WebKit Multiple Unspecified Remote Code Execution Vulnerabilities

Bugtraq ID:	54680
Class:	Unknown
CVE:	CVE-2012-0682 CVE-2012-0683 CVE-2012-1520 CVE-2012-3589 CVE-2012-3590 CVE-2012-3591 CVE-2012-3592 CVE-2012-3593 CVE-2012-3594 CVE-2012-3595 CVE-2012-3596 CVE-2012-3597 CVE-2012-3599 CVE-2012-3600 CVE-2012-3603 CVE-2012-3604 CVE-2012-3605 CVE-2012-3608 CVE-2012-3609 CVE-2012-3610 CVE-2012-3611 CVE-2012-3615 CVE-2012-3618 CVE-2012-3620 CVE-2012-3625 CVE-2012-3626 CVE-2012-3627 CVE-2012-3628 CVE-2012-3629 CVE-2012-3630 CVE-2012-3631 CVE-2012-3633 CVE-2012-3634 CVE-2012-3635 CVE-2012-3636 CVE-2012-3637 CVE-2012-3638 CVE-2012-3639 CVE-2012-3640 CVE-2012-3641 CVE-2012-3642 CVE-2012-3644 CVE-2012-3645 CVE-2012-3646 CVE-2012-3653 CVE-2012-3655 CVE-2012-3656 CVE-2012-3661 CVE-2012-3663 CVE-2012-3664 CVE-2012-3665 CVE-2012-3666 CVE-2012-3667 CVE-2012-3668 CVE-2012-3669 CVE-2012-3670 CVE-2012-3674 CVE-2012-3678 CVE-2012-3679 CVE-2012-3680 CVE-2012-3681 CVE-2012-3682 CVE-2012-3683 CVE-2012-3686 CVE-2012-3598
Remote:	Yes
Local:	No
Published:	Jul 25 2012 12:00AM
Updated:	Oct 25 2012 06:40PM
Credit:	Dave Mandelin of Mozilla, Martin Barbella of the Google Chrome Security Team using AddressSanitizer, Jose A. Vazquez of spa-s3c.blogspot.com working with iDefense VCP, Skylined of the Google Chrome Security Team, Apple Product Security, miaubiz, Martin Bar
Vulnerable:	WebKit Open Source Project WebKit 1.2.5 WebKit Open Source Project WebKit 1.2.3 WebKit Open Source Project WebKit 1.2.2 WebKit Open Source Project WebKit r82222 WebKit Open Source Project WebKit r77705 WebKit Open Source Project WebKit r52833 WebKit Open Source Project WebKit r52401 WebKit Open Source Project WebKit r51295 WebKit Open Source Project WebKit r38566 WebKit Open Source Project WebKit 1.2.X WebKit Open Source Project WebKit 1.2.2-1 WebKit Open Source Project WebKit 0 Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 Apple Safari 5.0.6 Apple Safari 5.1.7 for Windows Apple Safari 5.1.7 Apple Safari 5.1.5 for Windows Apple Safari 5.1.4 for Windows Apple Safari 5.1.4 Apple Safari 5.1.1 for Windows Apple Safari 5.1.1 Apple Safari 5.1 for Windows Apple Safari 5.1 Apple Safari 5.0.6 for windows Apple Safari 5.0.5 for Windows Apple Safari 5.0.5 Apple Safari 5.0.4 for Windows Apple Safari 5.0.4 Apple Safari 5.0.3 for Windows Apple Safari 5.0.3 Apple Safari 5.0.2 for Windows Apple Safari 5.0.2 Apple Safari 5.0.1 for Windows Apple Safari 5.0.1 Apple Safari 5.0 for Windows Apple Safari 5.0 Apple iTunes 10.6 Apple iTunes 10.5 Apple iTunes 10.2.2 Apple iTunes 10.2 Apple iOS 5.1.1 Apple iOS 5.1 Apple iOS 5.0.1 Apple iOS 5 Apple iOS 4.3.5 Apple iOS 4.3 Apple iOS 4.2 Apple iOS 4.1 Apple iOS 4 Apple iOS 3.2 Apple iOS 3.1 Apple iOS 3.0 Apple iOS 2.1 Apple iOS 2.0 Apple Apple TV 5.0 Apple Apple TV 4.4
Not Vulnerable:

WebKit Multiple Unspecified Remote Code Execution Vulnerabilities

WebKit is prone to multiple unspecified remote code-execution vulnerabilities.

Attackers can exploit these issues by performing a man-in-the-middle attack. Successful attacks will result in arbitrary code execution; failed attacks may cause denial-of-service conditions.

Note: This issue was previously discussed in BID 54669 (Apple Safari Prior to 6.0 Multiple Security Vulnerabilities), but has been given its own record to better document it.

WebKit Multiple Unspecified Remote Code Execution Vulnerabilities

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

WebKit Multiple Unspecified Remote Code Execution Vulnerabilities

Solution:
Updates are available. Please see the references for more information.

WebKit Multiple Unspecified Remote Code Execution Vulnerabilities

References:

• Apple Safari Homepage (Apple)
  
• WebKit Homepage (WebKit)