WebKit CVE-2014-1303 Heap Based Buffer Overflow Vulnerability

Bugtraq ID:	66242
Class:	Boundary Condition Error
CVE:	CVE-2014-1303
Remote:	Yes
Local:	No
Published:	Mar 14 2014 12:00AM
Updated:	Mar 19 2015 09:07AM
Credit:	Liang Chen of Keen Team.
Vulnerable:	WebKit Open Source Project WebKit 1.2.5 WebKit Open Source Project WebKit 1.2.3 WebKit Open Source Project WebKit 1.2.2 WebKit Open Source Project WebKit r82222 WebKit Open Source Project WebKit r77705 WebKit Open Source Project WebKit r52833 WebKit Open Source Project WebKit r52401 WebKit Open Source Project WebKit r51295 WebKit Open Source Project WebKit r38566 WebKit Open Source Project WebKit r105591 WebKit Open Source Project WebKit 2 WebKit Open Source Project WebKit 1.2.X WebKit Open Source Project WebKit 1.2.2-1 WebKit Open Source Project WebKit 0 eSignal eSignal 6.0.2 Apple iTunes 10.5.1 Apple iTunes 9.2.1 Apple iTunes 9.0.2 Apple iTunes 9.0.1 .8 Apple iTunes 9.0.1 Apple iTunes 9.0 Apple iTunes 7.3.2 Apple iTunes 7.3.1 Apple iTunes 7.3 Apple iTunes 6.0 Apple iTunes 5.0 Apple iTunes 4.7 Apple iTunes 4.5 Apple iTunes 4.2 .72 Apple iTunes 9.2 Apple iTunes 9.1 Apple iTunes 8.2 Apple iTunes 8.1 Apple iTunes 8.0.2.20 Apple iTunes 7.4 Apple iTunes 10.6 Apple iTunes 10.5 Apple iTunes 10.2.2 Apple iTunes 10.2 Apple iTunes 10 Apple iPhone 4.0 Apple Apple TV 5.0 Apple Apple TV 4.0
Not Vulnerable:

WebKit CVE-2014-1303 Heap Based Buffer Overflow Vulnerability

Exploitation of this issue was demonstrated at the Pwn2Own contest, but the exploit is not publicly available.

WebKit CVE-2014-1303 Heap Based Buffer Overflow Vulnerability

Solution:
Apple has released updates to address this issue for Safari. Updates for other applications utilizing WebKit are not yet known to be available.

WebKit CVE-2014-1303 Heap Based Buffer Overflow Vulnerability

References:

• Apple Safari Homepage (Apple)