RETIRED: Apple Safari Prior to 6.0.5 Multiple Security Vulnerabilities
BID:60330
Info
RETIRED: Apple Safari Prior to 6.0.5 Multiple Security Vulnerabilities
| Bugtraq ID: | 60330 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 05 2013 12:00AM |
| Updated: | Jun 06 2013 05:35PM |
| Credit: | Subodh Iyengar and Erling Ellingsen of Facebook, Sam Power of Pentest Limited, Google Chrome Security Team (Inferno) and vendor. |
| Vulnerable: |
Apple Safari 5.0.6 Apple Safari 5.1.7 for Windows Apple Safari 5.1.7 Apple Safari 5.1.5 for Windows Apple Safari 5.1.4 for Windows Apple Safari 5.1.4 Apple Safari 5.1.1 for Windows Apple Safari 5.1.1 Apple Safari 5.1 for Windows Apple Safari 5.1 Apple Safari 5.0.6 for windows Apple Safari 5.0.5 for Windows Apple Safari 5.0.5 Apple Safari 5.0.4 for Windows Apple Safari 5.0.4 Apple Safari 5.0.3 for Windows Apple Safari 5.0.3 Apple Safari 5.0.2 for Windows Apple Safari 5.0.2 Apple Safari 5.0.1 for Windows Apple Safari 5.0.1 Apple Safari 5.0 for Windows Apple Safari 5.0 |
| Not Vulnerable: | |
Discussion
RETIRED: Apple Safari Prior to 6.0.5 Multiple Security Vulnerabilities
Safari is prone to multiple security vulnerabilities that have been addressed in Apple security advisory APPLE-SA-2013-06-04-2.
Successful attacks may allow the attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steel cookie-based authentication credentials or a cause remote code execution. Other attacks are also possible.
Versions prior to Safari 6.0.5 are vulnerable.
This BID is being retired. The following individual records exist to better document the issues:
60362 Apple Safari CVE-2013-1009 Memory Corruption Vulnerability
60361 WebKit CVE-2013-1012 Unspecified Cross Site Scripting Vulnerability
60363 WebKit CVE-2013-1013 Unspecified Cross Site Scripting Vulnerability
60364 Apple Safari CVE-2013-1023 Memory Corruption Vulnerability
Safari is prone to multiple security vulnerabilities that have been addressed in Apple security advisory APPLE-SA-2013-06-04-2.
Successful attacks may allow the attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steel cookie-based authentication credentials or a cause remote code execution. Other attacks are also possible.
Versions prior to Safari 6.0.5 are vulnerable.
This BID is being retired. The following individual records exist to better document the issues:
60362 Apple Safari CVE-2013-1009 Memory Corruption Vulnerability
60361 WebKit CVE-2013-1012 Unspecified Cross Site Scripting Vulnerability
60363 WebKit CVE-2013-1013 Unspecified Cross Site Scripting Vulnerability
60364 Apple Safari CVE-2013-1023 Memory Corruption Vulnerability
Exploit / POC
RETIRED: Apple Safari Prior to 6.0.5 Multiple Security Vulnerabilities
To exploit cross-site scripting issues an attacker must entice an unsuspecting user to follow a malicious URI.
To exploit cross-site scripting issues an attacker must entice an unsuspecting user to follow a malicious URI.
Solution / Fix
RETIRED: Apple Safari Prior to 6.0.5 Multiple Security Vulnerabilities
Solution:
Vendor fixes are available. Please see the referenced advisory for details.
Solution:
Vendor fixes are available. Please see the referenced advisory for details.
References
RETIRED: Apple Safari Prior to 6.0.5 Multiple Security Vulnerabilities
References:
References:
- Apple Safari Homepage (Apple)