Apple Safari Buffer Overflow in WebKit in Processing SVGList Objects Lets Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1022207 |
|
SecurityTracker URL: http://securitytracker.com/id/1022207
|
|
CVE Reference:
CVE-2009-0945
(Links to External Site)
|
Date: May 13 2009
|
Impact:
Execution of arbitrary code via network, User access via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): prior to 3.2.3
|
Description:
A vulnerability was reported in Apple Safari. A remote user can cause arbitrary code to be executed on the target user's system.
A remote user can create specially crafted HTML that, when loaded by the target user, will trigger a flaw in WebKit's processing of SVGList objects and execute arbitrary code on the target system. The code will run with the privileges of the target user.
Nils reported this vulnerability via TippingPoint.
|
Impact:
A remote user can create HTML that, when loaded by the target user, will execute arbitrary code on the target user's system.
|
Solution:
The vendor has issued a fix (3.2.3), available via the Apple Software Update application, or Apple's Safari download site at:
http://www.apple.com/safari/download/
Safari for Mac OS X v10.5.7
The download file is named: Safari3.2.3Leo.dmg
Its SHA-1 digest is: d2e994d0c7125777e396d6c6a056f1222987944e
Safari for Mac OS X v10.4.11
The download file is named: Safari3.2.3Ti.dmg
Its SHA-1 digest is: 3c194ab0f1fa99531f4f1648d34878e9927371af
Safari for Windows XP or Vista
The download file is named: SafariSetup.exe
Its SHA-1 digest is: 54b707e636557720d52526e33262e1a44e8093a6
Safari+QuickTime for Windows XP or Vista
The file is named: SafariQuickTimeSetup.exe
Its SHA-1 digest is: 215e482adbaa1561ca2b90deb65b397894680f36
The vendor's advisory will be available at:
http://support.apple.com/kb/HT1222
|
Vendor URL: www.apple.com/ (Links to External Site)
|
Cause:
Boundary error
|
Underlying OS: UNIX (macOS/OS X), Windows (Vista), Windows (XP)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Subject: APPLE-SA-2009-05-12 Safari 3.2.3
|
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
APPLE-SA-2009-05-12 Safari 3.2.3
Safari 3.2.3 is now available and addresses the following:
libxml
CVE-ID: CVE-2008-3529
Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11,
Mac OS X v10.5.7, Mac OS X Server v10.5.7, Windows XP or Vista
Impact: Visiting a maliciously crafted website may lead to an
unexpected application termination or arbitrary code execution
Description: A heap buffer overflow exists in libxml's handling of
long entity names. Visiting a maliciously crafted website may lead to
an unexpected application termination or arbitrary code execution.
This update addresses the issue through improved bounds checking.
Safari 3.2.3 is included in the Mac OS X v10.5.7 update. Safari 3.2.3
on Mac OS X requires either Mac OS X v10.5.7, or Mac OS X v10.4.11
with Security Update 2009-002 installed.
Safari
CVE-ID: CVE-2009-0162
Available for: Mac OS X v10.5.7, Mac OS X Server v10.5.7,
Windows XP or Vista
Impact: Accessing a maliciously crafted "feed:" URL may lead to
arbitrary code execution
Description: Multiple input validation issues exist in Safari's
handling of "feed:" URLs. Accessing a maliciously crafted "feed:" URL
may lead to the execution of arbitrary JavaScript. This update
addresses the issues by performing additional validation of "feed:"
URLs. These issues do not affect systems prior to Mac OS X v10.5.
Safari 3.2.3 is included in the Mac OS X v10.5.7 update. Credit to
Billy Rios and Microsoft Vulnerability Research (MSVR), and Alfredo
Melloni for reporting these issues.
WebKit
CVE-ID: CVE-2009-0945
Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11,
Mac OS X v10.5.7, Mac OS X Server v10.5.7, Windows XP or Vista
Impact: Visiting a maliciously crafted website may lead to arbitrary
code execution
Description: A memory corruption issue exists in WebKit's handling
of SVGList objects. Visiting a maliciously crafted website may lead
to arbitrary code execution. This update addresses the issue through
improved bounds checking. Safari 3.2.3 is included in the Mac OS X
v10.5.7 update. Safari 3.2.3 on Mac OS X requires either Mac OS X
v10.5.7, or Mac OS X v10.4.11 with Security Update 2009-002
installed. Credit to Nils working with TippingPoint's Zero Day
Initiative for reporting this issue.
Safari 3.2.3 is available via the Apple Software Update application,
or Apple's Safari download site at:
http://www.apple.com/safari/download/
Safari for Mac OS X v10.5.7
The download file is named: Safari3.2.3Leo.dmg
Its SHA-1 digest is: d2e994d0c7125777e396d6c6a056f1222987944e
Safari for Mac OS X v10.4.11
The download file is named: Safari3.2.3Ti.dmg
Its SHA-1 digest is: 3c194ab0f1fa99531f4f1648d34878e9927371af
Safari for Windows XP or Vista
The download file is named: SafariSetup.exe
Its SHA-1 digest is: 54b707e636557720d52526e33262e1a44e8093a6
Safari+QuickTime for Windows XP or Vista
The file is named: SafariQuickTimeSetup.exe
Its SHA-1 digest is: 215e482adbaa1561ca2b90deb65b397894680f36
Information will also be posted to the Apple Security Updates
web site: http://support.apple.com/kb/HT1222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.9 (Darwin)
iQEcBAEBAgAGBQJKCbCgAAoJEHkodeiKZIkBYIYH/RgKY6f0Gc8uRpwY5WiyOkU9
uPIEBJG9z/JHSQAHFUPQkBt+pX5/glxGJynxcOwgGEqX7nUSHIp4TteuxFAExMwo
9u+JXnhVXjiZv7jGKLUE2KhnuweL/doIC74uYjSguViFASFpBTKAqpV/mqzrEPys
IWsm8HYR5DXSw7d1QipkzormuXSmm0hwl8+tNVMLOqIBaq4nDAUIjHeRKCjHTkd1
Xo1/GMtqcFaFexvtbrKe6Ut/etS8NJPLpetMjNxOw5qZDZiP9MV2EviKRQ2TVXG0
9MIe6rxVDfwLQGAF9rTgtfpqiheojzWcxU0OzqDoJFVDWO5KAvdN8CW6yBpnOVA=
=4rJD
-----END PGP SIGNATURE-----
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Security-announce mailing list (Security-announce@lists.apple.com)
|
|
