027 Method Remote Code Execution Vulnerability\n40666 WebKit \u0027removeChild\u0027 DOM Method Remote Code Execution Vulnerability\n40667 WebKit HTML Document Subtrees Remote Code Execution Vulnerability\n40668 WebKit \u0027libxml\u0027 Context Handling Remote Code Execution Vulnerability\n40669 Webkit UTF-7 Cross-Site Scripting Vulnerability\n40670 WebKit Fonts Handling Remote Code Execution Vulnerability\n40671 WebKit HTML Tables Remote Code Execution Vulnerability\n40672 WebKit CSS-Styled HTML Handling Remote Code Execution Vulnerability\n40673 Apple Safari PDF Handling Remote Code Execution Vulnerability\n40674 Apple Safari Window Management Remote Code Execution Vulnerability\n40675 Webkit HTML Document Fragments Cross Site Scripting Vulnerability\n40697 WebKit Integer Truncation TCP Port Information Disclosure Vulnerability\n40698 WebKit Keyboard Focus Cross Domain Information Disclosure Vulnerability\n40704 Apple Safari Authentication Data URI Spoofing Vulnerability\n40705 WebKit IRC Port Blacklist Information Disclosure Vulnerability\n40707 Webkit DOM Constructor Object Cross Site Scripting Vulnerability\n40710 WebKit \u0027frame.src\u0027 Validation Cross Site Scripting Vulnerability\n40714 WebKit SVG Image Pattern Cross Domain Security Bypass Vulnerability\n40717 WebKit Empty Hostname URI Handling Cross Site Scripting Vulnerability\n40726 Webkit \u0027textarea\u0027 Element Cross-Site Scripting Vulnerability\n40727 WebKit Cascading Stylesheets \u0027HREF\u0027 Information Disclosure Vulnerability\n40732 WebKit HTTP Redirects Information Disclosure Vulnerability\n40733 WebKit NTLM Credentials Information Disclosure Vulnerability\n40750 WebKit HTTPS Redirect Information Disclosure Vulnerability\n40752 WebKit HTTP URI Clipboard Information Disclosure Vulnerability\n40753 WebKit Local Storage and Web SQL Database Directory Traversal Vulnerability\n40754 WebKit \u0027execCommand()\u0027 Function Clipboard Overwrite Security Weakness\n40756 WebKit \u0027:visited\u0027 CSS Pseudo-class Information Disclosure Vulnerability. WebKit is prone to a cross-site scripting vulnerability because it fails to adequately sanitize user-supplied input. \nAn attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of a targeted site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. Remote attackers can inject arbitrary web scripts and HTML with the help of specially crafted URL-related vectors. ----------------------------------------------------------------------\n\n\nSecunia CSI integrated with Microsoft WSUS and Microsoft SCCM for 3rd party Patch Management\n\nFree webinars\n\nhttp://secunia.com/vulnerability_scanning/corporate/webinars/\n\n\n----------------------------------------------------------------------\n\nTITLE:\nApple Safari Multiple Vulnerabilities\n\nSECUNIA ADVISORY ID:\nSA40105\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/40105/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=40105\n\nRELEASE DATE:\n2010-06-09\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/40105/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/40105/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=40105\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nSome vulnerabilities have been reported in Apple Safari, which can be\nexploited by malicious people to bypass certain security restrictions,\ndisclose sensitive information, conduct spoofing or cross-site\nscripting attacks, and potentially compromise a user\u0027s system. \n\n1) An error when processing ColorSync profiles embedded in a\nspecially crafted image can be exploited to potentially execute\narbitrary code. \n\nThis is related to vulnerability #2 in:\nSA36096\n\n2) The browser follows links containing arbitrary user information\nwithout warning, which can be exploited to facilitate phishing\nattacks via specially crafted URLs. \n\n3) A use-after-free error when handling PDF files can be exploited to\npotentially execute arbitrary code. \n\n4) An error in WebKit when handling clipboard URLs can be exploited\nto disclose sensitive files if a user is tricked into dragging or\npasting links or images to a malicious website. \n\n6) An error in WebKit when handling UTF-7 encoded text can be\nexploited to leave an HTML quoted string unterminated and facilitate\ncross-site scripting attacks. \n\n7) An input sanitation error in WebKit when handling Local Storage\nand Web SQL databases can be exploited to create database files in\narbitrary directories via directory traversal attacks. \n\n8) A use-after-free error in WebKit when rendering HTML buttons can\nbe exploited to potentially execute arbitrary code. \n\n9) A use-after-free error in WebKit when handling attribute\nmanipulations can be exploited to potentially execute arbitrary\ncode. \n\n10) An error in WebKit when handling HTML document fragments can be\nexploited to execute arbitrary JavaScript code in a legitimate\ncontext processing foreign HTML fragments. \n\n11) An error in WebKit when handling keyboard focus can be exploited\nto deliver key press events intended for a different frame. \n\n12) An error in WebKit when handling DOM constructor objects can be\nexploited to conduct cross-site scripting attacks. \n\n13) A use-after-free error in WebKit when handling the removal of\ncontainer elements can be exploited to potentially execute arbitrary\ncode. \n\n14) A use-after-free error in WebKit when rendering a selection at\nthe time of a layout change can be exploited to potentially execute\narbitrary code. \n\n15) An error in WebKit when handling ordered list insertions can be\nexploited to corrupt memory and potentially execute arbitrary code. \n\n16) An uninitialised memory access error in WebKit when handling\nselection changes on form input elements can be exploited to\npotentially execute arbitrary code. \n\n17) A use-after-free error in WebKit when handling caption elements\ncan be exploited to potentially execute arbitrary code. \n\n18) A use-after-free error in WebKit when handling the\n\":first-letter\" pseudo-element in cascading stylesheets can be\nexploited to potentially execute arbitrary code. \n\n19) A double-free error in WebKit when handling event listeners in\nSVG documents can be exploited to potentially execute arbitrary\ncode. \n\n20) An uninitialised memory access error in WebKit when handling\n\"use\" elements in SVG documents can be exploited to potentially\nexecute arbitrary code. \n\n21) A use-after-free error in WebKit when handling SVG documents with\nmultiple \"use\" elements can be exploited to potentially execute\narbitrary code. \n\n22) An error in WebKit when handling nested \"use\" elements in SVG\ndocuments can be exploited to corrupt memory and potentially execute\narbitrary code. \n\n23) A use-after-free error in WebKit when handling CSS run-ins can be\nexploited to potentially execute arbitrary code. \n\n24) A use-after-free error in WebKit when handling HTML elements with\ncustom vertical positioning can be exploited to potentially execute\narbitrary code. \n\n25) An error exists in WebKit when visiting HTTPS websites\nredirecting to HTTP websites. This can be exploited to disclose\npotentially sensitive information contained in the HTTPS URL by\nreading the \"Referer\" header. \n\n26) An integer truncation error in WebKit when handling TCP requests\ncan be exploited to pass arbitrary data to arbitrary TCP ports. \n\n27) An error in WebKit when processing connections to IRC ports can\nbe exploited to send arbitrary data to arbitrary IRC servers. \n\n28) A use-after-free error in WebKit when handling hover events can\nbe exploited to potentially execute arbitrary code. \n\n29) An error in WebKit can be exploited to read NTLM credentials that\nare incorrectly transmitted in plain-text via Man-in-the-Middle (MitM)\nattacks. \n\n30) A use-after-free error in WebKit when handling the \"removeChild\"\nDOM method can be exploited to potentially execute arbitrary code. \n\n31) An error in WebKit when handling libxml contexts can be exploited\nto potentially execute arbitrary code. \n\n32) An error in WebKit when handling a canvas with an SVG image\npattern can be exploited to load and capture an image from another\nwebsite. \n\n33) An error in WebKit when rendering CSS-styled HTML content with\nmultiple \":after\" pseudo-selectors can be exploited to corrupt memory\nand potentially execute arbitrary code. \n\n34) An error in WebKit when handling the \"src\" attribute of a frame\nelement can be exploited to facilitate cross-site scripting attacks. \n\n35) A use-after-free error in WebKit when handling drag and drop\noperations can be exploited to potentially execute arbitrary code. \n\n36) An error in the implementation of the JavaScript \"execCommand\"\nfunction can be exploited to modify the contents of the clipboard. \n\n38) A use-after-free error in WebKit when handling DOM \"Range\"\nobjects can be exploited to potentially execute arbitrary code. \n\n39) A use-after-free error in WebKit when handling the\n\"Node.normalize()\" method can be exploited to potentially execute\narbitrary code. \n\n40) A use-after-free error in WebKit when rendering HTML document\nsubtrees can be exploited to potentially execute arbitrary code. \n\n42) An error in WebKit when visiting a website which redirects form\nsubmissions to a redirecting website can be exploited disclose\nsubmitted data. \n\n43) A type checking error in WebKit when handling text nodes can be\nexploited to potentially execute arbitrary code. \n\n44) A use-after-free error in WebKit when handling fonts can be\nexploited to potentially execute arbitrary code. \n\n45) An error in WebKit when handling HTML tables can be exploited to\ntrigger an out-of-bounds memory access and potentially execute\narbitrary code. \n\n46) An error in WebKit when handling the CSS \":visited\" pseudo-class\ncan be exploited to disclose visited websites. \n\nSOLUTION:\nUpdate to version 4.1 (available only for Mac OS X v10.4 systems) or\nupgrade to version 5.0. \n\nPROVIDED AND/OR DISCOVERED BY:\n37) Michal Zalewski\n\nThe vendor also credits:\n1) Chris Evans of the Google Security Team, and Andrzej Dyjak\n2) Abhishek Arya of Google\n3) Borja Marcos of Sarenet\n4) Eric Seidel of Google\n5) Paul Stone of Context Information Security\n6) Masahiro Yamada\n8) Matthieu Bonetti of Vupen\n9) Ralf Philipp Weinmann working with TippingPoint\u0027s Zero Day\nInitiative\n10, 41) Eduardo Vela Nava (sirdarckcat) of Google\n11) Michal Zalewski of Google\n12) Gianni \"gf3\" Chiappetta of Runlevel6\n13, 15, 16, 18, 19, 20, 21, 23, 43) wushi of team509, working with\nTippingPoint\u0027s Zero Day Initiative\n14) wushi and Z of team509, working with TippingPoint\u0027s Zero Day\nInitiative\n17) regenrecht working with iDefense\n22, 31) Aki Helin of OUSPG\n24) Ojan Vafai of Google\n25) Colin Percival of Tarsnap\n28) Dave Bowker\n30) Mark Dowd of Azimuth Security\n32) Chris Evans of Google\n33, 45) wushi of team509\n34) Sergey Glazunov\n35) kuzzcc, and Skylined of Google Chrome Security Team\n38) Yaar Schnitman of Google\n39) Mark Dowd\n40) James Robinson of Google\n42) Marc Worrell of WhatWebWhat\n\nORIGINAL ADVISORY:\nApple:\nhttp://support.apple.com/kb/HT4196\n\nMichal Zalewski:\nhttp://lcamtuf.blogspot.com/2010/06/safari-tale-of-betrayal-and-revenge.html\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. ----------------------------------------------------------------------\n\n\nSecure your corporate defenses and reduce complexity in handling vulnerability threats with the new Secunia Vulnerability Intelligence Manager (VIM). \n\nFor more information:\nSA40257\nSA41328\nSA42151\nSA42312\n\nSOLUTION:\nUpgrade to iOS 4.2 (downloadable and installable via iTunes). Belated, but here are some recent bugs that you guys might find interesting:\n\n1) DOM reference fuzzer, originally developed in 2008, crashed every\nbrowser on the market back then:\n\nhttp://lcamtuf.blogspot.com/2010/06/announcing-reffuzz-2yo-fuzzer.html\n\nSeveral of the bugs triggered by the fuzzer were rediscovered\nindependently in the two years it took vendors to investigate; most\nnotably, looks like the winning Pwn2own bug is a duplicate of this. \nThe release of Microsoft MS10-035 and Apple APPLE-SA-2010-06-21-1\nprobably fixes the last of the known exploitable issues triggered by\nthis tool. Probably not a great argument in favor of limited\ndisclosure. \n\n2) Safari SOP bypass (CVE-2010-0544) - the story is amusing by the\nvirtue of spanning more than one decade:\n\nhttp://lcamtuf.blogspot.com/2010/06/safari-tale-of-betrayal-and-revenge.html\n\n3) Address bar spoofing in Firefox (CVE-2010-1206):\n\nhttp://lcamtuf.blogspot.com/2010/06/yeah-about-that-address-bar-thing.html\n\n4) Some more fun with selective mid-keystroke focus redirection in\nWebKit-based browsers (CVE-2010-1422):\n\nhttp://lcamtuf.blogspot.com/2010/06/curse-of-inverse-strokejacking.html\n\n[ Original post on this topic: http://seclists.org/fulldisclosure/2010/Mar/232 ]\n\n_______________________________________________\nFull-Disclosure - We believe in it. \nCharter: http://lists.grok.org.uk/full-disclosure-charter.html\nHosted and sponsored by Secunia - http://secunia.com/\n. Some\nhave an unknown impact and others can be exploited by malicious\npeople to bypass certain security restrictions, disclose sensitive\ninformation, or compromise a user\u0027s system. \n\nFor more information:\nSA37931\nSA40105\n\n4) One unspecified vulnerability with an unknown impact has been\nreported in WebKit included in iTunes. No further information is\ncurrently available. \n\n5) Two vulnerabilities in WebKit can be exploited by malicious people\nto compromise a user\u0027s system. \n\nFor more information see vulnerability #14 and 15 in:\nSA40257\n\nSOLUTION:\nUpdate to version 9.2. \n\nPROVIDED AND/OR DISCOVERED BY:\n1) The vendor credits Chris Evans of the Google Security Team and\nAndrzej Dyjak. \n2) The vendor credits Kevin Finisterre, digitalmunition.com. \n4) Reported by the vendor",
"sources": [
{
"db": "NVD",
"id": "CVE-2010-0544"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001576"
},
{
"db": "BID",
"id": "40620"
},
{
"db": "BID",
"id": "40717"
},
{
"db": "VULHUB",
"id": "VHN-43149"
},
{
"db": "PACKETSTORM",
"id": "90456"
},
{
"db": "PACKETSTORM",
"id": "96086"
},
{
"db": "PACKETSTORM",
"id": "91167"
},
{
"db": "PACKETSTORM",
"id": "91028"
}
],
"trust": 2.61
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-43149",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-43149"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2010-0544",
"trust": 2.9
},
{
"db": "SECUNIA",
"id": "40105",
"trust": 2.6
},
{
"db": "VUPEN",
"id": "ADV-2010-1373",
"trust": 2.5
},
{
"db": "SECTRACK",
"id": "1024067",
"trust": 2.5
},
{
"db": "SECUNIA",
"id": "40196",
"trust": 2.0
},
{
"db": "BID",
"id": "40620",
"trust": 2.0
},
{
"db": "VUPEN",
"id": "ADV-2010-1512",
"trust": 1.9
},
{
"db": "SECUNIA",
"id": "42314",
"trust": 1.2
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001576",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201006-139",
"trust": 0.7
},
{
"db": "APPLE",
"id": "APPLE-SA-2010-06-07-1",
"trust": 0.6
},
{
"db": "BID",
"id": "40717",
"trust": 0.4
},
{
"db": "PACKETSTORM",
"id": "91167",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-43149",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "90456",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "96086",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "91028",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-43149"
},
{
"db": "BID",
"id": "40620"
},
{
"db": "BID",
"id": "40717"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001576"
},
{
"db": "PACKETSTORM",
"id": "90456"
},
{
"db": "PACKETSTORM",
"id": "96086"
},
{
"db": "PACKETSTORM",
"id": "91167"
},
{
"db": "PACKETSTORM",
"id": "91028"
},
{
"db": "CNNVD",
"id": "CNNVD-201006-139"
},
{
"db": "NVD",
"id": "CVE-2010-0544"
}
]
},
"id": "VAR-201006-1237",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-43149"
}
],
"trust": 0.01
},
"last_update_date": "2024-11-23T20:15:58.655000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "HT4196",
"trust": 0.8,
"url": "http://support.apple.com/kb/HT4196"
},
{
"title": "HT4220",
"trust": 0.8,
"url": "http://support.apple.com/kb/HT4220"
},
{
"title": "HT4225",
"trust": 0.8,
"url": "http://support.apple.com/kb/HT4225"
},
{
"title": "HT4456",
"trust": 0.8,
"url": "http://support.apple.com/kb/HT4456"
},
{
"title": "HT4196",
"trust": 0.8,
"url": "http://support.apple.com/kb/HT4196?viewlocale=ja_JP"
},
{
"title": "HT4220",
"trust": 0.8,
"url": "http://support.apple.com/kb/HT4220?viewlocale=ja_JP"
},
{
"title": "HT4225",
"trust": 0.8,
"url": "http://support.apple.com/kb/HT4225?viewlocale=ja_JP"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2010-001576"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-79",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-43149"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001576"
},
{
"db": "NVD",
"id": "CVE-2010-0544"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "http://securitytracker.com/id?1024067"
},
{
"trust": 2.5,
"url": "http://secunia.com/advisories/40105"
},
{
"trust": 2.5,
"url": "http://www.vupen.com/english/advisories/2010/1373"
},
{
"trust": 1.9,
"url": "http://secunia.com/advisories/40196"
},
{
"trust": 1.9,
"url": "http://www.vupen.com/english/advisories/2010/1512"
},
{
"trust": 1.8,
"url": "http://support.apple.com/kb/ht4196"
},
{
"trust": 1.7,
"url": "http://lists.apple.com/archives/security-announce/2010/jun/msg00000.html"
},
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/40620"
},
{
"trust": 1.2,
"url": "http://support.apple.com/kb/ht4220"
},
{
"trust": 1.2,
"url": "http://support.apple.com/kb/ht4456"
},
{
"trust": 1.1,
"url": "http://lists.apple.com/archives/security-announce/2010//jun/msg00002.html"
},
{
"trust": 1.1,
"url": "http://lists.apple.com/archives/security-announce/2010/jun/msg00003.html"
},
{
"trust": 1.1,
"url": "http://lists.apple.com/archives/security-announce/2010//nov/msg00003.html"
},
{
"trust": 1.1,
"url": "http://support.apple.com/kb/ht4225"
},
{
"trust": 1.1,
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3aorg.mitre.oval%3adef%3a6656"
},
{
"trust": 1.1,
"url": "http://secunia.com/advisories/42314"
},
{
"trust": 0.8,
"url": "http://lcamtuf.blogspot.com/2010/06/safari-tale-of-betrayal-and-revenge.html"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-0544"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2010-0544"
},
{
"trust": 0.6,
"url": "http://www.apple.com/safari/"
},
{
"trust": 0.3,
"url": "http://secunia.com/products/corporate/evm/"
},
{
"trust": 0.3,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.3,
"url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
},
{
"trust": 0.3,
"url": "http://secunia.com/vulnerability_scanning/personal/"
},
{
"trust": 0.3,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.3,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.2,
"url": "http://secunia.com/vulnerability_scanning/corporate/webinars/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/40105/#comments"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=40105"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/40105/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/42314/"
},
{
"trust": 0.1,
"url": "http://secunia.com/products/corporate/vim/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/42314/#comments"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=42314"
},
{
"trust": 0.1,
"url": "http://lcamtuf.blogspot.com/2010/06/yeah-about-that-address-bar-thing.html"
},
{
"trust": 0.1,
"url": "http://lcamtuf.blogspot.com/2010/06/announcing-reffuzz-2yo-fuzzer.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-1422"
},
{
"trust": 0.1,
"url": "http://secunia.com/"
},
{
"trust": 0.1,
"url": "http://lcamtuf.blogspot.com/2010/06/curse-of-inverse-strokejacking.html"
},
{
"trust": 0.1,
"url": "http://lists.grok.org.uk/full-disclosure-charter.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-0544"
},
{
"trust": 0.1,
"url": "http://seclists.org/fulldisclosure/2010/mar/232"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-1206"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/40196/#comments"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=40196"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/40196/"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-43149"
},
{
"db": "BID",
"id": "40620"
},
{
"db": "BID",
"id": "40717"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001576"
},
{
"db": "PACKETSTORM",
"id": "90456"
},
{
"db": "PACKETSTORM",
"id": "96086"
},
{
"db": "PACKETSTORM",
"id": "91167"
},
{
"db": "PACKETSTORM",
"id": "91028"
},
{
"db": "CNNVD",
"id": "CNNVD-201006-139"
},
{
"db": "NVD",
"id": "CVE-2010-0544"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-43149"
},
{
"db": "BID",
"id": "40620"
},
{
"db": "BID",
"id": "40717"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001576"
},
{
"db": "PACKETSTORM",
"id": "90456"
},
{
"db": "PACKETSTORM",
"id": "96086"
},
{
"db": "PACKETSTORM",
"id": "91167"
},
{
"db": "PACKETSTORM",
"id": "91028"
},
{
"db": "CNNVD",
"id": "CNNVD-201006-139"
},
{
"db": "NVD",
"id": "CVE-2010-0544"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2010-06-11T00:00:00",
"db": "VULHUB",
"id": "VHN-43149"
},
{
"date": "2010-06-07T00:00:00",
"db": "BID",
"id": "40620"
},
{
"date": "2010-06-07T00:00:00",
"db": "BID",
"id": "40717"
},
{
"date": "2010-06-29T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-001576"
},
{
"date": "2010-06-09T09:04:37",
"db": "PACKETSTORM",
"id": "90456"
},
{
"date": "2010-11-24T11:53:31",
"db": "PACKETSTORM",
"id": "96086"
},
{
"date": "2010-06-29T01:55:12",
"db": "PACKETSTORM",
"id": "91167"
},
{
"date": "2010-06-25T14:14:55",
"db": "PACKETSTORM",
"id": "91028"
},
{
"date": "2010-06-18T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201006-139"
},
{
"date": "2010-06-11T19:30:12.253000",
"db": "NVD",
"id": "CVE-2010-0544"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-09-19T00:00:00",
"db": "VULHUB",
"id": "VHN-43149"
},
{
"date": "2010-06-10T21:19:00",
"db": "BID",
"id": "40620"
},
{
"date": "2015-03-19T08:39:00",
"db": "BID",
"id": "40717"
},
{
"date": "2010-12-10T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-001576"
},
{
"date": "2010-06-18T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201006-139"
},
{
"date": "2024-11-21T01:12:24.953000",
"db": "NVD",
"id": "CVE-2010-0544"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "network",
"sources": [
{
"db": "BID",
"id": "40620"
},
{
"db": "BID",
"id": "40717"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Apple Safari of WebKit Vulnerable to cross-site scripting",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2010-001576"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "XSS",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201006-139"
}
],
"trust": 0.6
}
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.