WebKit CVE-2012-3695 Cross-Site Scripting Vulnerability

Bugtraq ID:	54695
Class:	Input Validation Error
CVE:	CVE-2012-3695
Remote:	Yes
Local:	No
Published:	Jul 25 2012 12:00AM
Updated:	Sep 19 2012 10:10PM
Credit:	Masato Kinugawa
Vulnerable:	Apple WebKit build 18794 Apple Safari 5.0.6 Apple Safari 5.1.7 for Windows Apple Safari 5.1.7 Apple Safari 5.1.5 for Windows Apple Safari 5.1.4 for Windows Apple Safari 5.1.4 Apple Safari 5.1.1 for Windows Apple Safari 5.1.1 Apple Safari 5.1 for Windows Apple Safari 5.1 Apple Safari 5.0.6 for windows Apple Safari 5.0.5 for Windows Apple Safari 5.0.5 Apple Safari 5.0.4 for Windows Apple Safari 5.0.4 Apple Safari 5.0.3 for Windows Apple Safari 5.0.3 Apple Safari 5.0.2 for Windows Apple Safari 5.0.2 Apple Safari 5.0.1 for Windows Apple Safari 5.0.1 Apple Safari 5.0 for Windows Apple Safari 5.0 Apple iOS 5.1.1 Apple iOS 5.1 Apple iOS 5.0.1 Apple iOS 5 Apple iOS 4.3.5 Apple iOS 4.3 Apple iOS 4.2 Apple iOS 4.1 Apple iOS 4 Apple iOS 3.2 Apple iOS 3.1 Apple iOS 3.0 Apple iOS 2.1 Apple iOS 2.0
Not Vulnerable:

WebKit CVE-2012-3695 Cross-Site Scripting Vulnerability

WebKit is prone to a cross-site scripting vulnerability.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of another site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Note: This issue was previously discussed in BID 54669 (Apple Safari Prior to 6.0 Multiple Security Vulnerabilities), but has been given its own record to better document it.

WebKit CVE-2012-3695 Cross-Site Scripting Vulnerability

To exploit this issue, an attacker must trick a victim into following a malicious URI.

WebKit CVE-2012-3695 Cross-Site Scripting Vulnerability

Solution:
Updates are available. Please see the references for details.

WebKit CVE-2012-3695 Cross-Site Scripting Vulnerability

References:

• Apple Safari Homepage (Apple)
  
• Webkit Homepage (Webkit)