WebKit 'Canvas' SVG Image Capture Remote Information Disclosure Vulnerability

Bugtraq ID:	35331
Class:	Access Validation Error
CVE:	CVE-2009-1693
Remote:	Yes
Local:	No
Published:	Jun 08 2009 12:00AM
Updated:	Dec 14 2009 08:53PM
Credit:	Chris Evans of Google
Vulnerable:	WebKit Open Source Project WebKit 0 Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0 Apple Safari 3.2.3 for Windows Apple Safari 3.2.3 Apple Safari 3.2.2 for Windows Apple Safari 3.1.2 for Windows Apple Safari 3.1.2 Apple Safari 3.1.1 for Windows Apple Safari 3.1.1 Apple Safari 3.0.4 Beta for Windows Apple Safari 3.0.3 Beta for Windows Apple Safari 3.0.3 Beta Apple Safari 3.0.2 Beta for Windows Apple Safari 3.0.2 Beta Apple Safari 3.0.1 Beta for Windows Apple Safari 3.0.1 Beta Apple Safari 3.2 Apple Safari 3.1 for Windows Apple Safari 3.1 Apple Safari 3 Beta for Windows Apple Safari 3 Beta Apple Safari 3 Apple iPod Touch 2.2.1 Apple iPod Touch 2.0.2 Apple iPod Touch 2.0.1 Apple iPod Touch 1.1.4 Apple iPod Touch 1.1.3 Apple iPod Touch 1.1.2 Apple iPod Touch 1.1.1 Apple iPod Touch 2.2 Apple iPod Touch 2.1 Apple iPod Touch 2.0 Apple iPod Touch 1.1 Apple iPhone 2.2.1 Apple iPhone 2.0.2 Apple iPhone 2.0.1 Apple iPhone 1.1.4 Apple iPhone 1.1.3 Apple iPhone 1.1.2 Apple iPhone 1.1.1 Apple iPhone 1.0.2 Apple iPhone 1.0.1 Apple iPhone 2.2 Apple iPhone 2.1 Apple iPhone 2.0 Apple iPhone 1.1 Apple iPhone 1
Not Vulnerable:	Apple Safari 4 for Windows Apple Safari 4 Apple iPod Touch 3.0 Apple iPhone 3.0

WebKit 'Canvas' SVG Image Capture Remote Information Disclosure Vulnerability

WebKit is prone to a remote information-disclosure vulnerability.

An attacker can exploit this issue to obtain sensitive information that may aid in further attacks.

NOTE: This issue was previously covered in BID 35260 (Apple Safari Prior to 4.0 Multiple Security Vulnerabilities), but has been assigned its own record to better document it.

WebKit 'Canvas' SVG Image Capture Remote Information Disclosure Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

WebKit 'Canvas' SVG Image Capture Remote Information Disclosure Vulnerability

Solution:
Vendor updates are available. Please see the references for details.


Apple Safari 3

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Debian Linux 5.0 ia-64

• Debian libwebkit-1.0-1-dbg_1.0.1-4+lenny2_ia64.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1- dbg_1.0.1-4+lenny2_ia64.deb


• Debian libwebkit-1.0-1_1.0.1-4+lenny2_ia64.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_ 1.0.1-4+lenny2_ia64.deb


• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Debian Linux 5.0 alpha

• Debian libwebkit-1.0-1-dbg_1.0.1-4+lenny2_alpha.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1- dbg_1.0.1-4+lenny2_alpha.deb


• Debian libwebkit-1.0-1_1.0.1-4+lenny2_alpha.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_ 1.0.1-4+lenny2_alpha.deb


• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Debian Linux 5.0 ia-32

• Debian libwebkit-1.0-1-dbg_1.0.1-4+lenny2_i386.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1- dbg_1.0.1-4+lenny2_i386.deb


• Debian libwebkit-1.0-1_1.0.1-4+lenny2_i386.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_ 1.0.1-4+lenny2_i386.deb


• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Debian Linux 5.0 s/390

• Debian libwebkit-1.0-1-dbg_1.0.1-4+lenny2_s390.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1- dbg_1.0.1-4+lenny2_s390.deb


• Debian libwebkit-1.0-1_1.0.1-4+lenny2_s390.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_ 1.0.1-4+lenny2_s390.deb


• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Apple Safari 3 Beta for Windows

• Apple SafariQuickTimeSetup.exe
  Safari4
  http://www.apple.com/safari/download/


• Apple SafariSetup.exe
  Safari4
  http://www.apple.com/safari/download/

Debian Linux 5.0 mipsel

• Debian libwebkit-1.0-1-dbg_1.0.1-4+lenny2_mipsel.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1- dbg_1.0.1-4+lenny2_mipsel.deb


• Debian libwebkit-1.0-1_1.0.1-4+lenny2_mipsel.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_ 1.0.1-4+lenny2_mipsel.deb


• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Apple Safari 3.1 for Windows

• Apple SafariQuickTimeSetup.exe
  Safari4
  http://www.apple.com/safari/download/


• Apple SafariSetup.exe
  Safari4
  http://www.apple.com/safari/download/

Debian Linux 5.0 hppa

• Debian libwebkit-1.0-1-dbg_1.0.1-4+lenny2_hppa.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1- dbg_1.0.1-4+lenny2_hppa.deb


• Debian libwebkit-1.0-1_1.0.1-4+lenny2_hppa.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_ 1.0.1-4+lenny2_hppa.deb


• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Apple Safari 3.2

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 3.1

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Debian Linux 5.0 m68k

• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Debian Linux 5.0 arm

• Debian libwebkit-1.0-1-dbg_1.0.1-4+lenny2_arm.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1- dbg_1.0.1-4+lenny2_arm.deb


• Debian libwebkit-1.0-1_1.0.1-4+lenny2_arm.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_ 1.0.1-4+lenny2_arm.deb


• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Debian Linux 5.0 armel

• Debian libwebkit-1.0-1-dbg_1.0.1-4+lenny2_armel.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1- dbg_1.0.1-4+lenny2_armel.deb


• Debian libwebkit-1.0-1_1.0.1-4+lenny2_armel.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_ 1.0.1-4+lenny2_armel.deb


• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Debian Linux 5.0

• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Debian Linux 5.0 amd64

• Debian libwebkit-1.0-1-dbg_1.0.1-4+lenny2_amd64.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1- dbg_1.0.1-4+lenny2_amd64.deb


• Debian libwebkit-1.0-1_1.0.1-4+lenny2_amd64.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_ 1.0.1-4+lenny2_amd64.deb


• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Debian Linux 5.0 mips

• Debian libwebkit-1.0-1-dbg_1.0.1-4+lenny2_mips.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1- dbg_1.0.1-4+lenny2_mips.deb


• Debian libwebkit-1.0-1_1.0.1-4+lenny2_mips.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_ 1.0.1-4+lenny2_mips.deb


• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Debian Linux 5.0 powerpc

• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Apple Safari 3 Beta

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Debian Linux 5.0 sparc

• Debian libwebkit-1.0-1-dbg_1.0.1-4+lenny2_sparc.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1- dbg_1.0.1-4+lenny2_sparc.deb


• Debian libwebkit-1.0-1_1.0.1-4+lenny2_sparc.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-1.0-1_ 1.0.1-4+lenny2_sparc.deb


• Debian libwebkit-dev_1.0.1-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/w/webkit/libwebkit-dev_1. 0.1-4+lenny2_all.deb

Apple Safari 3.0.1 Beta

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 3.0.1 Beta for Windows

• Apple SafariQuickTimeSetup.exe
  Safari4
  http://www.apple.com/safari/download/


• Apple SafariSetup.exe
  Safari4
  http://www.apple.com/safari/download/

Apple Safari 3.0.2 Beta

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 3.0.2 Beta for Windows

• Apple SafariQuickTimeSetup.exe
  Safari4
  http://www.apple.com/safari/download/


• Apple SafariSetup.exe
  Safari4
  http://www.apple.com/safari/download/

Apple Safari 3.0.3 Beta

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 3.0.3 Beta for Windows

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 3.0.4 Beta for Windows

• Apple SafariQuickTimeSetup.exe
  Safari4
  http://www.apple.com/safari/download/


• Apple SafariSetup.exe
  Safari4
  http://www.apple.com/safari/download/

Apple Safari 3.1.1

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 3.1.1 for Windows

• Apple SafariQuickTimeSetup.exe
  Safari4
  http://www.apple.com/safari/download/


• Apple SafariSetup.exe
  Safari4
  http://www.apple.com/safari/download/

Apple Safari 3.1.2 for Windows

• Apple SafariQuickTimeSetup.exe
  Safari4
  http://www.apple.com/safari/download/


• Apple SafariSetup.exe
  Safari4
  http://www.apple.com/safari/download/

Apple Safari 3.1.2

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 3.2.2 for Windows

• Apple SafariQuickTimeSetup.exe
  Safari4
  http://www.apple.com/safari/download/


• Apple SafariSetup.exe
  Safari4
  http://www.apple.com/safari/download/

Apple Safari 3.2.3

• Apple Safari4.0Leo.dmg
  http://www.apple.com/safari/download/


• Apple Safari4.0Ti.dmg
  http://www.apple.com/safari/download/

Apple Safari 3.2.3 for Windows

• Apple SafariQuickTimeSetup.exe
  Safari4
  http://www.apple.com/safari/download/


• Apple SafariSetup.exe
  Safari4
  http://www.apple.com/safari/download/

WebKit 'Canvas' SVG Image Capture Remote Information Disclosure Vulnerability

References:

• About the security content of iPhone OS 3.0 Software Update (Apple)
  
• iPhone Product Page (Apple)
  
• iPod touch Product Page (Apple)
  
• Safari Homepage (Apple)
  
• WebKit Homepage (WebKit Open Source Project)