WebKit JavaScript 'onload()' Event Cross Domain Scripting Vulnerability

Bugtraq ID:	35315
Class:	Input Validation Error
CVE:	CVE-2009-1684
Remote:	Yes
Local:	No
Published:	Jun 08 2009 12:00AM
Updated:	Dec 14 2009 08:33PM
Credit:	Michal Zalewski of Google Inc.
Vulnerable:	WebKit Open Source Project WebKit 0 Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0 Apple Safari For Windows 3.2.1 Apple Safari 3.2.3 for Windows Apple Safari 3.2.3 Apple Safari 3.2.2 for Windows Apple Safari 3.1.2 for Windows Apple Safari 3.1.2 Apple Safari 3.1.1 for Windows Apple Safari 3.1.1 Apple Safari 3.0.4 Beta for Windows Apple Safari 3.0.3 Beta for Windows Apple Safari 3.0.3 Beta Apple Safari 3.0.2 Beta for Windows Apple Safari 3.0.2 Beta Apple Safari 3.0.1 Beta for Windows Apple Safari 3.0.1 Beta Apple Safari 2.0.4 Apple Safari 2.0.3 Apple Safari 2.0.2 Apple Safari 2.0.1 + Apple Mac OS X 10.4.2 + Apple Mac OS X 10.4.1 + Apple Mac OS X 10.4 + Apple Mac OS X Server 10.4.2 + Apple Mac OS X Server 10.4.1 + Apple Mac OS X Server 10.4 Apple Safari 1.3.2 Apple Safari 1.3.1 + Apple Mac OS X 10.3.9 Apple Safari 1.3 + Apple Mac OS X 10.3.9 Apple Safari 1.2.3 Apple Safari 1.2.2 Apple Safari 1.2.1 Apple Safari 1.2 + Apple Mac OS X 10.3.7 + Apple Mac OS X 10.3.7 + Apple Mac OS X 10.3.6 + Apple Mac OS X 10.3.6 + Apple Mac OS X 10.3.5 + Apple Mac OS X 10.3.5 + Apple Mac OS X 10.3.4 + Apple Mac OS X 10.3.4 + Apple Mac OS X 10.3.3 + Apple Mac OS X 10.3.3 + Apple Mac OS X 10.3.2 + Apple Mac OS X 10.3.2 + Apple Mac OS X 10.3.1 + Apple Mac OS X 10.3.1 + Apple Mac OS X 10.3 + Apple Mac OS X 10.3 + Apple Mac OS X 10.2.8 + Apple Mac OS X 10.2.8 + Apple Mac OS X 10.2.7 + Apple Mac OS X 10.2.7 + Apple Mac OS X 10.2.6 + Apple Mac OS X 10.2.6 + Apple Mac OS X 10.2.5 + Apple Mac OS X 10.2.5 + Apple Mac OS X 10.2.4 + Apple Mac OS X 10.2.4 + Apple Mac OS X 10.2.3 + Apple Mac OS X 10.2.3 + Apple Mac OS X 10.2.2 + Apple Mac OS X 10.2.2 + Apple Mac OS X 10.2.1 + Apple Mac OS X 10.2.1 + Apple Mac OS X 10.2 + Apple Mac OS X 10.2 + Apple Mac OS X Server 10.3.7 + Apple Mac OS X Server 10.3.6 + Apple Mac OS X Server 10.3.6 + Apple Mac OS X Server 10.3.5 + Apple Mac OS X Server 10.3.5 + Apple Mac OS X Server 10.3.4 + Apple Mac OS X Server 10.3.4 + Apple Mac OS X Server 10.3.3 + Apple Mac OS X Server 10.3.3 + Apple Mac OS X Server 10.3.2 + Apple Mac OS X Server 10.3.2 + Apple Mac OS X Server 10.3.1 + Apple Mac OS X Server 10.3.1 + Apple Mac OS X Server 10.3 + Apple Mac OS X Server 10.3 + Apple Mac OS X Server 10.2.8 + Apple Mac OS X Server 10.2.8 + Apple Mac OS X Server 10.2.7 + Apple Mac OS X Server 10.2.7 + Apple Mac OS X Server 10.2.6 + Apple Mac OS X Server 10.2.6 + Apple Mac OS X Server 10.2.5 + Apple Mac OS X Server 10.2.5 + Apple Mac OS X Server 10.2.4 + Apple Mac OS X Server 10.2.4 + Apple Mac OS X Server 10.2.3 + Apple Mac OS X Server 10.2.3 + Apple Mac OS X Server 10.2.2 + Apple Mac OS X Server 10.2.2 + Apple Mac OS X Server 10.2.1 + Apple Mac OS X Server 10.2.1 + Apple Mac OS X Server 10.2 + Apple Mac OS X Server 10.2 Apple Safari 1.1 Apple Safari 1.0 + Apple Mac OS X 10.2.8 + Apple Mac OS X 10.2.8 + Apple Mac OS X 10.2.7 + Apple Mac OS X 10.2.7 + Apple Mac OS X 10.2.6 + Apple Mac OS X 10.2.6 + Apple Mac OS X 10.2.5 + Apple Mac OS X 10.2.5 + Apple Mac OS X 10.2.4 + Apple Mac OS X 10.2.4 + Apple Mac OS X 10.2.3 + Apple Mac OS X 10.2.3 + Apple Mac OS X 10.2.2 + Apple Mac OS X 10.2.2 + Apple Mac OS X 10.2.1 + Apple Mac OS X 10.2.1 + Apple Mac OS X 10.2 + Apple Mac OS X 10.2 + Apple Mac OS X Server 10.2.8 + Apple Mac OS X Server 10.2.7 + Apple Mac OS X Server 10.2.7 + Apple Mac OS X Server 10.2.6 + Apple Mac OS X Server 10.2.6 + Apple Mac OS X Server 10.2.5 + Apple Mac OS X Server 10.2.5 + Apple Mac OS X Server 10.2.4 + Apple Mac OS X Server 10.2.4 + Apple Mac OS X Server 10.2.3 + Apple Mac OS X Server 10.2.3 + Apple Mac OS X Server 10.2.2 + Apple Mac OS X Server 10.2.2 + Apple Mac OS X Server 10.2.1 + Apple Mac OS X Server 10.2.1 + Apple Mac OS X Server 10.2 + Apple Mac OS X Server 10.2 Apple Safari Beta 2 Apple Safari 4 Beta Apple Safari 4 Beta Apple Safari 3.2 Apple Safari 3.1 for Windows Apple Safari 3.1 Apple Safari 3 Beta for Windows Apple Safari 3 Beta Apple Safari 3
Not Vulnerable:	Apple Safari 4 for Windows Apple Safari 4

WebKit JavaScript 'onload()' Event Cross Domain Scripting Vulnerability

WebKit is prone to a cross-domain scripting vulnerability because it fails to properly restrict the access of JavaScript code when loading new webpages.

A remote attacker can exploit this vulnerability to bypass the same-origin policy and obtain potentially sensitive information or to launch spoofing attacks against other sites. Other attacks are also possible.

NOTE: This issue was previously covered in BID 35260 (Apple Safari Prior to 4.0 Multiple Security Vulnerabilities), but has been assigned its own record to better document it.

WebKit JavaScript 'onload()' Event Cross Domain Scripting Vulnerability

To exploit this issue, an attacker must entice an unsuspecting victim into visiting a malicious webpage.

The following proof of concept is available:

• /data/vulnerabilities/exploits/35135.html

WebKit JavaScript 'onload()' Event Cross Domain Scripting Vulnerability

Solution:
Updates are available. Please see the references for details.


Apple Safari 3

• Apple SafariQuickTimeSetup.exe
  Safari+QuickTime for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple SafariSetup.exe
  Safari for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Debian Linux 5.0 ia-64

• Debian libwebkit-1.0-1-dbg_1.0.1-4+lenny2_ia64.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1- dbg_1.0.1-4+lenny2_ia64.deb


• Debian libwebkit-1.0-1_1.0.1-4+lenny2_ia64.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_ 1.0.1-4+lenny2_ia64.deb


• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Debian Linux 5.0 alpha

• Debian libwebkit-1.0-1-dbg_1.0.1-4+lenny2_alpha.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1- dbg_1.0.1-4+lenny2_alpha.deb


• Debian libwebkit-1.0-1_1.0.1-4+lenny2_alpha.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_ 1.0.1-4+lenny2_alpha.deb


• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Debian Linux 5.0 ia-32

• Debian libwebkit-1.0-1-dbg_1.0.1-4+lenny2_i386.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1- dbg_1.0.1-4+lenny2_i386.deb


• Debian libwebkit-1.0-1_1.0.1-4+lenny2_i386.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_ 1.0.1-4+lenny2_i386.deb


• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Debian Linux 5.0 s/390

• Debian libwebkit-1.0-1-dbg_1.0.1-4+lenny2_s390.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1- dbg_1.0.1-4+lenny2_s390.deb


• Debian libwebkit-1.0-1_1.0.1-4+lenny2_s390.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_ 1.0.1-4+lenny2_s390.deb


• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Apple Safari 3 Beta for Windows

• Apple SafariQuickTimeSetup.exe
  Safari+QuickTime for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple SafariSetup.exe
  Safari for Windows XP or Vista
  http://www.apple.com/safari/download/

Debian Linux 5.0 mipsel

• Debian libwebkit-1.0-1-dbg_1.0.1-4+lenny2_mipsel.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1- dbg_1.0.1-4+lenny2_mipsel.deb


• Debian libwebkit-1.0-1_1.0.1-4+lenny2_mipsel.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_ 1.0.1-4+lenny2_mipsel.deb


• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Apple Safari 3.1 for Windows

• Apple SafariQuickTimeSetup.exe
  Safari+QuickTime for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple SafariSetup.exe
  Safari for Windows XP or Vista
  http://www.apple.com/safari/download/

Apple Safari 4 Beta

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Debian Linux 5.0 hppa

• Debian libwebkit-1.0-1-dbg_1.0.1-4+lenny2_hppa.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1- dbg_1.0.1-4+lenny2_hppa.deb


• Debian libwebkit-1.0-1_1.0.1-4+lenny2_hppa.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_ 1.0.1-4+lenny2_hppa.deb


• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Apple Safari 3.1

• Apple SafariQuickTimeSetup.exe
  Safari+QuickTime for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple SafariSetup.exe
  Safari for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 3.2

• Apple SafariQuickTimeSetup.exe
  Safari+QuickTime for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple SafariSetup.exe
  Safari for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Debian Linux 5.0 m68k

• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Debian Linux 5.0 arm

• Debian libwebkit-1.0-1-dbg_1.0.1-4+lenny2_arm.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1- dbg_1.0.1-4+lenny2_arm.deb


• Debian libwebkit-1.0-1_1.0.1-4+lenny2_arm.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_ 1.0.1-4+lenny2_arm.deb


• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Debian Linux 5.0 armel

• Debian libwebkit-1.0-1-dbg_1.0.1-4+lenny2_armel.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1- dbg_1.0.1-4+lenny2_armel.deb


• Debian libwebkit-1.0-1_1.0.1-4+lenny2_armel.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_ 1.0.1-4+lenny2_armel.deb


• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Debian Linux 5.0

• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Apple Safari 4 Beta

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Debian Linux 5.0 amd64

• Debian libwebkit-1.0-1-dbg_1.0.1-4+lenny2_amd64.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1- dbg_1.0.1-4+lenny2_amd64.deb


• Debian libwebkit-1.0-1_1.0.1-4+lenny2_amd64.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_ 1.0.1-4+lenny2_amd64.deb


• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Apple Safari Beta 2

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Debian Linux 5.0 mips

• Debian libwebkit-1.0-1-dbg_1.0.1-4+lenny2_mips.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1- dbg_1.0.1-4+lenny2_mips.deb


• Debian libwebkit-1.0-1_1.0.1-4+lenny2_mips.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_ 1.0.1-4+lenny2_mips.deb


• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Debian Linux 5.0 powerpc

• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Apple Safari 3 Beta

• Apple SafariQuickTimeSetup.exe
  Safari+QuickTime for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple SafariSetup.exe
  Safari for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Debian Linux 5.0 sparc

• Debian libwebkit-1.0-1-dbg_1.0.1-4+lenny2_sparc.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1- dbg_1.0.1-4+lenny2_sparc.deb


• Debian libwebkit-1.0-1_1.0.1-4+lenny2_sparc.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_ 1.0.1-4+lenny2_sparc.deb


• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Apple Safari 1.0

• Apple SafariQuickTimeSetup.exe
  Safari+QuickTime for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple SafariSetup.exe
  Safari for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 1.1

• Apple SafariQuickTimeSetup.exe
  Safari+QuickTime for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple SafariSetup.exe
  Safari for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 1.2

• Apple SafariQuickTimeSetup.exe
  Safari+QuickTime for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple SafariSetup.exe
  Safari for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 1.2.1

• Apple SafariQuickTimeSetup.exe
  Safari+QuickTime for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple SafariSetup.exe
  Safari for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 1.2.2

• Apple SafariQuickTimeSetup.exe
  Safari+QuickTime for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple SafariSetup.exe
  Safari for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 1.2.3

• Apple SafariQuickTimeSetup.exe
  Safari+QuickTime for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple SafariSetup.exe
  Safari for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 1.3

• Apple SafariQuickTimeSetup.exe
  Safari+QuickTime for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple SafariSetup.exe
  Safari for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 1.3.1

• Apple SafariQuickTimeSetup.exe
  Safari+QuickTime for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple SafariSetup.exe
  Safari for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 1.3.2

• Apple SafariQuickTimeSetup.exe
  Safari+QuickTime for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple SafariSetup.exe
  Safari for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 2.0.1

• Apple SafariQuickTimeSetup.exe
  Safari+QuickTime for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple SafariSetup.exe
  Safari for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 2.0.2

• Apple SafariQuickTimeSetup.exe
  Safari+QuickTime for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple SafariSetup.exe
  Safari for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 2.0.3

• Apple SafariQuickTimeSetup.exe
  Safari+QuickTime for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple SafariSetup.exe
  Safari for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 2.0.4

• Apple SafariQuickTimeSetup.exe
  Safari+QuickTime for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple SafariSetup.exe
  Safari for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 3.0.1 Beta

• Apple SafariQuickTimeSetup.exe
  Safari+QuickTime for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple SafariSetup.exe
  Safari for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 3.0.1 Beta for Windows

• Apple SafariQuickTimeSetup.exe
  Safari+QuickTime for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple SafariSetup.exe
  Safari for Windows XP or Vista
  http://www.apple.com/safari/download/

Apple Safari 3.0.2 Beta

• Apple SafariQuickTimeSetup.exe
  Safari+QuickTime for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple SafariSetup.exe
  Safari for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 3.0.2 Beta for Windows

• Apple SafariQuickTimeSetup.exe
  Safari+QuickTime for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple SafariSetup.exe
  Safari for Windows XP or Vista
  http://www.apple.com/safari/download/

Apple Safari 3.0.3 Beta

• Apple SafariQuickTimeSetup.exe
  Safari+QuickTime for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple SafariSetup.exe
  Safari for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 3.0.3 Beta for Windows

• Apple SafariQuickTimeSetup.exe
  Safari+QuickTime for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple SafariSetup.exe
  Safari for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 3.0.4 Beta for Windows

• Apple SafariQuickTimeSetup.exe
  Safari+QuickTime for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple SafariSetup.exe
  Safari for Windows XP or Vista
  http://www.apple.com/safari/download/

Apple Safari 3.1.1

• Apple SafariQuickTimeSetup.exe
  Safari+QuickTime for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple SafariSetup.exe
  Safari for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 3.1.1 for Windows

• Apple SafariQuickTimeSetup.exe
  Safari+QuickTime for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple SafariSetup.exe
  Safari for Windows XP or Vista
  http://www.apple.com/safari/download/

Apple Safari 3.1.2 for Windows

• Apple SafariQuickTimeSetup.exe
  Safari+QuickTime for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple SafariSetup.exe
  Safari for Windows XP or Vista
  http://www.apple.com/safari/download/

Apple Safari 3.1.2

• Apple SafariQuickTimeSetup.exe
  Safari+QuickTime for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple SafariSetup.exe
  Safari for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari For Windows 3.2.1

• Apple SafariQuickTimeSetup.exe
  Safari+QuickTime for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple SafariSetup.exe
  Safari for Windows XP or Vista
  http://www.apple.com/safari/download/

Apple Safari 3.2.2 for Windows

• Apple SafariQuickTimeSetup.exe
  Safari+QuickTime for Windows XP or Vista
  http://www.apple.com/safari/download/


• Apple SafariSetup.exe
  Safari for Windows XP or Vista
  http://www.apple.com/safari/download/

Apple Safari 3.2.3

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

WebKit JavaScript 'onload()' Event Cross Domain Scripting Vulnerability

References:

• Apple Safari Homepage (Apple)
  
• WebKit Homepage (WebKit Open Source Project)
  
• catching up on several recently fixed bugs of note (Michal Zalewski )