RETIRED: WebKit Multiple Memory Corruption Vulnerabilities
BID:46654
Info
RETIRED: WebKit Multiple Memory Corruption Vulnerabilities
| Bugtraq ID: | 46654 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 02 2011 12:00AM |
| Updated: | Mar 07 2011 05:27PM |
| Credit: | kuzzcc, wushi of team509, Sergey Glazunov, Yuzo Fujishima of Google Inc., Andreas Kling of Nokia, Chris Evans of Google Chrome Security Team, J23 working with TippingPoint's Zero Day Initiative, Emil A Eklund of Google, Inc, Abhishek Arya (Inferno) of Goog |
| Vulnerable: |
WebKit Open Source Project WebKit 1.2.5 WebKit Open Source Project WebKit 1.2.3 WebKit Open Source Project WebKit 1.2.2 WebKit Open Source Project WebKit r77705 WebKit Open Source Project WebKit r52833 WebKit Open Source Project WebKit r52401 WebKit Open Source Project WebKit r51295 WebKit Open Source Project WebKit r38566 WebKit Open Source Project WebKit 1.2.X WebKit Open Source Project WebKit 1.2.2-1 WebKit Open Source Project WebKit 0 Apple iTunes 9.2.1 Apple iTunes 9.0.2 Apple iTunes 9.0.1 .8 Apple iTunes 9.0.1 Apple iTunes 9.0 Apple iTunes 9.2 Apple iTunes 9.1 Apple iTunes 10.1 Apple iTunes 10 |
| Not Vulnerable: |
Apple iTunes 10.2 |
Discussion
RETIRED: WebKit Multiple Memory Corruption Vulnerabilities
WebKit is prone to multiple memory-corruption vulnerabilities.
An attacker may exploit these issues by enticing victims into viewing a malicious webpage.
Successful exploits may allow attackers to execute arbitrary code in the context of the affected browser or cause denial-of-service conditions; other attacks may also be possible.
This BID is being retired. The following individual records exists to better document the issues:
46684 WebKit CVE-2011-0111 Unspecified Memory Corruption Vulnerability
46686 WebKit CVE-2011-0117 Unspecified Memory Corruption Vulnerability
46687 WebKit CVE-2011-0118 Unspecified Memory Corruption Vulnerability
46688 WebKit CVE-2011-0119 Unspecified Memory Corruption Vulnerability
46689 WebKit CVE-2011-0141 Unspecified Memory Corruption Vulnerability
46690 WebKit CVE-2011-0136 Unspecified Memory Corruption Vulnerability
46691 WebKit CVE-2011-0114 Unspecified Memory Corruption Vulnerability
46692 WebKit CVE-2011-0128 Unspecified Memory Corruption Vulnerability
46693 WebKit CVE-2011-0129 Unspecified Memory Corruption Vulnerability
46694 WebKit CVE-2011-0120 Unspecified Memory Corruption Vulnerability
46695 WebKit CVE-2011-0143 Unspecified Memory Corruption Vulnerability
46696 WebKit CVE-2011-0121 Unspecified Memory Corruption Vulnerability
46698 WebKit CVE-2011-0123 Unspecified Memory Corruption Vulnerability
46699 WebKit CVE-2011-0144 Unspecified Memory Corruption Vulnerability
46700 WebKit CVE-2011-0130 Unspecified Memory Corruption Vulnerability
46701 WebKit CVE-2011-0125 Unspecified Memory Corruption Vulnerability
46702 WebKit CVE-2011-0147 Unspecified Memory Corruption Vulnerability
46703 WebKit CVE-2011-0164 Unspecified Memory Corruption Vulnerability
46704 WebKit CVE-2011-0131 Unspecified Memory Corruption Vulnerability
46705 WebKit CVE-2011-0127 Unspecified Memory Corruption Vulnerability
46706 WebKit CVE-2011-0142 Unspecified Memory Corruption Vulnerability
46707 WebKit CVE-2011-0137 Unspecified Memory Corruption Vulnerability
46708 WebKit CVE-2011-0148 Unspecified Memory Corruption Vulnerability
46709 WebKit CVE-2011-0135 Unspecified Memory Corruption Vulnerability
46710 WebKit CVE-2011-0145 Unspecified Memory Corruption Vulnerability
46711 WebKit CVE-2011-0134 Unspecified Memory Corruption Vulnerability
46712 WebKit CVE-2011-0139 Unspecified Memory Corruption Vulnerability
46713 WebKit CVE-2011-0138 Unspecified Memory Corruption Vulnerability
46714 WebKit CVE-2011-0140 Unspecified Memory Corruption Vulnerability
46715 WebKit CVE-2011-0146 Unspecified Memory Corruption Vulnerability
46716 WebKit CVE-2011-0165 Unspecified Memory Corruption Vulnerability
46717 WebKit CVE-2011-0150 Unspecified Memory Corruption Vulnerability
46718 WebKit CVE-2011-0152 Unspecified Memory Corruption Vulnerability
46719 WebKit CVE-2011-0151 Unspecified Memory Corruption Vulnerability
46720 WebKit CVE-2011-0153 Unspecified Memory Corruption Vulnerability
46721 WebKit CVE-2011-0155 Unspecified Memory Corruption Vulnerability
46722 WebKit CVE-2011-0168 Unspecified Memory Corruption Vulnerability
46723 WebKit CVE-2011-0122 Unspecified Memory Corruption Vulnerability
46724 WebKit CVE-2011-0156 Unspecified Memory Corruption Vulnerability
46725 WebKit CVE-2011-0124 Unspecified Memory Corruption Vulnerability
46726 WebKit CVE-2011-0112 Unspecified Memory Corruption Vulnerability
46727 WebKit CVE-2011-0126 Unspecified Memory Corruption Vulnerability
46728 WebKit CVE-2011-0113 Unspecified Memory Corruption Vulnerability
46744 WebKit CVE-2011-0149 'HTMLBRElement' Style Memory Corruption Vulnerability
46745 WebKit CVE-2011-0154 Javascript 'sort()' Method Memory Corruption Vulnerability
46746 WebKit Range Object Remote Code Execution Vulnerability
46747 WebKit CVE-2011-0116 'setOuterText()' Method Memory Corruption Remote Code Execution Vulnerability
46748 WebKit 'Runin' Box CVE-2011-0132 Use-After-Free Memory Corruption Vulnerability
46749 WebKit CVE-2011-0133 Glyph Data Memory Corruption Vulnerability
WebKit is prone to multiple memory-corruption vulnerabilities.
An attacker may exploit these issues by enticing victims into viewing a malicious webpage.
Successful exploits may allow attackers to execute arbitrary code in the context of the affected browser or cause denial-of-service conditions; other attacks may also be possible.
This BID is being retired. The following individual records exists to better document the issues:
46684 WebKit CVE-2011-0111 Unspecified Memory Corruption Vulnerability
46686 WebKit CVE-2011-0117 Unspecified Memory Corruption Vulnerability
46687 WebKit CVE-2011-0118 Unspecified Memory Corruption Vulnerability
46688 WebKit CVE-2011-0119 Unspecified Memory Corruption Vulnerability
46689 WebKit CVE-2011-0141 Unspecified Memory Corruption Vulnerability
46690 WebKit CVE-2011-0136 Unspecified Memory Corruption Vulnerability
46691 WebKit CVE-2011-0114 Unspecified Memory Corruption Vulnerability
46692 WebKit CVE-2011-0128 Unspecified Memory Corruption Vulnerability
46693 WebKit CVE-2011-0129 Unspecified Memory Corruption Vulnerability
46694 WebKit CVE-2011-0120 Unspecified Memory Corruption Vulnerability
46695 WebKit CVE-2011-0143 Unspecified Memory Corruption Vulnerability
46696 WebKit CVE-2011-0121 Unspecified Memory Corruption Vulnerability
46698 WebKit CVE-2011-0123 Unspecified Memory Corruption Vulnerability
46699 WebKit CVE-2011-0144 Unspecified Memory Corruption Vulnerability
46700 WebKit CVE-2011-0130 Unspecified Memory Corruption Vulnerability
46701 WebKit CVE-2011-0125 Unspecified Memory Corruption Vulnerability
46702 WebKit CVE-2011-0147 Unspecified Memory Corruption Vulnerability
46703 WebKit CVE-2011-0164 Unspecified Memory Corruption Vulnerability
46704 WebKit CVE-2011-0131 Unspecified Memory Corruption Vulnerability
46705 WebKit CVE-2011-0127 Unspecified Memory Corruption Vulnerability
46706 WebKit CVE-2011-0142 Unspecified Memory Corruption Vulnerability
46707 WebKit CVE-2011-0137 Unspecified Memory Corruption Vulnerability
46708 WebKit CVE-2011-0148 Unspecified Memory Corruption Vulnerability
46709 WebKit CVE-2011-0135 Unspecified Memory Corruption Vulnerability
46710 WebKit CVE-2011-0145 Unspecified Memory Corruption Vulnerability
46711 WebKit CVE-2011-0134 Unspecified Memory Corruption Vulnerability
46712 WebKit CVE-2011-0139 Unspecified Memory Corruption Vulnerability
46713 WebKit CVE-2011-0138 Unspecified Memory Corruption Vulnerability
46714 WebKit CVE-2011-0140 Unspecified Memory Corruption Vulnerability
46715 WebKit CVE-2011-0146 Unspecified Memory Corruption Vulnerability
46716 WebKit CVE-2011-0165 Unspecified Memory Corruption Vulnerability
46717 WebKit CVE-2011-0150 Unspecified Memory Corruption Vulnerability
46718 WebKit CVE-2011-0152 Unspecified Memory Corruption Vulnerability
46719 WebKit CVE-2011-0151 Unspecified Memory Corruption Vulnerability
46720 WebKit CVE-2011-0153 Unspecified Memory Corruption Vulnerability
46721 WebKit CVE-2011-0155 Unspecified Memory Corruption Vulnerability
46722 WebKit CVE-2011-0168 Unspecified Memory Corruption Vulnerability
46723 WebKit CVE-2011-0122 Unspecified Memory Corruption Vulnerability
46724 WebKit CVE-2011-0156 Unspecified Memory Corruption Vulnerability
46725 WebKit CVE-2011-0124 Unspecified Memory Corruption Vulnerability
46726 WebKit CVE-2011-0112 Unspecified Memory Corruption Vulnerability
46727 WebKit CVE-2011-0126 Unspecified Memory Corruption Vulnerability
46728 WebKit CVE-2011-0113 Unspecified Memory Corruption Vulnerability
46744 WebKit CVE-2011-0149 'HTMLBRElement' Style Memory Corruption Vulnerability
46745 WebKit CVE-2011-0154 Javascript 'sort()' Method Memory Corruption Vulnerability
46746 WebKit Range Object Remote Code Execution Vulnerability
46747 WebKit CVE-2011-0116 'setOuterText()' Method Memory Corruption Remote Code Execution Vulnerability
46748 WebKit 'Runin' Box CVE-2011-0132 Use-After-Free Memory Corruption Vulnerability
46749 WebKit CVE-2011-0133 Glyph Data Memory Corruption Vulnerability
Exploit / POC
RETIRED: WebKit Multiple Memory Corruption Vulnerabilities
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
NOTE: To exploit these issues through iTunes, and attacker would need to perform a man-in-the-middle attack first.
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
NOTE: To exploit these issues through iTunes, and attacker would need to perform a man-in-the-middle attack first.
Solution / Fix
RETIRED: WebKit Multiple Memory Corruption Vulnerabilities
Solution:
Apple has released updates to address these issues for iTunes. Updates for other applications utilizing WebKit are not yet known to be available.
Apple iTunes 10.1
Apple iTunes 10
Solution:
Apple has released updates to address these issues for iTunes. Updates for other applications utilizing WebKit are not yet known to be available.
Apple iTunes 10.1
-
Apple APPLE-SA-2011-03-02-1 iTunes64Setup.exe
For 64-bit Windows XP / Vista / Windows 7
http://www.apple.com/itunes/download/ -
Apple APPLE-SA-2011-03-02-1 iTunesSetup.exe
For Windows XP / Vista / Windows 7
http://www.apple.com/itunes/download/ -
Apple iTunes10.2.dmg
for Mac OS X
http://www.apple.com/itunes/download/
Apple iTunes 10
-
Apple APPLE-SA-2011-03-02-1 iTunes64Setup.exe
For 64-bit Windows XP / Vista / Windows 7
http://www.apple.com/itunes/download/ -
Apple APPLE-SA-2011-03-02-1 iTunesSetup.exe
For Windows XP / Vista / Windows 7
http://www.apple.com/itunes/download/ -
Apple iTunes10.2.dmg
for Mac OS X
http://www.apple.com/itunes/download/
References
RETIRED: WebKit Multiple Memory Corruption Vulnerabilities
References:
References:
- iTunes Homepage (Apple)
- Webkit Homepage (Webkit)
- ZDI-11-096 Apple Safari WebKit Range Object Remote Code Execution Vulnerability (Zero Day Initiative)
- ZDI-11-097 Apple Webkit setOuterText Memory Corruption Remote Code Execution Vul (Zero Day Initiative)
- ZDI-11-098 Apple Safari Webkit Runin Box Promotion Remote Code Execution Vulnera (Zero Day Initiative)
- ZDI-11-099 Apple Webkit Font Glyph Layout Remote Code Execution Vulnerability (Zero Day Initiative)
- ZDI-11-100 Apple Webkit Root HTMLBRElement Style Remote Code Execution Vulnerabi (Zero Day Initiative)
- ZDI-11-101 Apple iPhone Webkit Library Javascript Array sort Method Remote Code (Zero Day Initiative)