Webkit HTML Document Fragments Cross Site Scripting Vulnerability

Bugtraq ID:	40675
Class:	Input Validation Error
CVE:	CVE-2010-1394
Remote:	Yes
Local:	No
Published:	Jun 07 2010 12:00AM
Updated:	Mar 19 2015 09:21AM
Credit:	Eduardo Vela Nava (sirdarckcat) of Google Inc.
Vulnerable:	WebKit Open Source Project WebKit 1.2.3 WebKit Open Source Project WebKit 1.2.2 WebKit Open Source Project WebKit r52833 WebKit Open Source Project WebKit r52401 WebKit Open Source Project WebKit r51295 WebKit Open Source Project WebKit r38566 WebKit Open Source Project WebKit 1.2.2-1 WebKit Open Source Project WebKit 0 Ubuntu Ubuntu Linux 9.10 sparc Ubuntu Ubuntu Linux 9.10 powerpc Ubuntu Ubuntu Linux 9.10 lpia Ubuntu Ubuntu Linux 9.10 i386 Ubuntu Ubuntu Linux 9.10 amd64 Ubuntu Ubuntu Linux 10.10 powerpc Ubuntu Ubuntu Linux 10.10 i386 Ubuntu Ubuntu Linux 10.10 amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 amd64 Mandriva Linux Mandrake 2010.1 x86_64 Mandriva Linux Mandrake 2010.1 Apple Safari 4.0.5 for Windows Apple Safari 4.0.5 Apple Safari 4.0.4 for Windows Apple Safari 4.0.4 Apple Safari 4.0.3 for Windows Apple Safari 4.0.3 Apple Safari 4.0.2 for Windows Apple Safari 4.0.2 Apple Safari 4.0.1 Apple Safari 4 for Windows Apple Safari 4 Beta Apple Safari 4 Apple iPod Touch 3.1.3 Apple iPod Touch 3.1.2 Apple iPod Touch 3.1.1 Apple iPod Touch 2.2.1 Apple iPod Touch 2.0.2 Apple iPod Touch 2.0.1 Apple iPod Touch 3.0 Apple iPod Touch 2.2 Apple iPod Touch 2.1 Apple iPod Touch 2.0 Apple iPhone 3.1.3 Apple iPhone 3.1.2 Apple iPhone 3.0.1 Apple iPhone 2.2.1 Apple iPhone 2.0.2 Apple iPhone 2.0.1 Apple iPhone 3.1 Apple iPhone 3.0 Apple iPhone 2.2 Apple iPhone 2.1 Apple iPhone 2.0 Apple iPad 3.2.1 Apple iPad 3.2.2 Apple iPad 3.2 Apple iPad 0 Apple iOS 4.0.2 Apple iOS 4.0.1 Apple iOS 3.2.2 Apple iOS 3.2.1 Apple iOS 4.2 beta Apple iOS 4.1 Apple iOS 4 Apple iOS 3.2
Not Vulnerable:	WebKit Open Source Project WebKit 1.2.5 Apple Safari 5.0 for Windows Apple Safari 5.0 Apple Safari 4.1 Apple iOS 4.2 Apple iOS 4

Webkit HTML Document Fragments Cross Site Scripting Vulnerability

WebKit is prone to a cross-site scripting vulnerability caused by the mishandling of HTML document fragments.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

NOTE: This issue was previously covered in BID 40620 (Apple Safari Prior to 5.0 and 4.1 Multiple Security Vulnerabilities) but has been given its own record to better document it.

Webkit HTML Document Fragments Cross Site Scripting Vulnerability

Attackers can exploit this issue by enticing an unsuspecting victim into following a malicious URI.

Webkit HTML Document Fragments Cross Site Scripting Vulnerability

Solution:
Updates are available. Please see the references for more information.


Apple Safari 4

• Apple Safari4.1Tiger.dmg
  http://www.apple.com/safari/download/


• Apple Safari5.0Leopard.dmg
  http://www.apple.com/safari/download/


• Apple Safari5.0SnowLeopard.dmg
  http://www.apple.com/safari/download/

Ubuntu Ubuntu Linux 9.10 sparc

• Ubuntu libwebkit-1.0-2-dbg_1.2.5-0ubuntu0.9.10.1_sparc.deb
  http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-1.0-2-dbg_1.2.5-0 ubuntu0.9.10.1_sparc.deb


• Ubuntu libwebkit-1.0-2_1.2.5-0ubuntu0.9.10.1_sparc.deb
  http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-1.0-2_1.2.5-0ubun tu0.9.10.1_sparc.deb


• Ubuntu libwebkit-1.0-common_1.2.5-0ubuntu0.9.10.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-com mon_1.2.5-0ubuntu0.9.10.1_all.deb


• Ubuntu libwebkit-dev_1.2.5-0ubuntu0.9.10.1_sparc.deb
  http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-dev_1.2.5-0ubuntu 0.9.10.1_sparc.deb

Apple Safari 4 for Windows

• Apple Safari_Setup-safari5.exe
  http://www.apple.com/safari/download/


• Apple SafariQuickTimeSetup-safari5.exe
  http://www.apple.com/safari/download/


• Apple SafariSetup-safari5.exe
  http://www.apple.com/safari/download/

Ubuntu Ubuntu Linux 9.10 powerpc

• Ubuntu libwebkit-1.0-2-dbg_1.2.5-0ubuntu0.9.10.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-1.0-2-dbg_1.2.5-0 ubuntu0.9.10.1_powerpc.deb


• Ubuntu libwebkit-1.0-2_1.2.5-0ubuntu0.9.10.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-1.0-2_1.2.5-0ubun tu0.9.10.1_powerpc.deb


• Ubuntu libwebkit-1.0-common_1.2.5-0ubuntu0.9.10.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-com mon_1.2.5-0ubuntu0.9.10.1_all.deb


• Ubuntu libwebkit-dev_1.2.5-0ubuntu0.9.10.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-dev_1.2.5-0ubuntu 0.9.10.1_powerpc.deb

Ubuntu Ubuntu Linux 9.10 lpia

• Ubuntu libwebkit-1.0-2-dbg_1.2.5-0ubuntu0.9.10.1_lpia.deb
  http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-1.0-2-dbg_1.2.5-0 ubuntu0.9.10.1_lpia.deb


• Ubuntu libwebkit-1.0-2_1.2.5-0ubuntu0.9.10.1_lpia.deb
  http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-1.0-2_1.2.5-0ubun tu0.9.10.1_lpia.deb


• Ubuntu libwebkit-1.0-common_1.2.5-0ubuntu0.9.10.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-com mon_1.2.5-0ubuntu0.9.10.1_all.deb


• Ubuntu libwebkit-dev_1.2.5-0ubuntu0.9.10.1_lpia.deb
  http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-dev_1.2.5-0ubuntu 0.9.10.1_lpia.deb

Mandriva Linux Mandrake 2010.1 x86_64

• Mandriva lib64webkitgtk1.0-devel-1.2.7-0.1mdv2010.2.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64webkitgtk1.0_2-1.2.7-0.1mdv2010.2.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva webkit-1.2.7-0.1mdv2010.2.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva webkit-gtklauncher-1.2.7-0.1mdv2010.2.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva webkit-jsc-1.2.7-0.1mdv2010.2.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva webkit1.0-1.2.7-0.1mdv2010.2.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva webkit1.0-webinspector-1.2.7-0.1mdv2010.2.x86_64.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 10.10 amd64

• Ubuntu gir1.0-webkit-1.0_1.2.5-0ubuntu0.10.10.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/universe/w/webkit/gir1.0-webkit -1.0_1.2.5-0ubuntu0.10.10.1_amd64.deb


• Ubuntu libwebkit-1.0-2-dbg_1.2.5-0ubuntu0.10.10.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-2-d bg_1.2.5-0ubuntu0.10.10.1_amd64.deb


• Ubuntu libwebkit-1.0-2_1.2.5-0ubuntu0.10.10.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-2_1 .2.5-0ubuntu0.10.10.1_amd64.deb


• Ubuntu libwebkit-1.0-common_1.2.5-0ubuntu0.10.10.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-com mon_1.2.5-0ubuntu0.10.10.1_all.deb


• Ubuntu libwebkit-dev_1.2.5-0ubuntu0.10.10.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-dev_1.2 .5-0ubuntu0.10.10.1_amd64.deb

Ubuntu Ubuntu Linux 10.04 powerpc

• Ubuntu gir1.0-webkit-1.0_1.2.5-0ubuntu0.10.04.1_powerpc.deb
  http://ports.ubuntu.com/pool/universe/w/webkit/gir1.0-webkit-1.0_1.2.5 -0ubuntu0.10.04.1_powerpc.deb


• Ubuntu libwebkit-1.0-2-dbg_1.2.5-0ubuntu0.10.04.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-1.0-2-dbg_1.2.5-0 ubuntu0.10.04.1_powerpc.deb


• Ubuntu libwebkit-1.0-2_1.2.5-0ubuntu0.10.04.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-1.0-2_1.2.5-0ubun tu0.10.04.1_powerpc.deb


• Ubuntu libwebkit-1.0-common_1.2.5-0ubuntu0.10.04.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-com mon_1.2.5-0ubuntu0.10.04.1_all.deb


• Ubuntu libwebkit-dev_1.2.5-0ubuntu0.10.04.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-dev_1.2.5-0ubuntu 0.10.04.1_powerpc.deb

Ubuntu Ubuntu Linux 9.10 i386

• Ubuntu libwebkit-1.0-2-dbg_1.2.5-0ubuntu0.9.10.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-2-d bg_1.2.5-0ubuntu0.9.10.1_i386.deb


• Ubuntu libwebkit-1.0-2_1.2.5-0ubuntu0.9.10.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-2_1 .2.5-0ubuntu0.9.10.1_i386.deb


• Ubuntu libwebkit-1.0-common_1.2.5-0ubuntu0.9.10.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-com mon_1.2.5-0ubuntu0.9.10.1_all.deb


• Ubuntu libwebkit-dev_1.2.5-0ubuntu0.9.10.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-dev_1.2 .5-0ubuntu0.9.10.1_i386.deb

Ubuntu Ubuntu Linux 10.04 amd64

• Ubuntu gir1.0-webkit-1.0_1.2.5-0ubuntu0.10.04.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/universe/w/webkit/gir1.0-webkit -1.0_1.2.5-0ubuntu0.10.04.1_amd64.deb


• Ubuntu libwebkit-1.0-2-dbg_1.2.5-0ubuntu0.10.04.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-2-d bg_1.2.5-0ubuntu0.10.04.1_amd64.deb


• Ubuntu libwebkit-1.0-2_1.2.5-0ubuntu0.10.04.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-2_1 .2.5-0ubuntu0.10.04.1_amd64.deb


• Ubuntu libwebkit-1.0-common_1.2.5-0ubuntu0.10.04.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-com mon_1.2.5-0ubuntu0.10.04.1_all.deb


• Ubuntu libwebkit-dev_1.2.5-0ubuntu0.10.04.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-dev_1.2 .5-0ubuntu0.10.04.1_amd64.deb

Ubuntu Ubuntu Linux 9.10 amd64

• Ubuntu libwebkit-1.0-2-dbg_1.2.5-0ubuntu0.9.10.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-2-d bg_1.2.5-0ubuntu0.9.10.1_amd64.deb


• Ubuntu libwebkit-1.0-2_1.2.5-0ubuntu0.9.10.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-2_1 .2.5-0ubuntu0.9.10.1_amd64.deb


• Ubuntu libwebkit-1.0-common_1.2.5-0ubuntu0.9.10.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-com mon_1.2.5-0ubuntu0.9.10.1_all.deb


• Ubuntu libwebkit-dev_1.2.5-0ubuntu0.9.10.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-dev_1.2 .5-0ubuntu0.9.10.1_amd64.deb

Ubuntu Ubuntu Linux 10.04 i386

• Ubuntu gir1.0-webkit-1.0_1.2.5-0ubuntu0.10.04.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/universe/w/webkit/gir1.0-webkit -1.0_1.2.5-0ubuntu0.10.04.1_i386.deb


• Ubuntu libwebkit-1.0-2-dbg_1.2.5-0ubuntu0.10.04.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-2-d bg_1.2.5-0ubuntu0.10.04.1_i386.deb


• Ubuntu libwebkit-1.0-2_1.2.5-0ubuntu0.10.04.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-2_1 .2.5-0ubuntu0.10.04.1_i386.deb


• Ubuntu libwebkit-1.0-common_1.2.5-0ubuntu0.10.04.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-com mon_1.2.5-0ubuntu0.10.04.1_all.deb


• Ubuntu libwebkit-dev_1.2.5-0ubuntu0.10.04.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-dev_1.2 .5-0ubuntu0.10.04.1_i386.deb

Mandriva Linux Mandrake 2010.1

• Mandriva libwebkitgtk1.0-devel-1.2.7-0.1mdv2010.2.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libwebkitgtk1.0_2-1.2.7-0.1mdv2010.2.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva webkit-1.2.7-0.1mdv2010.2.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva webkit-gtklauncher-1.2.7-0.1mdv2010.2.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva webkit-jsc-1.2.7-0.1mdv2010.2.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva webkit1.0-1.2.7-0.1mdv2010.2.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva webkit1.0-webinspector-1.2.7-0.1mdv2010.2.i586.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 10.10 powerpc

• Ubuntu gir1.0-webkit-1.0_1.2.5-0ubuntu0.10.10.1_powerpc.deb
  http://ports.ubuntu.com/pool/universe/w/webkit/gir1.0-webkit-1.0_1.2.5 -0ubuntu0.10.10.1_powerpc.deb


• Ubuntu libwebkit-1.0-2-dbg_1.2.5-0ubuntu0.10.10.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-1.0-2-dbg_1.2.5-0 ubuntu0.10.10.1_powerpc.deb


• Ubuntu libwebkit-1.0-2_1.2.5-0ubuntu0.10.10.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-1.0-2_1.2.5-0ubun tu0.10.10.1_powerpc.deb


• Ubuntu libwebkit-1.0-common_1.2.5-0ubuntu0.10.10.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-com mon_1.2.5-0ubuntu0.10.10.1_all.deb


• Ubuntu libwebkit-dev_1.2.5-0ubuntu0.10.10.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-dev_1.2.5-0ubuntu 0.10.10.1_powerpc.deb

Ubuntu Ubuntu Linux 10.10 i386

• Ubuntu gir1.0-webkit-1.0_1.2.5-0ubuntu0.10.10.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/universe/w/webkit/gir1.0-webkit -1.0_1.2.5-0ubuntu0.10.10.1_i386.deb


• Ubuntu libwebkit-1.0-2-dbg_1.2.5-0ubuntu0.10.10.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-2-d bg_1.2.5-0ubuntu0.10.10.1_i386.deb


• Ubuntu libwebkit-1.0-2_1.2.5-0ubuntu0.10.10.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-2_1 .2.5-0ubuntu0.10.10.1_i386.deb


• Ubuntu libwebkit-1.0-common_1.2.5-0ubuntu0.10.10.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-com mon_1.2.5-0ubuntu0.10.10.1_all.deb


• Ubuntu libwebkit-dev_1.2.5-0ubuntu0.10.10.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-dev_1.2 .5-0ubuntu0.10.10.1_i386.deb

Ubuntu Ubuntu Linux 10.04 sparc

• Ubuntu gir1.0-webkit-1.0_1.2.5-0ubuntu0.10.04.1_sparc.deb
  http://ports.ubuntu.com/pool/universe/w/webkit/gir1.0-webkit-1.0_1.2.5 -0ubuntu0.10.04.1_sparc.deb


• Ubuntu libwebkit-1.0-2-dbg_1.2.5-0ubuntu0.10.04.1_sparc.deb
  http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-1.0-2-dbg_1.2.5-0 ubuntu0.10.04.1_sparc.deb


• Ubuntu libwebkit-1.0-2_1.2.5-0ubuntu0.10.04.1_sparc.deb
  http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-1.0-2_1.2.5-0ubun tu0.10.04.1_sparc.deb


• Ubuntu libwebkit-1.0-common_1.2.5-0ubuntu0.10.04.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-com mon_1.2.5-0ubuntu0.10.04.1_all.deb


• Ubuntu libwebkit-dev_1.2.5-0ubuntu0.10.04.1_sparc.deb
  http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-dev_1.2.5-0ubuntu 0.10.04.1_sparc.deb

Apple Safari 4.0.1

• Apple Safari4.1Tiger.dmg
  http://www.apple.com/safari/download/


• Apple Safari5.0Leopard.dmg
  http://www.apple.com/safari/download/


• Apple Safari5.0SnowLeopard.dmg
  http://www.apple.com/safari/download/

Apple Safari 4.0.2

• Apple Safari4.1Tiger.dmg
  http://www.apple.com/safari/download/


• Apple Safari5.0Leopard.dmg
  http://www.apple.com/safari/download/


• Apple Safari5.0SnowLeopard.dmg
  http://www.apple.com/safari/download/

Apple Safari 4.0.2 for Windows

• Apple Safari_Setup-safari5.exe
  http://www.apple.com/safari/download/


• Apple SafariQuickTimeSetup-safari5.exe
  http://www.apple.com/safari/download/


• Apple SafariSetup-safari5.exe
  http://www.apple.com/safari/download/

Apple Safari 4.0.3 for Windows

• Apple Safari_Setup-safari5.exe
  http://www.apple.com/safari/download/


• Apple SafariQuickTimeSetup-safari5.exe
  http://www.apple.com/safari/download/


• Apple SafariSetup-safari5.exe
  http://www.apple.com/safari/download/

Apple Safari 4.0.3

• Apple Safari4.1Tiger.dmg
  http://www.apple.com/safari/download/


• Apple Safari5.0Leopard.dmg
  http://www.apple.com/safari/download/


• Apple Safari5.0SnowLeopard.dmg
  http://www.apple.com/safari/download/

Apple Safari 4.0.4 for Windows

• Apple Safari_Setup-safari5.exe
  http://www.apple.com/safari/download/


• Apple SafariQuickTimeSetup-safari5.exe
  http://www.apple.com/safari/download/


• Apple SafariSetup-safari5.exe
  http://www.apple.com/safari/download/

Apple Safari 4.0.4

• Apple Safari4.1Tiger.dmg
  http://www.apple.com/safari/download/


• Apple Safari5.0Leopard.dmg
  http://www.apple.com/safari/download/


• Apple Safari5.0SnowLeopard.dmg
  http://www.apple.com/safari/download/

Apple Safari 4.0.5 for Windows

• Apple Safari_Setup-safari5.exe
  http://www.apple.com/safari/download/


• Apple SafariQuickTimeSetup-safari5.exe
  http://www.apple.com/safari/download/


• Apple SafariSetup-safari5.exe
  http://www.apple.com/safari/download/

Apple Safari 4.0.5

• Apple Safari4.1Tiger.dmg
  http://www.apple.com/safari/download/


• Apple Safari5.0Leopard.dmg
  http://www.apple.com/safari/download/


• Apple Safari5.0SnowLeopard.dmg
  http://www.apple.com/safari/download/

Webkit HTML Document Fragments Cross Site Scripting Vulnerability

References:

• Apple Safari Homepage (Apple)
  
• webkit 1.2.5 security update tracking bug (Ubuntu)
  
• Webkit Homepage (WebKit)