Apple Safari Cross Domain Information Disclosure Vulnerability

Bugtraq ID:	48841
Class:	Unknown
CVE:	CVE-2011-0219
Remote:	Yes
Local:	No
Published:	Jul 20 2011 12:00AM
Updated:	Jul 20 2011 12:00AM
Credit:	Joshua Smith
Vulnerable:	Apple Safari 5.0.5 for Windows Apple Safari 5.0.5 Apple Safari 5.0.4 for Windows Apple Safari 5.0.4 Apple Safari 5.0.3 for Windows Apple Safari 5.0.3 Apple Safari 5.0.2 for Windows Apple Safari 5.0.2 Apple Safari 5.0.1 for Windows Apple Safari 5.0.1 Apple Safari 5.0 for Windows Apple Safari 5.0
Not Vulnerable:	Apple Safari 5.0.6 Apple Safari 5.1 for Windows Apple Safari 5.1 Apple Safari 5.0.6 for windows

Apple Safari Cross Domain Information Disclosure Vulnerability

Apple Safari is prone to a cross-domain information-disclosure vulnerability that occurs in handling of Java Applets.

An attacker can exploit this issue to disclose text content from other sites.

NOTE: This issue was previously discussed in 48808 (Apple Safari Prior to 5.1 and 5.0.6 Multiple Security Vulnerabilities) but has been given its own record to better document it.

Apple Safari Cross Domain Information Disclosure Vulnerability

An attacker can exploit the issue by enticing an unsuspecting user to visit a crafted site.

Apple Safari Cross Domain Information Disclosure Vulnerability

Solution:
Updates are available. Please see the reference for more details.

Apple Safari Cross Domain Information Disclosure Vulnerability

References:

• Apple Safari Homepage (Apple)
  
• APPLE-SA-2011-07-20-1 Safari 5.1 and Safari 5.0.6 (Apple)