Sign-up

ID

VAR-201411-0266


CVE

CVE-2014-4452


TITLE

Apple iOS and Apple TV Used in etc. Webkit Vulnerable to arbitrary code execution

Trust: 0.8

sources: JVNDB: JVNDB-2014-005508

DESCRIPTION

WebKit, as used in Apple iOS before 8.1.1 and Apple TV before 7.0.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-4462. Apple iOS and Apple TV Used in etc. WebKit is prone to an unspecified memory-corruption vulnerability. An attacker may exploit this issue by enticing victims into viewing a malicious webpage. Successful exploits may allow attackers to execute arbitrary code in the context of the affected browser or cause denial-of-service conditions; other attacks may also be possible. WebKit is a set of open source web browser engines jointly developed by companies such as KDE, Apple (Apple), and Google (Google), and is currently used by browsers such as Apple Safari and Google Chrome. ------------------------------------------------------------------------ WebKitGTK+ Security Advisory WSA-2015-0002 ------------------------------------------------------------------------ Date reported : December 28, 2015 Advisory ID : WSA-2015-0002 Advisory URL : http://webkitgtk.org/security/WSA-2015-0002.html CVE identifiers : CVE-2013-6663, CVE-2014-1748, CVE-2014-3192, CVE-2014-4409, CVE-2014-4410, CVE-2014-4411, CVE-2014-4412, CVE-2014-4413, CVE-2014-4414, CVE-2014-4452, CVE-2014-4459, CVE-2014-4465, CVE-2014-4466, CVE-2014-4468, CVE-2014-4469, CVE-2014-4470, CVE-2014-4471, CVE-2014-4472, CVE-2014-4473, CVE-2014-4474, CVE-2014-4475, CVE-2014-4476, CVE-2014-4477, CVE-2014-4479, CVE-2015-1068, CVE-2015-1069, CVE-2015-1070, CVE-2015-1071, CVE-2015-1072, CVE-2015-1073, CVE-2015-1074, CVE-2015-1075, CVE-2015-1076, CVE-2015-1077, CVE-2015-1080, CVE-2015-1081, CVE-2015-1082, CVE-2015-1083, CVE-2015-1084, CVE-2015-1119, CVE-2015-1120, CVE-2015-1121, CVE-2015-1122, CVE-2015-1124, CVE-2015-1126, CVE-2015-1127, CVE-2015-1152, CVE-2015-1153, CVE-2015-1154, CVE-2015-1155, CVE-2015-1156, CVE-2015-2330, CVE-2015-3658, CVE-2015-3659, CVE-2015-3660, CVE-2015-3727, CVE-2015-3730, CVE-2015-3731, CVE-2015-3732, CVE-2015-3733, CVE-2015-3734, CVE-2015-3735, CVE-2015-3736, CVE-2015-3737, CVE-2015-3738, CVE-2015-3739, CVE-2015-3740, CVE-2015-3741, CVE-2015-3742, CVE-2015-3743, CVE-2015-3744, CVE-2015-3745, CVE-2015-3746, CVE-2015-3747, CVE-2015-3748, CVE-2015-3749, CVE-2015-3750, CVE-2015-3751, CVE-2015-3752, CVE-2015-3753, CVE-2015-3754, CVE-2015-3755, CVE-2015-5788, CVE-2015-5789, CVE-2015-5790, CVE-2015-5791, CVE-2015-5792, CVE-2015-5793, CVE-2015-5794, CVE-2015-5795, CVE-2015-5797, CVE-2015-5798, CVE-2015-5799, CVE-2015-5800, CVE-2015-5801, CVE-2015-5802, CVE-2015-5803, CVE-2015-5804, CVE-2015-5805, CVE-2015-5806, CVE-2015-5807, CVE-2015-5809, CVE-2015-5810, CVE-2015-5811, CVE-2015-5812, CVE-2015-5813, CVE-2015-5814, CVE-2015-5815, CVE-2015-5816, CVE-2015-5817, CVE-2015-5818, CVE-2015-5819, CVE-2015-5822, CVE-2015-5823, CVE-2015-5825, CVE-2015-5826, CVE-2015-5827, CVE-2015-5828, CVE-2015-5928, CVE-2015-5929, CVE-2015-5930, CVE-2015-5931, CVE-2015-7002, CVE-2015-7012, CVE-2015-7013, CVE-2015-7014, CVE-2015-7048, CVE-2015-7095, CVE-2015-7097, CVE-2015-7099, CVE-2015-7100, CVE-2015-7102, CVE-2015-7103, CVE-2015-7104. Several vulnerabilities were discovered on WebKitGTK+. CVE-2013-6663 Versions affected: WebKitGTK+ before 2.4.0. Credit to Atte Kettunen of OUSPG. CVE-2014-1748 Versions affected: WebKitGTK+ before 2.6.0. Credit to Jordan Milne. The ScrollView::paint function in platform/scroll/ScrollView.cpp in Blink, as used in Google Chrome before 35.0.1916.114, allows remote attackers to spoof the UI by extending scrollbar painting into the parent frame. CVE-2014-3192 Versions affected: WebKitGTK+ before 2.6.3. Credit to cloudfuzzer. CVE-2014-4409 Versions affected: WebKitGTK+ before 2.6.0. Credit to Yosuke Hasegawa (NetAgent Co., Led.). CVE-2014-4410 Versions affected: WebKitGTK+ before 2.6.0. Credit to Eric Seidel of Google. CVE-2014-4411 Versions affected: WebKitGTK+ before 2.6.0. Credit to Google Chrome Security Team. CVE-2014-4412 Versions affected: WebKitGTK+ before 2.4.0. CVE-2014-4413 Versions affected: WebKitGTK+ before 2.4.0. CVE-2014-4414 Versions affected: WebKitGTK+ before 2.4.0. CVE-2014-4452 Versions affected: WebKitGTK+ before 2.6.0. Credit to unknown. CVE-2014-4459 Versions affected: WebKitGTK+ before 2.6.2. Credit to unknown. CVE-2014-4465 Versions affected: WebKitGTK+ before 2.6.2. Credit to Rennie deGraaf of iSEC Partners. WebKit in Apple Safari before 6.2.1, 7.x before 7.1.1, and 8.x before 8.0.1 allows remote attackers to bypass the Same Origin Policy via crafted Cascading Style Sheets (CSS) token sequences within an SVG file in the SRC attribute of an IMG element. CVE-2014-4466 Versions affected: WebKitGTK+ before 2.6.2. CVE-2014-4468 Versions affected: WebKitGTK+ before 2.6.0. CVE-2014-4469 Versions affected: WebKitGTK+ before 2.6.4. CVE-2014-4470 Versions affected: WebKitGTK+ before 2.6.0. CVE-2014-4471 Versions affected: WebKitGTK+ before 2.6.0. CVE-2014-4472 Versions affected: WebKitGTK+ before 2.6.0. CVE-2014-4473 Versions affected: WebKitGTK+ before 2.6.0. CVE-2014-4474 Versions affected: WebKitGTK+ before 2.6.2. CVE-2014-4475 Versions affected: WebKitGTK+ before 2.6.0. CVE-2014-4476 Versions affected: WebKitGTK+ before 2.6.2. CVE-2014-4477 Versions affected: WebKitGTK+ before 2.6.4. Credit to lokihardt@ASRT working with HP’s Zero Day Initiative. CVE-2014-4479 Versions affected: WebKitGTK+ before 2.6.4. CVE-2015-1068 Versions affected: WebKitGTK+ before 2.8.0. CVE-2015-1069 Versions affected: WebKitGTK+ before 2.8.0. CVE-2015-1070 Versions affected: WebKitGTK+ before 2.8.0. CVE-2015-1071 Versions affected: WebKitGTK+ before 2.8.0. CVE-2015-1072 Versions affected: WebKitGTK+ before 2.8.0. Credit to unknown. CVE-2015-1073 Versions affected: WebKitGTK+ before 2.8.0. CVE-2015-1074 Versions affected: WebKitGTK+ before 2.6.4. CVE-2015-1075 Versions affected: WebKitGTK+ before 2.8.0. Credit to Google Chrome Security Team. CVE-2015-1076 Versions affected: WebKitGTK+ before 2.8.0. Credit to unknown. CVE-2015-1077 Versions affected: WebKitGTK+ before 2.8.0. CVE-2015-1080 Versions affected: WebKitGTK+ before 2.6.0. CVE-2015-1081 Versions affected: WebKitGTK+ before 2.8.0. CVE-2015-1082 Versions affected: WebKitGTK+ before 2.8.0. CVE-2015-1083 Versions affected: WebKitGTK+ before 2.6.4. CVE-2015-1084 Versions affected: WebKitGTK+ before 2.6.1. The user interface in WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, does not display URLs consistently, which makes it easier for remote attackers to conduct phishing attacks via a crafted URL. CVE-2015-1119 Versions affected: WebKitGTK+ before 2.8.0. Credit to Renata Hodovan of University of Szeged / Samsung Electronics. CVE-2015-1120 Versions affected: WebKitGTK+ before 2.8.0. CVE-2015-1121 Versions affected: WebKitGTK+ before 2.8.0. CVE-2015-1122 Versions affected: WebKitGTK+ before 2.10.0. CVE-2015-1124 Versions affected: WebKitGTK+ before 2.8.0. CVE-2015-1126 Versions affected: WebKitGTK+ before 2.8.0. Credit to Jouko Pynnonen of Klikki Oy. CVE-2015-1127 Versions affected: WebKitGTK+ before 2.8.0. Credit to Tyler C (2.6.5). The private-browsing implementation in WebKit in Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5 places browsing history into an index, which might allow local users to obtain sensitive information by reading index entries. CVE-2015-1152 Versions affected: WebKitGTK+ before 2.10.0. CVE-2015-1153 Versions affected: WebKitGTK+ before 2.8.0. CVE-2015-1154 Versions affected: WebKitGTK+ before 2.8.0. CVE-2015-1155 Versions affected: WebKitGTK+ before 2.10.0. Credit to Joe Vennix of Rapid7 Inc. working with HP's Zero Day Initiative. CVE-2015-1156 Versions affected: WebKitGTK+ before 2.8.0. Credit to Zachary Durber of Moodle. CVE-2015-2330 Versions affected: WebKitGTK+ before 2.6.6. Credit to Ross Lagerwall. Late TLS certificate verification in WebKitGTK+ prior to 2.6.6 allows remote attackers to view a secure HTTP request, including, for example, secure cookies. CVE-2015-3658 Versions affected: WebKitGTK+ before 2.8.1. Credit to Brad Hill of Facebook. CVE-2015-3659 Versions affected: WebKitGTK+ before 2.8.3. Credit to Peter Rutenbar working with HP's Zero Day Initiative. CVE-2015-3660 Versions affected: WebKitGTK+ before 2.10.0. CVE-2015-3727 Versions affected: WebKitGTK+ before 2.8.1. Credit to Peter Rutenbar working with HP's Zero Day Initiative. CVE-2015-3730 Versions affected: WebKitGTK+ before 2.10.0. CVE-2015-3731 Versions affected: WebKitGTK+ before 2.8.3. CVE-2015-3732 Versions affected: WebKitGTK+ before 2.8.3. CVE-2015-3733 Versions affected: WebKitGTK+ before 2.8.3. CVE-2015-3734 Versions affected: WebKitGTK+ before 2.8.3. CVE-2015-3735 Versions affected: WebKitGTK+ before 2.8.3. CVE-2015-3736 Versions affected: WebKitGTK+ before 2.8.3. CVE-2015-3737 Versions affected: WebKitGTK+ before 2.8.3. CVE-2015-3738 Versions affected: WebKitGTK+ before 2.10.0. CVE-2015-3739 Versions affected: WebKitGTK+ before 2.8.1. CVE-2015-3740 Versions affected: WebKitGTK+ before 2.10.0. CVE-2015-3741 Versions affected: WebKitGTK+ before 2.8.1. CVE-2015-3742 Versions affected: WebKitGTK+ before 2.10.0. CVE-2015-3743 Versions affected: WebKitGTK+ before 2.8.3. CVE-2015-3744 Versions affected: WebKitGTK+ before 2.10.0. CVE-2015-3745 Versions affected: WebKitGTK+ before 2.8.1. CVE-2015-3746 Versions affected: WebKitGTK+ before 2.10.0. CVE-2015-3747 Versions affected: WebKitGTK+ before 2.8.0. CVE-2015-3748 Versions affected: WebKitGTK+ before 2.8.3. CVE-2015-3749 Versions affected: WebKitGTK+ before 2.8.3. CVE-2015-3750 Versions affected: WebKitGTK+ before 2.10.0. Credit to Muneaki Nishimura (nishimunea). WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not enforce the HTTP Strict Transport Security (HSTS) protection mechanism for Content Security Policy (CSP) report requests, which allows man-in-the-middle attackers to obtain sensitive information by sniffing the network or spoof a report by modifying the client- server data stream. CVE-2015-3751 Versions affected: WebKitGTK+ before 2.10.0. Credit to Muneaki Nishimura (nishimunea). WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, allows remote attackers to bypass a Content Security Policy protection mechanism by using a video control in conjunction with an IMG element within an OBJECT element. CVE-2015-3752 Versions affected: WebKitGTK+ before 2.8.4. Credit to Muneaki Nishimura (nishimunea). The Content Security Policy implementation in WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not properly restrict cookie transmission for report requests, which allows remote attackers to obtain sensitive information via vectors involving (1) a cross- origin request or (2) a private-browsing request. CVE-2015-3753 Versions affected: WebKitGTK+ before 2.8.3. Credit to Antonio Sanso and Damien Antipa of Adobe. WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not properly perform taint checking for CANVAS elements, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive image data by leveraging a redirect to a data:image resource. CVE-2015-3754 Versions affected: WebKitGTK+ before 2.10.0. Credit to Dongsung Kim (@kid1ng). CVE-2015-3755 Versions affected: WebKitGTK+ before 2.10.0. Credit to xisigr of Tencent's Xuanwu Lab. WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, allows remote attackers to spoof the user interface via a malformed URL. CVE-2015-5788 Versions affected: WebKitGTK+ before 2.8.0. The WebKit Canvas implementation in Apple iOS before 9 allows remote attackers to bypass the Same Origin Policy and obtain sensitive image information via vectors involving a CANVAS element. CVE-2015-5789 Versions affected: WebKitGTK+ before 2.6.1. CVE-2015-5790 Versions affected: WebKitGTK+ before 2.6.2. CVE-2015-5791 Versions affected: WebKitGTK+ before 2.6.0. CVE-2015-5792 Versions affected: WebKitGTK+ before 2.4.0. CVE-2015-5793 Versions affected: WebKitGTK+ before 2.8.0. CVE-2015-5794 Versions affected: WebKitGTK+ before 2.8.0. CVE-2015-5795 Versions affected: WebKitGTK+ before 2.8.3. CVE-2015-5797 Versions affected: WebKitGTK+ before 2.8.0. CVE-2015-5798 Versions affected: WebKitGTK+ before 2.6.0. CVE-2015-5799 Versions affected: WebKitGTK+ before 2.8.0. CVE-2015-5800 Versions affected: WebKitGTK+ before 2.8.0. CVE-2015-5801 Versions affected: WebKitGTK+ before 2.8.0. CVE-2015-5802 Versions affected: WebKitGTK+ before 2.6.0. CVE-2015-5803 Versions affected: WebKitGTK+ before 2.8.0. CVE-2015-5804 Versions affected: WebKitGTK+ before 2.10.0. CVE-2015-5805 Versions affected: WebKitGTK+ before 2.10.0. Credit to unknown. CVE-2015-5806 Versions affected: WebKitGTK+ before 2.8.3. CVE-2015-5807 Versions affected: WebKitGTK+ before 2.10.0. CVE-2015-5809 Versions affected: WebKitGTK+ before 2.8.4. CVE-2015-5810 Versions affected: WebKitGTK+ before 2.10.0. CVE-2015-5811 Versions affected: WebKitGTK+ before 2.8.0. CVE-2015-5812 Versions affected: WebKitGTK+ before 2.8.0. CVE-2015-5813 Versions affected: WebKitGTK+ before 2.10.0. CVE-2015-5814 Versions affected: WebKitGTK+ before 2.10.0. CVE-2015-5815 Versions affected: WebKitGTK+ before 2.10.0. CVE-2015-5816 Versions affected: WebKitGTK+ before 2.8.0. CVE-2015-5817 Versions affected: WebKitGTK+ before 2.10.0. CVE-2015-5818 Versions affected: WebKitGTK+ before 2.10.0. CVE-2015-5819 Versions affected: WebKitGTK+ before 2.8.0. CVE-2015-5822 Versions affected: WebKitGTK+ before 2.8.1. Credit to Mark S. Miller of Google. CVE-2015-5823 Versions affected: WebKitGTK+ before 2.8.0. CVE-2015-5825 Versions affected: WebKitGTK+ before 2.10.0. Credit to Yossi Oren et al. of Columbia University's Network Security Lab. CVE-2015-5826 Versions affected: WebKitGTK+ before 2.6.5. Credit to filedescriptior, Chris Evans. CVE-2015-5827 Versions affected: WebKitGTK+ before 2.10.0. Credit to Gildas. WebKit in Apple iOS before 9 allows remote attackers to bypass the Same Origin Policy and obtain an object reference via vectors involving a (1) custom event, (2) message event, or (3) pop state event. CVE-2015-5828 Versions affected: WebKitGTK+ before 2.10.0. Credit to Lorenzo Fontana. CVE-2015-5928 Versions affected: WebKitGTK+ before 2.8.4. CVE-2015-5929 Versions affected: WebKitGTK+ before 2.10.0. CVE-2015-5930 Versions affected: WebKitGTK+ before 2.10.0. CVE-2015-5931 Versions affected: WebKitGTK+ before 2.10.0. Credit to unknown. CVE-2015-7002 Versions affected: WebKitGTK+ before 2.10.0. CVE-2015-7012 Versions affected: WebKitGTK+ before 2.8.4. CVE-2015-7013 Versions affected: WebKitGTK+ before 2.10.0. CVE-2015-7014 Versions affected: WebKitGTK+ before 2.10.0. Credit to unknown. CVE-2015-7048 Versions affected: WebKitGTK+ before 2.10.0. CVE-2015-7095 Versions affected: WebKitGTK+ before 2.10.2. CVE-2015-7097 Versions affected: WebKitGTK+ before 2.10.3. CVE-2015-7099 Versions affected: WebKitGTK+ before 2.10.0. CVE-2015-7100 Versions affected: WebKitGTK+ before 2.10.0. CVE-2015-7102 Versions affected: WebKitGTK+ before 2.10.0. CVE-2015-7103 Versions affected: WebKitGTK+ before 2.10.0. CVE-2015-7104 Versions affected: WebKitGTK+ before 2.10.0. We recommend updating to the last stable version of WebKitGTK+. It is the best way of ensuring that you are running a safe version of WebKitGTK+. Please check our website for information about the last stable releases. Further information about WebKitGTK+ Security Advisories can be found at: http://webkitgtk.org/security.html The WebKitGTK+ team, December 28, 2015 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2014-11-17-1 iOS 8.1.1 iOS 8.1.1 is now available and addresses the following: CFNetwork Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Website cache may not be fully cleared after leaving private browsing Description: A privacy issue existed where browsing data could remain in the cache after leaving private browsing. This issue was addressed through a change in caching behavior. CVE-ID CVE-2014-4460 dyld Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A local user may be able to execute unsigned code Description: A state management issue existed in the handling of Mach-O executable files with overlapping segments. This issue was addressed through improved validation of segment sizes. CVE-ID CVE-2014-4455 : @PanguTeam Kernel Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A malicious application may be able to execute arbitrary code with system privileges Description: A validation issue existed in the handling of certain metadata fields of IOSharedDataQueue objects. This issue was addressed through relocation of the metadata. CVE-ID CVE-2014-4461 : @PanguTeam Lock Screen Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: An attacker in possession of a device may exceed the maximum number of failed passcode attempts Description: In some circumstances, the failed passcode attempt limit was not enforced. This issue was addressed through additional enforcement of this limit. CVE-ID CVE-2014-4451 : Stuart Ryan of University of Technology, Sydney Lock Screen Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A person with physical access to the phone may be able to access photos in the Photo Library Description: The Leave a Message option in FaceTime may have allowed viewing and sending photos from the device. This issue was addressed through improved state management. CVE-ID CVE-2014-4463 Sandbox Profiles Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A malicious application may be able to launch arbitrary binaries on a trusted device Description: A permissions issue existed with the debugging functionality for iOS that allowed the spawning of applications on trusted devices that were not being debugged. This was addressed by changes to debugserver's sandbox. CVE-ID CVE-2014-4457 : @PanguTeam Spotlight Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Unnecessary information is included as part of the initial connection between Spotlight or Safari and the Spotlight Suggestions servers Description: The initial connection made by Spotlight or Safari to the Spotlight Suggestions servers included a user's approximate location before a user entered a query. This issue was addressed by removing this information from the initial connection and only sending the user's approximate location as part of queries. These issues were addressed through improved memory handling. CVE-ID CVE-2014-4452 CVE-2014-4462 Installation note: This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.22 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBAgAGBQJUajYFAAoJEBcWfLTuOo7tGxsP/RccLDIt/LMluE7bcG9NSz4w tw8AHhkfiDZ+T/nnhqAiS2RQ2cgSfMg8KVzCtbrtXrEgebFTUVlos1vIjMSEkqgp GmSDFn64vZIExVo8w9iTLG/AdW0sERz3h2xVSEr/154AG2SHnL1+nY5abHHycTIG Uuo60+t2OVPtREIcrffmwj6hsYAX1dLAI0QV7PdvjpCc82Snf+yJZCFyjQ23AkQn P9NElRnK+pbhqqnfZXKO3Hbgf5IkuzeSl4Rwrj8nehu+hcEp32a8zH2wbbzDsFTO AyM02SAGLmBM30QcoJYK/s0lCGJBbr9rM5+9dUH6KXc8q/OTLJ0YETdHqwsO29cf XEl5uQT4IHGjlij2f/xYsa0OXbLfyXNeaT5YGlUSIUKNFXRhD6rPccL5V5Ktjnac JxOv0og5L4OBtPykc0XhmRqTIkEC4Cf3RmewA+b8ivsp/LuPjYsdfN1tZ8MXa1a8 C7hhUQSSSTtA3v7oO/LpU8Qw7kV79SkeQcYYTP07QI87cU2HHDejBHCfGjK9cz65 Uf4Sa/leCT0JyQYnx0XOafFTzxIJ2641HtTjuQ3sTKungkE5CR/KyVk2Wul3YqcA Meo//heYRLNa1XANfzV70TcsnQ2lcirzOqiufC+jljsfkQtlAXWim9H9BCc4102b ugp50lE7/p+CbwYvqaZg =x/RM -----END PGP SIGNATURE----- . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 APPLE-SA-2014-12-3-1 Safari 8.0.1, Safari 7.1.1, and Safari 6.2.1 Safari 8.0.1, Safari 7.1.1, and Safari 6.2.1 is now available and addresses the following: WebKit Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10.1 Impact: Style sheets are loaded cross-origin which may allow for data exfiltration Description: An SVG loaded in an img element could load a CSS file cross-origin. This issue was addressed through enhanced blocking of external CSS references in SVGs. CVE-ID CVE-2014-4465 : Rennie deGraaf of iSEC Partners WebKit Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10.1 Impact: Visiting a website that frames malicious content may lead to UI spoofing Description: A UI spoofing issue existed in the handling of scrollbar boundaries

Trust: 2.43

sources: NVD: CVE-2014-4452 // JVNDB: JVNDB-2014-005508 // BID: 71137 // VULHUB: VHN-72392 // PACKETSTORM: 132529 // PACKETSTORM: 135081 // PACKETSTORM: 129158 // PACKETSTORM: 129391 // PACKETSTORM: 129163

AFFECTED PRODUCTS

vendor:applemodel:iphone osscope:gteversion:8.0

Trust: 1.0

vendor:applemodel:safariscope:gteversion:8.0

Trust: 1.0

vendor:applemodel:safariscope:ltversion:6.2.1

Trust: 1.0

vendor:applemodel:tvosscope:ltversion:7.0.2

Trust: 1.0

vendor:applemodel:safariscope:ltversion:8.0.1

Trust: 1.0

vendor:applemodel:tvosscope:gteversion:6.0

Trust: 1.0

vendor:applemodel:safariscope:gteversion:6.0

Trust: 1.0

vendor:applemodel:itunesscope:ltversion:12.2

Trust: 1.0

vendor:applemodel:iphone osscope:ltversion:8.1.1

Trust: 1.0

vendor:applemodel:safariscope:gteversion:7.0

Trust: 1.0

vendor:applemodel:safariscope:ltversion:7.1.1

Trust: 1.0

vendor:applemodel:safariscope:ltversion:7.x (os x mavericks v10.9.5)

Trust: 0.8

vendor:applemodel:safariscope:ltversion:(os x mountain lion v10.8.5)

Trust: 0.8

vendor:applemodel:safariscope:ltversion:7.x (os x mountain lion v10.8.5)

Trust: 0.8

vendor:applemodel:safariscope:ltversion:8.x (os x mavericks v10.9.5)

Trust: 0.8

vendor:applemodel:safariscope:ltversion:8.x (os x yosemite v10.10.1)

Trust: 0.8

vendor:applemodel:safariscope:ltversion:8.x (os x mountain lion v10.8.5)

Trust: 0.8

vendor:applemodel:safariscope:eqversion:6.2.2

Trust: 0.8

vendor:applemodel:safariscope:ltversion:(os x mavericks v10.9.5)

Trust: 0.8

vendor:applemodel:itunesscope:eqversion:12.2

Trust: 0.8

vendor:applemodel:itunesscope:ltversion:(windows 7)

Trust: 0.8

vendor:applemodel:safariscope:eqversion:7.1.2

Trust: 0.8

vendor:applemodel:safariscope:ltversion:(os x yosemite v10.10.1)

Trust: 0.8

vendor:applemodel:safariscope:eqversion:8.0.2

Trust: 0.8

vendor:applemodel:safariscope:ltversion:7.x (os x yosemite v10.10.1)

Trust: 0.8

vendor:applemodel:itunesscope:ltversion:(windows 8)

Trust: 0.8

vendor:applemodel:iphone osscope:eqversion:8.0

Trust: 0.6

vendor:applemodel:safariscope:eqversion:7.1.0

Trust: 0.6

vendor:applemodel:tvscope:eqversion:6.0.1

Trust: 0.6

vendor:applemodel:iphone osscope:eqversion:8.0.1

Trust: 0.6

vendor:applemodel:tvscope:eqversion:6.0.2

Trust: 0.6

vendor:applemodel:tvscope:eqversion:6.0

Trust: 0.6

vendor:applemodel:tvscope:eqversion:6.1.1

Trust: 0.6

vendor:applemodel:tvscope:eqversion:6.1

Trust: 0.6

vendor:applemodel:iphone osscope:eqversion:8.0.2

Trust: 0.6

vendor:applemodel:iphone osscope:eqversion:8.1

Trust: 0.6

vendor:webkitmodel:open source project webkitscope:eqversion:0

Trust: 0.3

vendor:applemodel:itunesscope:eqversion:10.5.1

Trust: 0.3

vendor:applemodel:itunesscope:eqversion:9.2.1

Trust: 0.3

vendor:applemodel:itunesscope:eqversion:9.0.2

Trust: 0.3

vendor:applemodel:itunesscope:eqversion:9.0.1.8

Trust: 0.3

vendor:applemodel:itunesscope:eqversion:9.0.1

Trust: 0.3

vendor:applemodel:itunesscope:eqversion:9.0

Trust: 0.3

vendor:applemodel:itunesscope:eqversion:5.0

Trust: 0.3

vendor:applemodel:itunesscope:eqversion:9.2

Trust: 0.3

vendor:applemodel:itunesscope:eqversion:9.1

Trust: 0.3

vendor:applemodel:itunesscope:eqversion:8.2

Trust: 0.3

vendor:applemodel:itunesscope:eqversion:8.1

Trust: 0.3

vendor:applemodel:itunesscope:eqversion:8.0.2.20

Trust: 0.3

vendor:applemodel:itunesscope:eqversion:10.6

Trust: 0.3

vendor:applemodel:itunesscope:eqversion:10.5

Trust: 0.3

vendor:applemodel:itunesscope:eqversion:10.2.2

Trust: 0.3

vendor:applemodel:itunesscope:eqversion:10.2

Trust: 0.3

vendor:applemodel:ipod touchscope:eqversion:0

Trust: 0.3

vendor:applemodel:iphonescope:eqversion:0

Trust: 0.3

vendor:applemodel:ipadscope:eqversion:0

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.0.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.0.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.2.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.2.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:5.1.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:5.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:5.0.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:5

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.5

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.4

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.9

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.8

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.7

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.6

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.5

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.10

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.0

Trust: 0.3

vendor:applemodel:iosscope:eqversion:2.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:2.0

Trust: 0.3

vendor:applemodel:tvscope:eqversion:5.0

Trust: 0.3

vendor:applemodel:tvscope:eqversion:4.4

Trust: 0.3

vendor:applemodel:tvscope:eqversion:4.3

Trust: 0.3

vendor:applemodel:tvscope:eqversion:4.2

Trust: 0.3

vendor:applemodel:tvscope:eqversion:4.1

Trust: 0.3

vendor:applemodel:tvscope:eqversion:4.0

Trust: 0.3

vendor:applemodel:tvscope:eqversion:2.1

Trust: 0.3

vendor:applemodel:tvscope:eqversion:1.0

Trust: 0.3

sources: BID: 71137 // JVNDB: JVNDB-2014-005508 // CNNVD: CNNVD-201411-307 // NVD: CVE-2014-4452

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2014-4452
value: MEDIUM

Trust: 1.0

NVD: CVE-2014-4452
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201411-307
value: MEDIUM

Trust: 0.6

VULHUB: VHN-72392
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2014-4452
severity: MEDIUM
baseScore: 5.4
vectorString: AV:A/AC:M/AU:N/C:P/I:P/A:P
accessVector: ADJACENT_NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 5.5
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-72392
severity: MEDIUM
baseScore: 5.4
vectorString: AV:A/AC:M/AU:N/C:P/I:P/A:P
accessVector: ADJACENT_NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 5.5
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-72392 // JVNDB: JVNDB-2014-005508 // CNNVD: CNNVD-201411-307 // NVD: CVE-2014-4452

PROBLEMTYPE DATA

problemtype:CWE-399

Trust: 1.9

sources: VULHUB: VHN-72392 // JVNDB: JVNDB-2014-005508 // NVD: CVE-2014-4452

THREAT TYPE

specific network environment

Trust: 0.6

sources: CNNVD: CNNVD-201411-307

TYPE

resource management error

Trust: 0.6

sources: CNNVD: CNNVD-201411-307

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2014-005508

PATCH
title:APPLE-SA-2014-11-17-3url:http://lists.apple.com/archives/security-announce/2014/Nov/msg00002.html
Trust: 0.8
title:APPLE-SA-2014-12-11-1url:http://lists.apple.com/archives/security-announce/2014/Dec/msg00002.html
Trust: 0.8
title:APPLE-SA-2015-06-30-6 iTunes 12.2url:http://lists.apple.com/archives/security-announce/2015/Jun/msg00006.html
Trust: 0.8
title:APPLE-SA-2014-11-17-1url:http://lists.apple.com/archives/security-announce/2014/Nov/msg00000.html
Trust: 0.8
title:APPLE-SA-2014-12-2-1url:http://lists.apple.com/archives/security-announce/2014/Dec/msg00000.html
Trust: 0.8
title:HT6597url:http://support.apple.com/en-us/HT6597
Trust: 0.8
title:HT6590url:https://support.apple.com/en-eu/HT6590
Trust: 0.8
title:HT6592url:https://support.apple.com/en-eu/HT6592
Trust: 0.8
title:HT204949url:http://support.apple.com/en-us/HT204949
Trust: 0.8
title:HT6596url:http://support.apple.com/en-eu/HT6596
Trust: 0.8
title:HT6597url:http://support.apple.com/ja-jp/HT6597
Trust: 0.8
title:HT6590url:https://support.apple.com/ja-jp/HT6590
Trust: 0.8
title:HT6592url:https://support.apple.com/ja-jp/HT6592
Trust: 0.8
title:HT204949url:http://support.apple.com/ja-jp/HT204949
Trust: 0.8
title:HT6596url:http://support.apple.com/ja-jp/HT6596
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2014-005508

EXTERNAL IDS
db:NVDid:CVE-2014-4452
Trust: 3.3
db:BIDid:71137
Trust: 2.0
db:SECTRACKid:1031231
Trust: 1.7
db:SECUNIAid:62504
Trust: 1.7
db:SECUNIAid:62505
Trust: 1.7
db:JVNid:JVNVU92305751
Trust: 0.8
db:JVNDBid:JVNDB-2014-005508
Trust: 0.8
db:CNNVDid:CNNVD-201411-307
Trust: 0.7
db:PACKETSTORMid:129163
Trust: 0.2
db:VULHUBid:VHN-72392
Trust: 0.1
db:PACKETSTORMid:132529
Trust: 0.1
db:PACKETSTORMid:135081
Trust: 0.1
db:PACKETSTORMid:129158
Trust: 0.1
db:PACKETSTORMid:129391
Trust: 0.1
sources:
            
            
            VULHUB: VHN-72392 // 
            
            
            
            BID: 71137 // 
            
            
            
            JVNDB: JVNDB-2014-005508 // 
            
            
            
            PACKETSTORM: 132529 // 
            
            
            
            PACKETSTORM: 135081 // 
            
            
            
            PACKETSTORM: 129158 // 
            
            
            
            PACKETSTORM: 129391 // 
            
            
            
            PACKETSTORM: 129163 // 
            
            
            
            CNNVD: CNNVD-201411-307 // 
            
            
            
            NVD: CVE-2014-4452

REFERENCES
url:http://www.securityfocus.com/bid/71137
Trust: 2.3
url:http://lists.apple.com/archives/security-announce/2014/nov/msg00000.html
Trust: 1.7
url:http://lists.apple.com/archives/security-announce/2014/nov/msg00002.html
Trust: 1.7
url:http://lists.apple.com/archives/security-announce/2014/dec/msg00000.html
Trust: 1.7
url:http://lists.apple.com/archives/security-announce/2015/jun/msg00006.html
Trust: 1.7
url:http://support.apple.com/kb/ht6596
Trust: 1.7
url:https://support.apple.com/en-us/ht204418
Trust: 1.7
url:https://support.apple.com/en-us/ht204420
Trust: 1.7
url:https://support.apple.com/en-us/ht6590
Trust: 1.7
url:https://support.apple.com/en-us/ht6592
Trust: 1.7
url:https://support.apple.com/kb/ht204949
Trust: 1.7
url:http://www.securitytracker.com/id/1031231
Trust: 1.7
url:http://secunia.com/advisories/62504
Trust: 1.7
url:http://secunia.com/advisories/62505
Trust: 1.7
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/98771
Trust: 1.7
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-4452
Trust: 0.8
url:http://jvn.jp/cert/jvnvu92305751/index.html
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-4452
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2014-4452
Trust: 0.5
url:http://support.apple.com/kb/ht1222
Trust: 0.4
url:https://www.apple.com/support/security/pgp/
Trust: 0.4
url:http://www.apple.com/ipad/
Trust: 0.3
url:http://www.apple.com/iphone/
Trust: 0.3
url:http://www.apple.com/ipodtouch/
Trust: 0.3
url:http://www.webkit.org/
Trust: 0.3
url:https://nvd.nist.gov/vuln/detail/cve-2014-4471
Trust: 0.3
url:https://nvd.nist.gov/vuln/detail/cve-2014-4473
Trust: 0.3
url:https://nvd.nist.gov/vuln/detail/cve-2014-4468
Trust: 0.3
url:https://nvd.nist.gov/vuln/detail/cve-2014-4475
Trust: 0.3
url:https://nvd.nist.gov/vuln/detail/cve-2014-4474
Trust: 0.3
url:https://nvd.nist.gov/vuln/detail/cve-2014-4459
Trust: 0.3
url:https://nvd.nist.gov/vuln/detail/cve-2014-4469
Trust: 0.3
url:https://nvd.nist.gov/vuln/detail/cve-2014-4472
Trust: 0.3
url:https://nvd.nist.gov/vuln/detail/cve-2014-4470
Trust: 0.3
url:https://nvd.nist.gov/vuln/detail/cve-2014-4466
Trust: 0.3
url:http://gpgtools.org
Trust: 0.3
url:https://nvd.nist.gov/vuln/detail/cve-2014-4479
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2015-1069
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2015-1070
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2015-1071
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2014-4476
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2014-3192
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2014-4477
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2015-1068
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2014-1748
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2014-4465
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2014-4462
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2014-4455
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2014-4461
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2015-1073
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-1075
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-1079
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-1076
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-1077
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-1074
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-1072
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-1080
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-1078
Trust: 0.1
url:http://www.apple.com/itunes/download/
Trust: 0.1
url:http://webkitgtk.org/security.html
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2013-6663
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-4411
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-4413
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-4410
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-4409
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-4414
Trust: 0.1
url:http://webkitgtk.org/security/wsa-2015-0002.html
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-4412
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-4460
Trust: 0.1
url:https://www.apple.com/itunes/
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-4457
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-4453
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-4463
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-4451
Trust: 0.1
sources:
            
            
            VULHUB: VHN-72392 // 
            
            
            
            BID: 71137 // 
            
            
            
            JVNDB: JVNDB-2014-005508 // 
            
            
            
            PACKETSTORM: 132529 // 
            
            
            
            PACKETSTORM: 135081 // 
            
            
            
            PACKETSTORM: 129158 // 
            
            
            
            PACKETSTORM: 129391 // 
            
            
            
            PACKETSTORM: 129163 // 
            
            
            
            CNNVD: CNNVD-201411-307 // 
            
            
            
            NVD: CVE-2014-4452

CREDITS
Apple
Trust: 0.7
sources:
            
            
            BID: 71137 // 
            
            
            
            PACKETSTORM: 132529 // 
            
            
            
            PACKETSTORM: 129158 // 
            
            
            
            PACKETSTORM: 129391 // 
            
            
            
            PACKETSTORM: 129163

SOURCES
db:VULHUBid:VHN-72392
db:BIDid:71137
db:JVNDBid:JVNDB-2014-005508
db:PACKETSTORMid:132529
db:PACKETSTORMid:135081
db:PACKETSTORMid:129158
db:PACKETSTORMid:129391
db:PACKETSTORMid:129163
db:CNNVDid:CNNVD-201411-307
db:NVDid:CVE-2014-4452

LAST UPDATE DATE
2024-11-23T20:26:48.412000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-72392date:2019-07-16T00:00:00
db:BIDid:71137date:2015-07-15T00:50:00
db:JVNDBid:JVNDB-2014-005508date:2015-07-07T00:00:00
db:CNNVDid:CNNVD-201411-307date:2019-07-17T00:00:00
db:NVDid:CVE-2014-4452date:2024-11-21T02:10:13.650

SOURCES RELEASE DATE
db:VULHUBid:VHN-72392date:2014-11-18T00:00:00
db:BIDid:71137date:2014-11-17T00:00:00
db:JVNDBid:JVNDB-2014-005508date:2014-11-19T00:00:00
db:PACKETSTORMid:132529date:2015-07-02T11:08:22
db:PACKETSTORMid:135081date:2015-12-28T22:22:22
db:PACKETSTORMid:129158date:2014-11-19T00:41:28
db:PACKETSTORMid:129391date:2014-12-04T17:32:22
db:PACKETSTORMid:129163date:2014-11-19T01:30:54
db:CNNVDid:CNNVD-201411-307date:2014-11-19T00:00:00
db:NVDid:CVE-2014-4452date:2014-11-18T11:59:01.403