VARIoT IoT vulnerabilities database
| VAR-201103-0223 | CVE-2011-0122 | plural Apple Product WebKit Vulnerable to arbitrary code execution |
CVSS V2: 7.6 CVSS V3: - Severity: HIGH |
WebKit, as used in Apple iTunes before 10.2 on Windows, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other CVEs listed in APPLE-SA-2011-03-02-1. WebKit is prone to an unspecified memory-corruption vulnerability.
An attacker can exploit this issue by enticing an unsuspecting user into visiting a malicious webpage with a vulnerable application.
Very few technical details are currently available. We will update this BID when more information emerges.
Successful exploits will allow attackers to execute arbitrary code in the context of the affected browser or cause denial-of-service conditions; other attacks may also be possible.
NOTE: This issue was previously discussed in BID 46654 (WebKit Multiple Memory Corruption Vulnerabilities) but has been given its own record to better document it. WebKit is a set of open source web browser engines jointly developed by companies such as KDE, Apple (Apple), and Google (Google), and is currently used by browsers such as Apple Safari and Google Chrome. A vulnerability exists in WebKit used in versions prior to 10.2 of Apple iTunes on Windows-based platforms
| VAR-201103-0222 | CVE-2011-0121 | plural Apple Product WebKit Vulnerable to arbitrary code execution |
CVSS V2: 7.6 CVSS V3: - Severity: HIGH |
WebKit, as used in Apple iTunes before 10.2 on Windows, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other CVEs listed in APPLE-SA-2011-03-02-1. WebKit is prone to an unspecified memory-corruption vulnerability.
An attacker can exploit this issue by enticing an unsuspecting user into visiting a malicious webpage with a vulnerable application.
Very few technical details are currently available. We will update this BID when more information emerges.
Successful exploits will allow attackers to execute arbitrary code in the context of the affected browser or cause denial-of-service conditions; other attacks may also be possible.
NOTE: This issue was previously discussed in BID 46654 (WebKit Multiple Memory Corruption Vulnerabilities) but has been given its own record to better document it. WebKit is a set of open source web browser engines jointly developed by companies such as KDE, Apple (Apple), and Google (Google), and is currently used by browsers such as Apple Safari and Google Chrome. A vulnerability exists in WebKit used in versions prior to 10.2 of Apple iTunes on Windows-based platforms
| VAR-201103-0221 | CVE-2011-0120 | plural Apple Product WebKit Vulnerable to arbitrary code execution |
CVSS V2: 7.6 CVSS V3: - Severity: HIGH |
WebKit, as used in Apple iTunes before 10.2 on Windows, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other CVEs listed in APPLE-SA-2011-03-02-1. WebKit is prone to an unspecified memory-corruption vulnerability.
An attacker can exploit this issue by enticing an unsuspecting user into visiting a malicious webpage with a vulnerable application.
Very few technical details are currently available. We will update this BID when more information emerges.
Successful exploits will allow attackers to execute arbitrary code in the context of the affected browser or cause denial-of-service conditions; other attacks may also be possible.
NOTE: This issue was previously discussed in BID 46654 (WebKit Multiple Memory Corruption Vulnerabilities) but has been given its own record to better document it. WebKit is a set of open source web browser engines jointly developed by companies such as KDE, Apple (Apple), and Google (Google), and is currently used by browsers such as Apple Safari and Google Chrome. A vulnerability exists in WebKit used in versions prior to 10.2 of Apple iTunes on Windows-based platforms
| VAR-201103-0220 | CVE-2011-0119 | plural Apple Product WebKit Vulnerable to arbitrary code execution |
CVSS V2: 7.6 CVSS V3: - Severity: HIGH |
WebKit, as used in Apple iTunes before 10.2 on Windows, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other CVEs listed in APPLE-SA-2011-03-02-1. WebKit is prone to an unspecified memory-corruption vulnerability.
An attacker can exploit this issue by enticing an unsuspecting user into visiting a malicious webpage with a vulnerable application.
Very few technical details are currently available. We will update this BID when more information emerges.
Successful exploits will allow attackers to execute arbitrary code in the context of the affected browser or cause denial-of-service conditions; other attacks may also be possible.
NOTE: This issue was previously discussed in BID 46654 (WebKit Multiple Memory Corruption Vulnerabilities) but has been given its own record to better document it. WebKit is a set of open source web browser engines jointly developed by companies such as KDE, Apple (Apple), and Google (Google), and is currently used by browsers such as Apple Safari and Google Chrome. A buffer overflow vulnerability exists in WebKit used in versions prior to 10.2 of Apple iTunes on Windows-based platforms
| VAR-201103-0219 | CVE-2011-0118 | plural Apple Product WebKit Vulnerable to arbitrary code execution |
CVSS V2: 7.6 CVSS V3: - Severity: HIGH |
WebKit, as used in Apple iTunes before 10.2 on Windows, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other CVEs listed in APPLE-SA-2011-03-02-1. WebKit is prone to an unspecified memory-corruption vulnerability.
An attacker can exploit this issue by enticing an unsuspecting user into visiting a malicious webpage with a vulnerable application.
Very few technical details are currently available. We will update this BID when more information emerges.
Successful exploits will allow attackers to execute arbitrary code in the context of the affected browser or cause denial-of-service conditions; other attacks may also be possible.
NOTE: This issue was previously discussed in BID 46654 (WebKit Multiple Memory Corruption Vulnerabilities) but has been given its own record to better document it. WebKit is a set of open source web browser engines jointly developed by companies such as KDE, Apple (Apple), and Google (Google), and is currently used by browsers such as Apple Safari and Google Chrome. A buffer overflow vulnerability exists in WebKit used in versions prior to 10.2 of Apple iTunes on Windows-based platforms
| VAR-201103-0218 | CVE-2011-0117 | plural Apple Product WebKit Vulnerable to arbitrary code execution |
CVSS V2: 7.6 CVSS V3: - Severity: HIGH |
WebKit, as used in Apple iTunes before 10.2 on Windows, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other CVEs listed in APPLE-SA-2011-03-02-1. WebKit is prone to an unspecified memory-corruption vulnerability.
An attacker can exploit this issue by enticing an unsuspecting user into visiting a malicious webpage with a vulnerable application.
Very few technical details are currently available. We will update this BID when more information emerges.
Successful exploits will allow attackers to execute arbitrary code in the context of the affected browser or cause denial-of-service conditions; other attacks may also be possible.
NOTE: This issue was previously discussed in BID 46654 (WebKit Multiple Memory Corruption Vulnerabilities) but has been given its own record to better document it. WebKit is a set of open source web browser engines jointly developed by companies such as KDE, Apple (Apple), and Google (Google), and is currently used by browsers such as Apple Safari and Google Chrome. A buffer overflow vulnerability exists in WebKit used in versions prior to 10.2 of Apple iTunes on Windows-based platforms
| VAR-201103-0215 | CVE-2011-0114 | plural Apple Product WebKit Vulnerable to arbitrary code execution |
CVSS V2: 7.6 CVSS V3: - Severity: HIGH |
WebKit, as used in Apple iTunes before 10.2 on Windows, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other CVEs listed in APPLE-SA-2011-03-02-1. WebKit is prone to an unspecified memory-corruption vulnerability.
An attacker can exploit this issue by enticing an unsuspecting user into visiting a malicious webpage with a vulnerable application.
Very few technical details are currently available. We will update this BID when more information emerges.
Successful exploits will allow attackers to execute arbitrary code in the context of the affected browser or cause denial-of-service conditions; other attacks may also be possible.
NOTE: This issue was previously discussed in BID 46654 (WebKit Multiple Memory Corruption Vulnerabilities) but has been given its own record to better document it. WebKit is a set of open source web browser engines jointly developed by companies such as KDE, Apple (Apple), and Google (Google), and is currently used by browsers such as Apple Safari and Google Chrome. A buffer overflow vulnerability exists in WebKit used in versions prior to 10.2 of Apple iTunes on Windows-based platforms
| VAR-201103-0214 | CVE-2011-0113 | plural Apple Product WebKit Vulnerable to arbitrary code execution |
CVSS V2: 7.6 CVSS V3: - Severity: HIGH |
WebKit, as used in Apple iTunes before 10.2 on Windows, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other CVEs listed in APPLE-SA-2011-03-02-1. WebKit is prone to an unspecified memory-corruption vulnerability.
An attacker can exploit this issue by enticing an unsuspecting user into visiting a malicious webpage with a vulnerable application.
Very few technical details are currently available. We will update this BID when more information emerges.
Successful exploits will allow attackers to execute arbitrary code in the context of the affected browser or cause denial-of-service conditions; other attacks may also be possible.
NOTE: This issue was previously discussed in BID 46654 (WebKit Multiple Memory Corruption Vulnerabilities) but has been given its own record to better document it. WebKit is a set of open source web browser engines jointly developed by companies such as KDE, Apple (Apple), and Google (Google), and is currently used by browsers such as Apple Safari and Google Chrome. A buffer overflow vulnerability exists in WebKit used in versions prior to 10.2 of Apple iTunes on Windows-based platforms
| VAR-201103-0250 | CVE-2011-0149 | plural Apple Product WebKit Vulnerable to arbitrary code execution |
CVSS V2: 7.6 CVSS V3: - Severity: HIGH |
WebKit, as used in Apple iTunes before 10.2 on Windows, does not properly parse HTML elements associated with document namespaces, which allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to a "dangling pointer" and iTunes Store browsing, a different vulnerability than other CVEs listed in APPLE-SA-2011-03-02-1. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple's Webkit Library. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within how the application parses a specially formatted HTML file. When parsing a particular element that also defines the namespace of the document, the library will call a dangling pointer which is consistent but unmapped. Due to this being unmapped, if an attacker can get code loaded at that address this can can lead to code execution under the context of the application. WebKit is prone to multiple memory-corruption vulnerabilities.
An attacker may exploit these issues by enticing victims into viewing a malicious webpage.
This BID is being retired. The following individual records exists to better document the issues:
46684 WebKit CVE-2011-0111 Unspecified Memory Corruption Vulnerability
46686 WebKit CVE-2011-0117 Unspecified Memory Corruption Vulnerability
46687 WebKit CVE-2011-0118 Unspecified Memory Corruption Vulnerability
46688 WebKit CVE-2011-0119 Unspecified Memory Corruption Vulnerability
46689 WebKit CVE-2011-0141 Unspecified Memory Corruption Vulnerability
46690 WebKit CVE-2011-0136 Unspecified Memory Corruption Vulnerability
46691 WebKit CVE-2011-0114 Unspecified Memory Corruption Vulnerability
46692 WebKit CVE-2011-0128 Unspecified Memory Corruption Vulnerability
46693 WebKit CVE-2011-0129 Unspecified Memory Corruption Vulnerability
46694 WebKit CVE-2011-0120 Unspecified Memory Corruption Vulnerability
46695 WebKit CVE-2011-0143 Unspecified Memory Corruption Vulnerability
46696 WebKit CVE-2011-0121 Unspecified Memory Corruption Vulnerability
46698 WebKit CVE-2011-0123 Unspecified Memory Corruption Vulnerability
46699 WebKit CVE-2011-0144 Unspecified Memory Corruption Vulnerability
46700 WebKit CVE-2011-0130 Unspecified Memory Corruption Vulnerability
46701 WebKit CVE-2011-0125 Unspecified Memory Corruption Vulnerability
46702 WebKit CVE-2011-0147 Unspecified Memory Corruption Vulnerability
46703 WebKit CVE-2011-0164 Unspecified Memory Corruption Vulnerability
46704 WebKit CVE-2011-0131 Unspecified Memory Corruption Vulnerability
46705 WebKit CVE-2011-0127 Unspecified Memory Corruption Vulnerability
46706 WebKit CVE-2011-0142 Unspecified Memory Corruption Vulnerability
46707 WebKit CVE-2011-0137 Unspecified Memory Corruption Vulnerability
46708 WebKit CVE-2011-0148 Unspecified Memory Corruption Vulnerability
46709 WebKit CVE-2011-0135 Unspecified Memory Corruption Vulnerability
46710 WebKit CVE-2011-0145 Unspecified Memory Corruption Vulnerability
46711 WebKit CVE-2011-0134 Unspecified Memory Corruption Vulnerability
46712 WebKit CVE-2011-0139 Unspecified Memory Corruption Vulnerability
46713 WebKit CVE-2011-0138 Unspecified Memory Corruption Vulnerability
46714 WebKit CVE-2011-0140 Unspecified Memory Corruption Vulnerability
46715 WebKit CVE-2011-0146 Unspecified Memory Corruption Vulnerability
46716 WebKit CVE-2011-0165 Unspecified Memory Corruption Vulnerability
46717 WebKit CVE-2011-0150 Unspecified Memory Corruption Vulnerability
46718 WebKit CVE-2011-0152 Unspecified Memory Corruption Vulnerability
46719 WebKit CVE-2011-0151 Unspecified Memory Corruption Vulnerability
46720 WebKit CVE-2011-0153 Unspecified Memory Corruption Vulnerability
46721 WebKit CVE-2011-0155 Unspecified Memory Corruption Vulnerability
46722 WebKit CVE-2011-0168 Unspecified Memory Corruption Vulnerability
46723 WebKit CVE-2011-0122 Unspecified Memory Corruption Vulnerability
46724 WebKit CVE-2011-0156 Unspecified Memory Corruption Vulnerability
46725 WebKit CVE-2011-0124 Unspecified Memory Corruption Vulnerability
46726 WebKit CVE-2011-0112 Unspecified Memory Corruption Vulnerability
46727 WebKit CVE-2011-0126 Unspecified Memory Corruption Vulnerability
46728 WebKit CVE-2011-0113 Unspecified Memory Corruption Vulnerability
46744 WebKit CVE-2011-0149 'HTMLBRElement' Style Memory Corruption Vulnerability
46745 WebKit CVE-2011-0154 Javascript 'sort()' Method Memory Corruption Vulnerability
46746 WebKit Range Object Remote Code Execution Vulnerability
46747 WebKit CVE-2011-0116 'setOuterText()' Method Memory Corruption Remote Code Execution Vulnerability
46748 WebKit 'Runin' Box CVE-2011-0132 Use-After-Free Memory Corruption Vulnerability
46749 WebKit CVE-2011-0133 Glyph Data Memory Corruption Vulnerability.
NOTE: This issue was previously discussed in BID 46654 (WebKit Multiple Memory Corruption Vulnerabilities) but has been given its own record to better document it. WebKit is a set of open source web browser engines jointly developed by companies such as KDE, Apple (Apple), and Google (Google), and is currently used by browsers such as Apple Safari and Google Chrome. ZDI-11-100: Apple Webkit Root HTMLBRElement Style Remote Code Execution Vulnerability
http://www.zerodayinitiative.com/advisories/ZDI-11-100
March 2, 2011
-- CVE ID:
CVE-2011-0149
-- CVSS:
9, (AV:N/AC:M/Au:N/C:C/I:P/A:C)
-- Affected Vendors:
Apple
-- Affected Products:
Apple WebKit
-- TippingPoint(TM) IPS Customer Protection:
TippingPoint IPS customers have been protected against this
vulnerability by Digital Vaccine protection filter ID 10884.
-- Vendor Response:
Apple has issued an update to correct this vulnerability. More
details can be found at:
http://support.apple.com/kb/HT4554
-- Disclosure Timeline:
2010-10-18 - Vulnerability reported to vendor
2011-03-02 - Coordinated public release of advisory
-- Credit:
This vulnerability was discovered by:
* wushi of team509
-- About the Zero Day Initiative (ZDI):
Established by TippingPoint, The Zero Day Initiative (ZDI) represents
a best-of-breed model for rewarding security researchers for responsibly
disclosing discovered vulnerabilities.
Researchers interested in getting paid for their security research
through the ZDI can find more information and sign-up at:
http://www.zerodayinitiative.com
The ZDI is unique in how the acquired vulnerability information is
used. TippingPoint does not re-sell the vulnerability details or any
exploit code. Instead, upon notifying the affected product vendor,
TippingPoint provides its customers with zero day protection through
its intrusion prevention technology. Explicit details regarding the
specifics of the vulnerability are not exposed to any parties until
an official vendor patch is publicly available. Furthermore, with the
altruistic aim of helping to secure a broader user base, TippingPoint
provides this vulnerability information confidentially to security
vendors (including competitors) who have a vulnerability protection or
mitigation product.
Our vulnerability disclosure policy is available online at:
http://www.zerodayinitiative.com/advisories/disclosure_policy/
Follow the ZDI on Twitter:
http://twitter.com/thezdi
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
. ----------------------------------------------------------------------
Get a tax break on purchases of Secunia Solutions!
If you are a U.S. company, you may be qualified for a tax break for your software purchases. Learn more at:
http://secunia.com/products/corporate/vim/section_179/
----------------------------------------------------------------------
TITLE:
Apple iTunes Multiple Vulnerabilities
SECUNIA ADVISORY ID:
SA43582
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/43582/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=43582
RELEASE DATE:
2011-03-03
DISCUSS ADVISORY:
http://secunia.com/advisories/43582/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/43582/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=43582
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
Multiple vulnerabilities have been reported in Apple iTunes, which
can be exploited by malicious people to compromise a user's system.
1) Some errors exists due to the use of a vulnerable libpng library.
For more information:
SA40302
2) An array indexing error in the CoreGraphics library (ImageIO) when
processing the International Color Consortium (ICC) profile within a
JPEG image can be exploited to corrupt heap-based memory.
3) An error in the libTIFF library when handling JPEG encoded TIFF
images can be exploited to cause a buffer overflow.
4) A boundary error in the libTIFF library when handling CCITT Group
4 encoded TIFF images.
For more information:
SA43593
5) A double free error in the libxml library when handling XPath
expressions.
For more information:
SA42721
6) An error exists in the libxml library when traversing the XPath.
8) An error in the WebKit component when elements are being appended
to the DOM tree during the display of an error message can be
exploited to access a freed element via a specially crafted
document.
9) An error in the WebKit component when handling a DOM level 2 range
object can be exploited to corrupt memory by manipulating the DOM via
an event listener.
10) A use-after-free error in the "setOuterText()" method in the
htmlelement library (WebKit) when tracking DOM manipulations can be
exploited to dereference freed memory.
11) A use-after-free error in the WebKit component when promoting a
run-in element can be exploited to dereference freed memory.
12) An error in the WebKit component when performing layout
operations for a floating block of a pseudo-element can be exploited
to dereference uninitialised glyph data.
14) An error in the Javascript array "sort()" method (WebKit) can be
exploited to manipulate elements outside of the array's boundary.
SOLUTION:
Update to version 10.2.
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
PROVIDED AND/OR DISCOVERED BY:
2) Andrzej Dyjak via iDefense VCP
3, 4) Reported by the vendor
8, 11 - 13) wushi of team509 via ZDI
9) J23 via ZDI
10, 14) An anonymous person via ZDI
11) Jose A. Vazquez via ZDI
The vendor also credits:
5) Yang Dingning of NCNIPC, Graduate University of Chinese Academy of
Sciences
6) Bui Quang Minh, Bkis
8) kuzcc
9) Emil A Eklund, Google Inc
13) SkyLined, Google Chrome Security Team
The vendor provides a bundled list of credits for vulnerabilities in
#7:
Sergey Glazunov
Andreas Kling, Nokia
Yuzo Fujishima, Google Inc.
Abhishek Arya (Inferno), Google, Inc.
Mihai Parparita, Google, Inc.
Emil A Eklund, Google, Inc.
Michal Zalewski, Google, Inc.
Chris Evans, Google Chrome Security Team
SkyLined, Google Chrome Security Team
Chris Rohlf, Matasano Security
Aki Helin, OUSPG
Dirk Schulze
Slawomir Blazek
David Bloom
Famlam
Jan Tosovsky
Michael Gundlach
ORIGINAL ADVISORY:
Apple:
http://support.apple.com/kb/HT4554
iDefense VCP:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=897
ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-11-095/
http://www.zerodayinitiative.com/advisories/ZDI-11-096/
http://www.zerodayinitiative.com/advisories/ZDI-11-097/
http://www.zerodayinitiative.com/advisories/ZDI-11-098/
http://www.zerodayinitiative.com/advisories/ZDI-11-099/
http://www.zerodayinitiative.com/advisories/ZDI-11-100/
http://www.zerodayinitiative.com/advisories/ZDI-11-101/
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201103-0213 | CVE-2011-0112 | plural Apple Product WebKit Vulnerable to arbitrary code execution |
CVSS V2: 7.6 CVSS V3: - Severity: HIGH |
WebKit, as used in Apple iTunes before 10.2 on Windows, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other CVEs listed in APPLE-SA-2011-03-02-1. WebKit is prone to an unspecified memory-corruption vulnerability.
An attacker can exploit this issue by enticing an unsuspecting user into visiting a malicious webpage with a vulnerable application.
Very few technical details are currently available. We will update this BID when more information emerges.
Successful exploits will allow attackers to execute arbitrary code in the context of the affected browser or cause denial-of-service conditions; other attacks may also be possible.
NOTE: This issue was previously discussed in BID 46654 (WebKit Multiple Memory Corruption Vulnerabilities) but has been given its own record to better document it. WebKit is a set of open source web browser engines jointly developed by companies such as KDE, Apple (Apple), and Google (Google), and is currently used by browsers such as Apple Safari and Google Chrome. A buffer overflow vulnerability exists in WebKit used in versions prior to 10.2 of Apple iTunes on Windows-based platforms
| VAR-201103-0212 | CVE-2011-0111 | plural Apple Product WebKit Vulnerable to arbitrary code execution |
CVSS V2: 7.6 CVSS V3: - Severity: HIGH |
WebKit, as used in Apple iTunes before 10.2 on Windows, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other CVEs listed in APPLE-SA-2011-03-02-1. WebKit is prone to an unspecified memory-corruption vulnerability.
An attacker can exploit this issue by enticing an unsuspecting user into visiting a malicious webpage with a vulnerable application.
Very few technical details are currently available. We will update this BID when more information emerges.
Successful exploits will allow attackers to execute arbitrary code in the context of the affected browser or cause denial-of-service conditions; other attacks may also be possible.
NOTE: This issue was previously discussed in BID 46654 (WebKit Multiple Memory Corruption Vulnerabilities) but has been given its own record to better document it. WebKit is a set of open source web browser engines jointly developed by companies such as KDE, Apple (Apple), and Google (Google), and is currently used by browsers such as Apple Safari and Google Chrome. A buffer overflow vulnerability exists in WebKit used in versions prior to 10.2 of Apple iTunes on Windows-based platforms
| VAR-201103-0255 | CVE-2011-0154 | plural Apple Product WebKit Vulnerable to arbitrary code execution |
CVSS V2: 5.1 CVSS V3: - Severity: MEDIUM |
WebKit, as used in Apple iTunes before 10.2 on Windows and Apple iOS, does not properly implement the .sort function for JavaScript arrays, which allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other CVEs listed in APPLE-SA-2011-03-02-1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the way the library implements the .sort function for an array. The library will trust the implementation of a particular method which when executed can be used to manipulate elements out from underneath it. This can lead to code execution under the context of the application. WebKit is prone to multiple memory-corruption vulnerabilities.
An attacker may exploit these issues by enticing victims into viewing a malicious webpage.
This BID is being retired. The following individual records exists to better document the issues:
46684 WebKit CVE-2011-0111 Unspecified Memory Corruption Vulnerability
46686 WebKit CVE-2011-0117 Unspecified Memory Corruption Vulnerability
46687 WebKit CVE-2011-0118 Unspecified Memory Corruption Vulnerability
46688 WebKit CVE-2011-0119 Unspecified Memory Corruption Vulnerability
46689 WebKit CVE-2011-0141 Unspecified Memory Corruption Vulnerability
46690 WebKit CVE-2011-0136 Unspecified Memory Corruption Vulnerability
46691 WebKit CVE-2011-0114 Unspecified Memory Corruption Vulnerability
46692 WebKit CVE-2011-0128 Unspecified Memory Corruption Vulnerability
46693 WebKit CVE-2011-0129 Unspecified Memory Corruption Vulnerability
46694 WebKit CVE-2011-0120 Unspecified Memory Corruption Vulnerability
46695 WebKit CVE-2011-0143 Unspecified Memory Corruption Vulnerability
46696 WebKit CVE-2011-0121 Unspecified Memory Corruption Vulnerability
46698 WebKit CVE-2011-0123 Unspecified Memory Corruption Vulnerability
46699 WebKit CVE-2011-0144 Unspecified Memory Corruption Vulnerability
46700 WebKit CVE-2011-0130 Unspecified Memory Corruption Vulnerability
46701 WebKit CVE-2011-0125 Unspecified Memory Corruption Vulnerability
46702 WebKit CVE-2011-0147 Unspecified Memory Corruption Vulnerability
46703 WebKit CVE-2011-0164 Unspecified Memory Corruption Vulnerability
46704 WebKit CVE-2011-0131 Unspecified Memory Corruption Vulnerability
46705 WebKit CVE-2011-0127 Unspecified Memory Corruption Vulnerability
46706 WebKit CVE-2011-0142 Unspecified Memory Corruption Vulnerability
46707 WebKit CVE-2011-0137 Unspecified Memory Corruption Vulnerability
46708 WebKit CVE-2011-0148 Unspecified Memory Corruption Vulnerability
46709 WebKit CVE-2011-0135 Unspecified Memory Corruption Vulnerability
46710 WebKit CVE-2011-0145 Unspecified Memory Corruption Vulnerability
46711 WebKit CVE-2011-0134 Unspecified Memory Corruption Vulnerability
46712 WebKit CVE-2011-0139 Unspecified Memory Corruption Vulnerability
46713 WebKit CVE-2011-0138 Unspecified Memory Corruption Vulnerability
46714 WebKit CVE-2011-0140 Unspecified Memory Corruption Vulnerability
46715 WebKit CVE-2011-0146 Unspecified Memory Corruption Vulnerability
46716 WebKit CVE-2011-0165 Unspecified Memory Corruption Vulnerability
46717 WebKit CVE-2011-0150 Unspecified Memory Corruption Vulnerability
46718 WebKit CVE-2011-0152 Unspecified Memory Corruption Vulnerability
46719 WebKit CVE-2011-0151 Unspecified Memory Corruption Vulnerability
46720 WebKit CVE-2011-0153 Unspecified Memory Corruption Vulnerability
46721 WebKit CVE-2011-0155 Unspecified Memory Corruption Vulnerability
46722 WebKit CVE-2011-0168 Unspecified Memory Corruption Vulnerability
46723 WebKit CVE-2011-0122 Unspecified Memory Corruption Vulnerability
46724 WebKit CVE-2011-0156 Unspecified Memory Corruption Vulnerability
46725 WebKit CVE-2011-0124 Unspecified Memory Corruption Vulnerability
46726 WebKit CVE-2011-0112 Unspecified Memory Corruption Vulnerability
46727 WebKit CVE-2011-0126 Unspecified Memory Corruption Vulnerability
46728 WebKit CVE-2011-0113 Unspecified Memory Corruption Vulnerability
46744 WebKit CVE-2011-0149 'HTMLBRElement' Style Memory Corruption Vulnerability
46745 WebKit CVE-2011-0154 Javascript 'sort()' Method Memory Corruption Vulnerability
46746 WebKit Range Object Remote Code Execution Vulnerability
46747 WebKit CVE-2011-0116 'setOuterText()' Method Memory Corruption Remote Code Execution Vulnerability
46748 WebKit 'Runin' Box CVE-2011-0132 Use-After-Free Memory Corruption Vulnerability
46749 WebKit CVE-2011-0133 Glyph Data Memory Corruption Vulnerability.
NOTE: This issue was previously discussed in BID 46654 (WebKit Multiple Memory Corruption Vulnerabilities) but has been given its own record to better document it. WebKit is a set of open source web browser engines jointly developed by companies such as KDE, Apple (Apple), and Google (Google), and is currently used by browsers such as Apple Safari and Google Chrome. ----------------------------------------------------------------------
Get a tax break on purchases of Secunia Solutions!
If you are a U.S. company, you may be qualified for a tax break for your software purchases. Learn more at:
http://secunia.com/products/corporate/vim/section_179/
----------------------------------------------------------------------
TITLE:
Apple iTunes Multiple Vulnerabilities
SECUNIA ADVISORY ID:
SA43582
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/43582/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=43582
RELEASE DATE:
2011-03-03
DISCUSS ADVISORY:
http://secunia.com/advisories/43582/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/43582/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=43582
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
Multiple vulnerabilities have been reported in Apple iTunes, which
can be exploited by malicious people to compromise a user's system.
1) Some errors exists due to the use of a vulnerable libpng library.
For more information:
SA40302
2) An array indexing error in the CoreGraphics library (ImageIO) when
processing the International Color Consortium (ICC) profile within a
JPEG image can be exploited to corrupt heap-based memory.
3) An error in the libTIFF library when handling JPEG encoded TIFF
images can be exploited to cause a buffer overflow.
4) A boundary error in the libTIFF library when handling CCITT Group
4 encoded TIFF images.
For more information:
SA43593
5) A double free error in the libxml library when handling XPath
expressions.
For more information:
SA42721
6) An error exists in the libxml library when traversing the XPath.
8) An error in the WebKit component when elements are being appended
to the DOM tree during the display of an error message can be
exploited to access a freed element via a specially crafted
document.
9) An error in the WebKit component when handling a DOM level 2 range
object can be exploited to corrupt memory by manipulating the DOM via
an event listener.
10) A use-after-free error in the "setOuterText()" method in the
htmlelement library (WebKit) when tracking DOM manipulations can be
exploited to dereference freed memory.
11) A use-after-free error in the WebKit component when promoting a
run-in element can be exploited to dereference freed memory.
12) An error in the WebKit component when performing layout
operations for a floating block of a pseudo-element can be exploited
to dereference uninitialised glyph data.
13) An error in the WebKit component when parsing a Root
HTMLBRElement element can be exploited to call an unmapped dangling
pointer.
SOLUTION:
Update to version 10.2.
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
PROVIDED AND/OR DISCOVERED BY:
2) Andrzej Dyjak via iDefense VCP
3, 4) Reported by the vendor
8, 11 - 13) wushi of team509 via ZDI
9) J23 via ZDI
10, 14) An anonymous person via ZDI
11) Jose A. Vazquez via ZDI
The vendor also credits:
5) Yang Dingning of NCNIPC, Graduate University of Chinese Academy of
Sciences
6) Bui Quang Minh, Bkis
8) kuzcc
9) Emil A Eklund, Google Inc
13) SkyLined, Google Chrome Security Team
The vendor provides a bundled list of credits for vulnerabilities in
#7:
Sergey Glazunov
Andreas Kling, Nokia
Yuzo Fujishima, Google Inc.
Abhishek Arya (Inferno), Google, Inc.
Mihai Parparita, Google, Inc.
Emil A Eklund, Google, Inc.
Michal Zalewski, Google, Inc.
Chris Evans, Google Chrome Security Team
SkyLined, Google Chrome Security Team
Chris Rohlf, Matasano Security
Aki Helin, OUSPG
Dirk Schulze
Slawomir Blazek
David Bloom
Famlam
Jan Tosovsky
Michael Gundlach
ORIGINAL ADVISORY:
Apple:
http://support.apple.com/kb/HT4554
iDefense VCP:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=897
ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-11-095/
http://www.zerodayinitiative.com/advisories/ZDI-11-096/
http://www.zerodayinitiative.com/advisories/ZDI-11-097/
http://www.zerodayinitiative.com/advisories/ZDI-11-098/
http://www.zerodayinitiative.com/advisories/ZDI-11-099/
http://www.zerodayinitiative.com/advisories/ZDI-11-100/
http://www.zerodayinitiative.com/advisories/ZDI-11-101/
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
. ZDI-11-101: Apple iPhone Webkit Library Javascript Array sort Method Remote Code Execution Vulnerability
http://www.zerodayinitiative.com/advisories/ZDI-11-101
March 2, 2011
-- CVE ID:
CVE-2011-0154
-- CVSS:
9, (AV:N/AC:L/Au:N/C:P/I:P/A:C)
-- Affected Vendors:
Apple
-- Affected Products:
Apple WebKit
-- TippingPoint(TM) IPS Customer Protection:
TippingPoint IPS customers have been protected against this
vulnerability by Digital Vaccine protection filter ID 10849.
-- Vendor Response:
Apple has issued an update to correct this vulnerability. More
details can be found at:
http://support.apple.com/kb/HT4554
-- Disclosure Timeline:
2010-09-29 - Vulnerability reported to vendor
2011-03-02 - Coordinated public release of advisory
-- Credit:
This vulnerability was discovered by:
* Anonymous
-- About the Zero Day Initiative (ZDI):
Established by TippingPoint, The Zero Day Initiative (ZDI) represents
a best-of-breed model for rewarding security researchers for responsibly
disclosing discovered vulnerabilities.
Researchers interested in getting paid for their security research
through the ZDI can find more information and sign-up at:
http://www.zerodayinitiative.com
The ZDI is unique in how the acquired vulnerability information is
used. TippingPoint does not re-sell the vulnerability details or any
exploit code. Instead, upon notifying the affected product vendor,
TippingPoint provides its customers with zero day protection through
its intrusion prevention technology. Explicit details regarding the
specifics of the vulnerability are not exposed to any parties until
an official vendor patch is publicly available. Furthermore, with the
altruistic aim of helping to secure a broader user base, TippingPoint
provides this vulnerability information confidentially to security
vendors (including competitors) who have a vulnerability protection or
mitigation product.
Our vulnerability disclosure policy is available online at:
http://www.zerodayinitiative.com/advisories/disclosure_policy/
Follow the ZDI on Twitter:
http://twitter.com/thezdi
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
| VAR-201103-0234 | CVE-2011-0133 | plural Apple Product WebKit Vulnerable to arbitrary code execution |
CVSS V2: 7.6 CVSS V3: - Severity: HIGH |
WebKit, as used in Apple iTunes before 10.2 on Windows, does not properly access glyph data during layout actions for floating blocks associated with pseudo-elements, which allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other CVEs listed in APPLE-SA-2011-03-02-1. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple Safari's Webkit. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the way the application handles floating blocks in certain situations. When performing layout operations for a floating block produced by a pseudo-element, the application will attempt to access glyph data that hasn't been fully assigned into the glyph data hashmap. Due to this type being incomplete, this can lead to code execution under the context of the application. WebKit is prone to multiple memory-corruption vulnerabilities.
An attacker may exploit these issues by enticing victims into viewing a malicious webpage.
This BID is being retired. The following individual records exists to better document the issues:
46684 WebKit CVE-2011-0111 Unspecified Memory Corruption Vulnerability
46686 WebKit CVE-2011-0117 Unspecified Memory Corruption Vulnerability
46687 WebKit CVE-2011-0118 Unspecified Memory Corruption Vulnerability
46688 WebKit CVE-2011-0119 Unspecified Memory Corruption Vulnerability
46689 WebKit CVE-2011-0141 Unspecified Memory Corruption Vulnerability
46690 WebKit CVE-2011-0136 Unspecified Memory Corruption Vulnerability
46691 WebKit CVE-2011-0114 Unspecified Memory Corruption Vulnerability
46692 WebKit CVE-2011-0128 Unspecified Memory Corruption Vulnerability
46693 WebKit CVE-2011-0129 Unspecified Memory Corruption Vulnerability
46694 WebKit CVE-2011-0120 Unspecified Memory Corruption Vulnerability
46695 WebKit CVE-2011-0143 Unspecified Memory Corruption Vulnerability
46696 WebKit CVE-2011-0121 Unspecified Memory Corruption Vulnerability
46698 WebKit CVE-2011-0123 Unspecified Memory Corruption Vulnerability
46699 WebKit CVE-2011-0144 Unspecified Memory Corruption Vulnerability
46700 WebKit CVE-2011-0130 Unspecified Memory Corruption Vulnerability
46701 WebKit CVE-2011-0125 Unspecified Memory Corruption Vulnerability
46702 WebKit CVE-2011-0147 Unspecified Memory Corruption Vulnerability
46703 WebKit CVE-2011-0164 Unspecified Memory Corruption Vulnerability
46704 WebKit CVE-2011-0131 Unspecified Memory Corruption Vulnerability
46705 WebKit CVE-2011-0127 Unspecified Memory Corruption Vulnerability
46706 WebKit CVE-2011-0142 Unspecified Memory Corruption Vulnerability
46707 WebKit CVE-2011-0137 Unspecified Memory Corruption Vulnerability
46708 WebKit CVE-2011-0148 Unspecified Memory Corruption Vulnerability
46709 WebKit CVE-2011-0135 Unspecified Memory Corruption Vulnerability
46710 WebKit CVE-2011-0145 Unspecified Memory Corruption Vulnerability
46711 WebKit CVE-2011-0134 Unspecified Memory Corruption Vulnerability
46712 WebKit CVE-2011-0139 Unspecified Memory Corruption Vulnerability
46713 WebKit CVE-2011-0138 Unspecified Memory Corruption Vulnerability
46714 WebKit CVE-2011-0140 Unspecified Memory Corruption Vulnerability
46715 WebKit CVE-2011-0146 Unspecified Memory Corruption Vulnerability
46716 WebKit CVE-2011-0165 Unspecified Memory Corruption Vulnerability
46717 WebKit CVE-2011-0150 Unspecified Memory Corruption Vulnerability
46718 WebKit CVE-2011-0152 Unspecified Memory Corruption Vulnerability
46719 WebKit CVE-2011-0151 Unspecified Memory Corruption Vulnerability
46720 WebKit CVE-2011-0153 Unspecified Memory Corruption Vulnerability
46721 WebKit CVE-2011-0155 Unspecified Memory Corruption Vulnerability
46722 WebKit CVE-2011-0168 Unspecified Memory Corruption Vulnerability
46723 WebKit CVE-2011-0122 Unspecified Memory Corruption Vulnerability
46724 WebKit CVE-2011-0156 Unspecified Memory Corruption Vulnerability
46725 WebKit CVE-2011-0124 Unspecified Memory Corruption Vulnerability
46726 WebKit CVE-2011-0112 Unspecified Memory Corruption Vulnerability
46727 WebKit CVE-2011-0126 Unspecified Memory Corruption Vulnerability
46728 WebKit CVE-2011-0113 Unspecified Memory Corruption Vulnerability
46744 WebKit CVE-2011-0149 'HTMLBRElement' Style Memory Corruption Vulnerability
46745 WebKit CVE-2011-0154 Javascript 'sort()' Method Memory Corruption Vulnerability
46746 WebKit Range Object Remote Code Execution Vulnerability
46747 WebKit CVE-2011-0116 'setOuterText()' Method Memory Corruption Remote Code Execution Vulnerability
46748 WebKit 'Runin' Box CVE-2011-0132 Use-After-Free Memory Corruption Vulnerability
46749 WebKit CVE-2011-0133 Glyph Data Memory Corruption Vulnerability.
NOTE: This issue was previously discussed in BID 46654 (WebKit Multiple Memory Corruption Vulnerabilities) but has been given its own record to better document it. WebKit is a set of open source web browser engines jointly developed by companies such as KDE, Apple (Apple), and Google (Google), and is currently used by browsers such as Apple Safari and Google Chrome.
-- Vendor Response:
Apple has issued an update to correct this vulnerability. More
details can be found at:
http://support.apple.com/kb/HT4554
-- Disclosure Timeline:
2010-10-18 - Vulnerability reported to vendor
2011-03-02 - Coordinated public release of advisory
-- Credit:
This vulnerability was discovered by:
* wushi of team509
-- About the Zero Day Initiative (ZDI):
Established by TippingPoint, The Zero Day Initiative (ZDI) represents
a best-of-breed model for rewarding security researchers for responsibly
disclosing discovered vulnerabilities.
Researchers interested in getting paid for their security research
through the ZDI can find more information and sign-up at:
http://www.zerodayinitiative.com
The ZDI is unique in how the acquired vulnerability information is
used. TippingPoint does not re-sell the vulnerability details or any
exploit code. Instead, upon notifying the affected product vendor,
TippingPoint provides its customers with zero day protection through
its intrusion prevention technology. Explicit details regarding the
specifics of the vulnerability are not exposed to any parties until
an official vendor patch is publicly available. Furthermore, with the
altruistic aim of helping to secure a broader user base, TippingPoint
provides this vulnerability information confidentially to security
vendors (including competitors) who have a vulnerability protection or
mitigation product.
Our vulnerability disclosure policy is available online at:
http://www.zerodayinitiative.com/advisories/disclosure_policy/
Follow the ZDI on Twitter:
http://twitter.com/thezdi
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
. ----------------------------------------------------------------------
Get a tax break on purchases of Secunia Solutions!
If you are a U.S. company, you may be qualified for a tax break for your software purchases. Learn more at:
http://secunia.com/products/corporate/vim/section_179/
----------------------------------------------------------------------
TITLE:
Apple iTunes Multiple Vulnerabilities
SECUNIA ADVISORY ID:
SA43582
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/43582/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=43582
RELEASE DATE:
2011-03-03
DISCUSS ADVISORY:
http://secunia.com/advisories/43582/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/43582/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=43582
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
Multiple vulnerabilities have been reported in Apple iTunes, which
can be exploited by malicious people to compromise a user's system.
1) Some errors exists due to the use of a vulnerable libpng library.
For more information:
SA40302
2) An array indexing error in the CoreGraphics library (ImageIO) when
processing the International Color Consortium (ICC) profile within a
JPEG image can be exploited to corrupt heap-based memory.
3) An error in the libTIFF library when handling JPEG encoded TIFF
images can be exploited to cause a buffer overflow.
4) A boundary error in the libTIFF library when handling CCITT Group
4 encoded TIFF images.
For more information:
SA43593
5) A double free error in the libxml library when handling XPath
expressions.
For more information:
SA42721
6) An error exists in the libxml library when traversing the XPath.
8) An error in the WebKit component when elements are being appended
to the DOM tree during the display of an error message can be
exploited to access a freed element via a specially crafted
document.
9) An error in the WebKit component when handling a DOM level 2 range
object can be exploited to corrupt memory by manipulating the DOM via
an event listener.
10) A use-after-free error in the "setOuterText()" method in the
htmlelement library (WebKit) when tracking DOM manipulations can be
exploited to dereference freed memory.
11) A use-after-free error in the WebKit component when promoting a
run-in element can be exploited to dereference freed memory.
13) An error in the WebKit component when parsing a Root
HTMLBRElement element can be exploited to call an unmapped dangling
pointer.
14) An error in the Javascript array "sort()" method (WebKit) can be
exploited to manipulate elements outside of the array's boundary.
SOLUTION:
Update to version 10.2.
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
PROVIDED AND/OR DISCOVERED BY:
2) Andrzej Dyjak via iDefense VCP
3, 4) Reported by the vendor
8, 11 - 13) wushi of team509 via ZDI
9) J23 via ZDI
10, 14) An anonymous person via ZDI
11) Jose A. Vazquez via ZDI
The vendor also credits:
5) Yang Dingning of NCNIPC, Graduate University of Chinese Academy of
Sciences
6) Bui Quang Minh, Bkis
8) kuzcc
9) Emil A Eklund, Google Inc
13) SkyLined, Google Chrome Security Team
The vendor provides a bundled list of credits for vulnerabilities in
#7:
Sergey Glazunov
Andreas Kling, Nokia
Yuzo Fujishima, Google Inc.
Abhishek Arya (Inferno), Google, Inc.
Mihai Parparita, Google, Inc.
Emil A Eklund, Google, Inc.
Michal Zalewski, Google, Inc.
Chris Evans, Google Chrome Security Team
SkyLined, Google Chrome Security Team
Chris Rohlf, Matasano Security
Aki Helin, OUSPG
Dirk Schulze
Slawomir Blazek
David Bloom
Famlam
Jan Tosovsky
Michael Gundlach
ORIGINAL ADVISORY:
Apple:
http://support.apple.com/kb/HT4554
iDefense VCP:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=897
ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-11-095/
http://www.zerodayinitiative.com/advisories/ZDI-11-096/
http://www.zerodayinitiative.com/advisories/ZDI-11-097/
http://www.zerodayinitiative.com/advisories/ZDI-11-098/
http://www.zerodayinitiative.com/advisories/ZDI-11-099/
http://www.zerodayinitiative.com/advisories/ZDI-11-100/
http://www.zerodayinitiative.com/advisories/ZDI-11-101/
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201103-0233 | CVE-2011-0132 | plural Apple Product WebKit Vulnerable to arbitrary code execution |
CVSS V2: 7.6 CVSS V3: - Severity: HIGH |
Use-after-free vulnerability in the Runin box functionality in the Cascading Style Sheets (CSS) 2.1 Visual Formatting Model implementation in WebKit, as used in Apple iTunes before 10.2 on Windows and Apple Safari, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other CVEs listed in APPLE-SA-2011-03-02-1. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple Safari's Webkit. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the way the WebKit library implements the requirements required for a Runin box as outlined in the Visual Formatting Model listed in the CSS 2.1 Specification. When promoting a run-in element the application will incorrectly free one of the child elements of the run-in. Later, when attempting to do layout for this element, the application will access the freed element due to the dangling reference. This can lead to code execution under the context of the application. WebKit is prone to multiple memory-corruption vulnerabilities.
An attacker may exploit these issues by enticing victims into viewing a malicious webpage.
This BID is being retired. The following individual records exists to better document the issues:
46684 WebKit CVE-2011-0111 Unspecified Memory Corruption Vulnerability
46686 WebKit CVE-2011-0117 Unspecified Memory Corruption Vulnerability
46687 WebKit CVE-2011-0118 Unspecified Memory Corruption Vulnerability
46688 WebKit CVE-2011-0119 Unspecified Memory Corruption Vulnerability
46689 WebKit CVE-2011-0141 Unspecified Memory Corruption Vulnerability
46690 WebKit CVE-2011-0136 Unspecified Memory Corruption Vulnerability
46691 WebKit CVE-2011-0114 Unspecified Memory Corruption Vulnerability
46692 WebKit CVE-2011-0128 Unspecified Memory Corruption Vulnerability
46693 WebKit CVE-2011-0129 Unspecified Memory Corruption Vulnerability
46694 WebKit CVE-2011-0120 Unspecified Memory Corruption Vulnerability
46695 WebKit CVE-2011-0143 Unspecified Memory Corruption Vulnerability
46696 WebKit CVE-2011-0121 Unspecified Memory Corruption Vulnerability
46698 WebKit CVE-2011-0123 Unspecified Memory Corruption Vulnerability
46699 WebKit CVE-2011-0144 Unspecified Memory Corruption Vulnerability
46700 WebKit CVE-2011-0130 Unspecified Memory Corruption Vulnerability
46701 WebKit CVE-2011-0125 Unspecified Memory Corruption Vulnerability
46702 WebKit CVE-2011-0147 Unspecified Memory Corruption Vulnerability
46703 WebKit CVE-2011-0164 Unspecified Memory Corruption Vulnerability
46704 WebKit CVE-2011-0131 Unspecified Memory Corruption Vulnerability
46705 WebKit CVE-2011-0127 Unspecified Memory Corruption Vulnerability
46706 WebKit CVE-2011-0142 Unspecified Memory Corruption Vulnerability
46707 WebKit CVE-2011-0137 Unspecified Memory Corruption Vulnerability
46708 WebKit CVE-2011-0148 Unspecified Memory Corruption Vulnerability
46709 WebKit CVE-2011-0135 Unspecified Memory Corruption Vulnerability
46710 WebKit CVE-2011-0145 Unspecified Memory Corruption Vulnerability
46711 WebKit CVE-2011-0134 Unspecified Memory Corruption Vulnerability
46712 WebKit CVE-2011-0139 Unspecified Memory Corruption Vulnerability
46713 WebKit CVE-2011-0138 Unspecified Memory Corruption Vulnerability
46714 WebKit CVE-2011-0140 Unspecified Memory Corruption Vulnerability
46715 WebKit CVE-2011-0146 Unspecified Memory Corruption Vulnerability
46716 WebKit CVE-2011-0165 Unspecified Memory Corruption Vulnerability
46717 WebKit CVE-2011-0150 Unspecified Memory Corruption Vulnerability
46718 WebKit CVE-2011-0152 Unspecified Memory Corruption Vulnerability
46719 WebKit CVE-2011-0151 Unspecified Memory Corruption Vulnerability
46720 WebKit CVE-2011-0153 Unspecified Memory Corruption Vulnerability
46721 WebKit CVE-2011-0155 Unspecified Memory Corruption Vulnerability
46722 WebKit CVE-2011-0168 Unspecified Memory Corruption Vulnerability
46723 WebKit CVE-2011-0122 Unspecified Memory Corruption Vulnerability
46724 WebKit CVE-2011-0156 Unspecified Memory Corruption Vulnerability
46725 WebKit CVE-2011-0124 Unspecified Memory Corruption Vulnerability
46726 WebKit CVE-2011-0112 Unspecified Memory Corruption Vulnerability
46727 WebKit CVE-2011-0126 Unspecified Memory Corruption Vulnerability
46728 WebKit CVE-2011-0113 Unspecified Memory Corruption Vulnerability
46744 WebKit CVE-2011-0149 'HTMLBRElement' Style Memory Corruption Vulnerability
46745 WebKit CVE-2011-0154 Javascript 'sort()' Method Memory Corruption Vulnerability
46746 WebKit Range Object Remote Code Execution Vulnerability
46747 WebKit CVE-2011-0116 'setOuterText()' Method Memory Corruption Remote Code Execution Vulnerability
46748 WebKit 'Runin' Box CVE-2011-0132 Use-After-Free Memory Corruption Vulnerability
46749 WebKit CVE-2011-0133 Glyph Data Memory Corruption Vulnerability.
NOTE: This issue was previously discussed in BID 46654 (WebKit Multiple Memory Corruption Vulnerabilities) but has been given its own record to better document it. WebKit is a set of open source web browser engines jointly developed by companies such as KDE, Apple (Apple), and Google (Google), and is currently used by browsers such as Apple Safari and Google Chrome.
-- Vendor Response:
Apple has issued an update to correct this vulnerability. Vazquez of {http://spa-s3c.blogspot.com/}
-- About the Zero Day Initiative (ZDI):
Established by TippingPoint, The Zero Day Initiative (ZDI) represents
a best-of-breed model for rewarding security researchers for responsibly
disclosing discovered vulnerabilities.
Researchers interested in getting paid for their security research
through the ZDI can find more information and sign-up at:
http://www.zerodayinitiative.com
The ZDI is unique in how the acquired vulnerability information is
used. TippingPoint does not re-sell the vulnerability details or any
exploit code. Instead, upon notifying the affected product vendor,
TippingPoint provides its customers with zero day protection through
its intrusion prevention technology. Explicit details regarding the
specifics of the vulnerability are not exposed to any parties until
an official vendor patch is publicly available. Furthermore, with the
altruistic aim of helping to secure a broader user base, TippingPoint
provides this vulnerability information confidentially to security
vendors (including competitors) who have a vulnerability protection or
mitigation product.
Our vulnerability disclosure policy is available online at:
http://www.zerodayinitiative.com/advisories/disclosure_policy/
Follow the ZDI on Twitter:
http://twitter.com/thezdi
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
. ----------------------------------------------------------------------
Get a tax break on purchases of Secunia Solutions!
If you are a U.S. company, you may be qualified for a tax break for your software purchases. Learn more at:
http://secunia.com/products/corporate/vim/section_179/
----------------------------------------------------------------------
TITLE:
Apple iTunes Multiple Vulnerabilities
SECUNIA ADVISORY ID:
SA43582
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/43582/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=43582
RELEASE DATE:
2011-03-03
DISCUSS ADVISORY:
http://secunia.com/advisories/43582/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/43582/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=43582
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
Multiple vulnerabilities have been reported in Apple iTunes, which
can be exploited by malicious people to compromise a user's system.
1) Some errors exists due to the use of a vulnerable libpng library.
For more information:
SA40302
2) An array indexing error in the CoreGraphics library (ImageIO) when
processing the International Color Consortium (ICC) profile within a
JPEG image can be exploited to corrupt heap-based memory.
3) An error in the libTIFF library when handling JPEG encoded TIFF
images can be exploited to cause a buffer overflow.
4) A boundary error in the libTIFF library when handling CCITT Group
4 encoded TIFF images.
For more information:
SA43593
5) A double free error in the libxml library when handling XPath
expressions.
For more information:
SA42721
6) An error exists in the libxml library when traversing the XPath.
8) An error in the WebKit component when elements are being appended
to the DOM tree during the display of an error message can be
exploited to access a freed element via a specially crafted
document.
9) An error in the WebKit component when handling a DOM level 2 range
object can be exploited to corrupt memory by manipulating the DOM via
an event listener.
10) A use-after-free error in the "setOuterText()" method in the
htmlelement library (WebKit) when tracking DOM manipulations can be
exploited to dereference freed memory.
12) An error in the WebKit component when performing layout
operations for a floating block of a pseudo-element can be exploited
to dereference uninitialised glyph data.
13) An error in the WebKit component when parsing a Root
HTMLBRElement element can be exploited to call an unmapped dangling
pointer.
14) An error in the Javascript array "sort()" method (WebKit) can be
exploited to manipulate elements outside of the array's boundary.
SOLUTION:
Update to version 10.2.
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
PROVIDED AND/OR DISCOVERED BY:
2) Andrzej Dyjak via iDefense VCP
3, 4) Reported by the vendor
8, 11 - 13) wushi of team509 via ZDI
9) J23 via ZDI
10, 14) An anonymous person via ZDI
11) Jose A. Vazquez via ZDI
The vendor also credits:
5) Yang Dingning of NCNIPC, Graduate University of Chinese Academy of
Sciences
6) Bui Quang Minh, Bkis
8) kuzcc
9) Emil A Eklund, Google Inc
13) SkyLined, Google Chrome Security Team
The vendor provides a bundled list of credits for vulnerabilities in
#7:
Sergey Glazunov
Andreas Kling, Nokia
Yuzo Fujishima, Google Inc.
Abhishek Arya (Inferno), Google, Inc.
Mihai Parparita, Google, Inc.
Emil A Eklund, Google, Inc.
Michal Zalewski, Google, Inc.
Chris Evans, Google Chrome Security Team
SkyLined, Google Chrome Security Team
Chris Rohlf, Matasano Security
Aki Helin, OUSPG
Dirk Schulze
Slawomir Blazek
David Bloom
Famlam
Jan Tosovsky
Michael Gundlach
ORIGINAL ADVISORY:
Apple:
http://support.apple.com/kb/HT4554
iDefense VCP:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=897
ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-11-095/
http://www.zerodayinitiative.com/advisories/ZDI-11-096/
http://www.zerodayinitiative.com/advisories/ZDI-11-097/
http://www.zerodayinitiative.com/advisories/ZDI-11-098/
http://www.zerodayinitiative.com/advisories/ZDI-11-099/
http://www.zerodayinitiative.com/advisories/ZDI-11-100/
http://www.zerodayinitiative.com/advisories/ZDI-11-101/
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201103-0217 | CVE-2011-0116 | Apple Webkit setOuterText Memory Corruption Remote Code Execution Vulnerability |
CVSS V2: 7.6 CVSS V3: - Severity: HIGH |
Use-after-free vulnerability in the setOuterText method in the htmlelement library in WebKit, as used in Apple iTunes before 10.2 on Windows, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to DOM manipulations during iTunes Store browsing, a different vulnerability than other CVEs listed in APPLE-SA-2011-03-02-1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the setOuterText method of the Webkit htmlelement library. Due to a failure to properly track DOM manipulations made within the browser, it is possible to make use of a previously freed pointer and facilitate remote code execution under the context of the user running the browser process. WebKit is prone to multiple memory-corruption vulnerabilities.
An attacker may exploit these issues by enticing victims into viewing a malicious webpage.
This BID is being retired. The following individual records exists to better document the issues:
46684 WebKit CVE-2011-0111 Unspecified Memory Corruption Vulnerability
46686 WebKit CVE-2011-0117 Unspecified Memory Corruption Vulnerability
46687 WebKit CVE-2011-0118 Unspecified Memory Corruption Vulnerability
46688 WebKit CVE-2011-0119 Unspecified Memory Corruption Vulnerability
46689 WebKit CVE-2011-0141 Unspecified Memory Corruption Vulnerability
46690 WebKit CVE-2011-0136 Unspecified Memory Corruption Vulnerability
46691 WebKit CVE-2011-0114 Unspecified Memory Corruption Vulnerability
46692 WebKit CVE-2011-0128 Unspecified Memory Corruption Vulnerability
46693 WebKit CVE-2011-0129 Unspecified Memory Corruption Vulnerability
46694 WebKit CVE-2011-0120 Unspecified Memory Corruption Vulnerability
46695 WebKit CVE-2011-0143 Unspecified Memory Corruption Vulnerability
46696 WebKit CVE-2011-0121 Unspecified Memory Corruption Vulnerability
46698 WebKit CVE-2011-0123 Unspecified Memory Corruption Vulnerability
46699 WebKit CVE-2011-0144 Unspecified Memory Corruption Vulnerability
46700 WebKit CVE-2011-0130 Unspecified Memory Corruption Vulnerability
46701 WebKit CVE-2011-0125 Unspecified Memory Corruption Vulnerability
46702 WebKit CVE-2011-0147 Unspecified Memory Corruption Vulnerability
46703 WebKit CVE-2011-0164 Unspecified Memory Corruption Vulnerability
46704 WebKit CVE-2011-0131 Unspecified Memory Corruption Vulnerability
46705 WebKit CVE-2011-0127 Unspecified Memory Corruption Vulnerability
46706 WebKit CVE-2011-0142 Unspecified Memory Corruption Vulnerability
46707 WebKit CVE-2011-0137 Unspecified Memory Corruption Vulnerability
46708 WebKit CVE-2011-0148 Unspecified Memory Corruption Vulnerability
46709 WebKit CVE-2011-0135 Unspecified Memory Corruption Vulnerability
46710 WebKit CVE-2011-0145 Unspecified Memory Corruption Vulnerability
46711 WebKit CVE-2011-0134 Unspecified Memory Corruption Vulnerability
46712 WebKit CVE-2011-0139 Unspecified Memory Corruption Vulnerability
46713 WebKit CVE-2011-0138 Unspecified Memory Corruption Vulnerability
46714 WebKit CVE-2011-0140 Unspecified Memory Corruption Vulnerability
46715 WebKit CVE-2011-0146 Unspecified Memory Corruption Vulnerability
46716 WebKit CVE-2011-0165 Unspecified Memory Corruption Vulnerability
46717 WebKit CVE-2011-0150 Unspecified Memory Corruption Vulnerability
46718 WebKit CVE-2011-0152 Unspecified Memory Corruption Vulnerability
46719 WebKit CVE-2011-0151 Unspecified Memory Corruption Vulnerability
46720 WebKit CVE-2011-0153 Unspecified Memory Corruption Vulnerability
46721 WebKit CVE-2011-0155 Unspecified Memory Corruption Vulnerability
46722 WebKit CVE-2011-0168 Unspecified Memory Corruption Vulnerability
46723 WebKit CVE-2011-0122 Unspecified Memory Corruption Vulnerability
46724 WebKit CVE-2011-0156 Unspecified Memory Corruption Vulnerability
46725 WebKit CVE-2011-0124 Unspecified Memory Corruption Vulnerability
46726 WebKit CVE-2011-0112 Unspecified Memory Corruption Vulnerability
46727 WebKit CVE-2011-0126 Unspecified Memory Corruption Vulnerability
46728 WebKit CVE-2011-0113 Unspecified Memory Corruption Vulnerability
46744 WebKit CVE-2011-0149 'HTMLBRElement' Style Memory Corruption Vulnerability
46745 WebKit CVE-2011-0154 Javascript 'sort()' Method Memory Corruption Vulnerability
46746 WebKit Range Object Remote Code Execution Vulnerability
46747 WebKit CVE-2011-0116 'setOuterText()' Method Memory Corruption Remote Code Execution Vulnerability
46748 WebKit 'Runin' Box CVE-2011-0132 Use-After-Free Memory Corruption Vulnerability
46749 WebKit CVE-2011-0133 Glyph Data Memory Corruption Vulnerability.
NOTE: This issue was previously discussed in BID 46654 (WebKit Multiple Memory Corruption Vulnerabilities) but has been given its own record to better document it. WebKit is a set of open source web browser engines jointly developed by companies such as KDE, Apple (Apple), and Google (Google), and is currently used by browsers such as Apple Safari and Google Chrome.
-- Vendor Response:
Apple has issued an update to correct this vulnerability. More
details can be found at:
http://support.apple.com/kb/HT4554
-- Disclosure Timeline:
2010-12-21 - Vulnerability reported to vendor
2011-03-02 - Coordinated public release of advisory
-- Credit:
This vulnerability was discovered by:
* Anonymous
-- About the Zero Day Initiative (ZDI):
Established by TippingPoint, The Zero Day Initiative (ZDI) represents
a best-of-breed model for rewarding security researchers for responsibly
disclosing discovered vulnerabilities.
Researchers interested in getting paid for their security research
through the ZDI can find more information and sign-up at:
http://www.zerodayinitiative.com
The ZDI is unique in how the acquired vulnerability information is
used. TippingPoint does not re-sell the vulnerability details or any
exploit code. Instead, upon notifying the affected product vendor,
TippingPoint provides its customers with zero day protection through
its intrusion prevention technology. Explicit details regarding the
specifics of the vulnerability are not exposed to any parties until
an official vendor patch is publicly available. Furthermore, with the
altruistic aim of helping to secure a broader user base, TippingPoint
provides this vulnerability information confidentially to security
vendors (including competitors) who have a vulnerability protection or
mitigation product.
Our vulnerability disclosure policy is available online at:
http://www.zerodayinitiative.com/advisories/disclosure_policy/
Follow the ZDI on Twitter:
http://twitter.com/thezdi
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
. ----------------------------------------------------------------------
Get a tax break on purchases of Secunia Solutions!
If you are a U.S. company, you may be qualified for a tax break for your software purchases. Learn more at:
http://secunia.com/products/corporate/vim/section_179/
----------------------------------------------------------------------
TITLE:
Apple iTunes Multiple Vulnerabilities
SECUNIA ADVISORY ID:
SA43582
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/43582/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=43582
RELEASE DATE:
2011-03-03
DISCUSS ADVISORY:
http://secunia.com/advisories/43582/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/43582/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=43582
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
Multiple vulnerabilities have been reported in Apple iTunes, which
can be exploited by malicious people to compromise a user's system.
1) Some errors exists due to the use of a vulnerable libpng library.
For more information:
SA40302
2) An array indexing error in the CoreGraphics library (ImageIO) when
processing the International Color Consortium (ICC) profile within a
JPEG image can be exploited to corrupt heap-based memory.
3) An error in the libTIFF library when handling JPEG encoded TIFF
images can be exploited to cause a buffer overflow.
4) A boundary error in the libTIFF library when handling CCITT Group
4 encoded TIFF images.
For more information:
SA43593
5) A double free error in the libxml library when handling XPath
expressions.
For more information:
SA42721
6) An error exists in the libxml library when traversing the XPath.
8) An error in the WebKit component when elements are being appended
to the DOM tree during the display of an error message can be
exploited to access a freed element via a specially crafted
document.
9) An error in the WebKit component when handling a DOM level 2 range
object can be exploited to corrupt memory by manipulating the DOM via
an event listener.
10) A use-after-free error in the "setOuterText()" method in the
htmlelement library (WebKit) when tracking DOM manipulations can be
exploited to dereference freed memory.
11) A use-after-free error in the WebKit component when promoting a
run-in element can be exploited to dereference freed memory.
12) An error in the WebKit component when performing layout
operations for a floating block of a pseudo-element can be exploited
to dereference uninitialised glyph data.
13) An error in the WebKit component when parsing a Root
HTMLBRElement element can be exploited to call an unmapped dangling
pointer.
14) An error in the Javascript array "sort()" method (WebKit) can be
exploited to manipulate elements outside of the array's boundary.
SOLUTION:
Update to version 10.2.
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
PROVIDED AND/OR DISCOVERED BY:
2) Andrzej Dyjak via iDefense VCP
3, 4) Reported by the vendor
8, 11 - 13) wushi of team509 via ZDI
9) J23 via ZDI
10, 14) An anonymous person via ZDI
11) Jose A. Vazquez via ZDI
The vendor also credits:
5) Yang Dingning of NCNIPC, Graduate University of Chinese Academy of
Sciences
6) Bui Quang Minh, Bkis
8) kuzcc
9) Emil A Eklund, Google Inc
13) SkyLined, Google Chrome Security Team
The vendor provides a bundled list of credits for vulnerabilities in
#7:
Sergey Glazunov
Andreas Kling, Nokia
Yuzo Fujishima, Google Inc.
Abhishek Arya (Inferno), Google, Inc.
Mihai Parparita, Google, Inc.
Emil A Eklund, Google, Inc.
Michal Zalewski, Google, Inc.
Chris Evans, Google Chrome Security Team
SkyLined, Google Chrome Security Team
Chris Rohlf, Matasano Security
Aki Helin, OUSPG
Dirk Schulze
Slawomir Blazek
David Bloom
Famlam
Jan Tosovsky
Michael Gundlach
ORIGINAL ADVISORY:
Apple:
http://support.apple.com/kb/HT4554
iDefense VCP:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=897
ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-11-095/
http://www.zerodayinitiative.com/advisories/ZDI-11-096/
http://www.zerodayinitiative.com/advisories/ZDI-11-097/
http://www.zerodayinitiative.com/advisories/ZDI-11-098/
http://www.zerodayinitiative.com/advisories/ZDI-11-099/
http://www.zerodayinitiative.com/advisories/ZDI-11-100/
http://www.zerodayinitiative.com/advisories/ZDI-11-101/
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201103-0265 | CVE-2011-0164 | Windows Run on Apple iTunes of WebKit Vulnerable to arbitrary code execution |
CVSS V2: 7.6 CVSS V3: - Severity: HIGH |
WebKit, as used in Apple iTunes before 10.2 on Windows, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other CVEs listed in APPLE-SA-2011-03-02-1. WebKit is prone to an unspecified memory-corruption vulnerability.
An attacker can exploit this issue by enticing an unsuspecting user into visiting a malicious webpage with a vulnerable application.
Very few technical details are currently available. We will update this BID when more information emerges.
Successful exploits will allow attackers to execute arbitrary code in the context of the affected browser or cause denial-of-service conditions; other attacks may also be possible.
NOTE: This issue was previously discussed in BID 46654 (WebKit Multiple Memory Corruption Vulnerabilities) but has been given its own record to better document it. WebKit is a set of open source web browser engines jointly developed by companies such as KDE, Apple (Apple), and Google (Google), and is currently used by browsers such as Apple Safari and Google Chrome. A vulnerability exists in WebKit used in versions prior to 10.2 of Apple iTunes on Windows-based platforms. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
APPLE-SA-2011-07-20-1 Safari 5.1 and Safari 5.0.6
Safari 5.1 and Safari 5.0.6 are now available and address the
following:
CFNetwork
Available for: Windows 7, Vista, XP SP2 or later
Impact: Visiting a maliciously crafted website may lead to a cross-
site scripting attack
Description: In certain situations, Safari may treat a file as HTML,
even if it is served with the 'text/plain' content type. This may
lead to a cross-site scripting attack on sites that allow untrusted
users to post text files. This issue is addressed through improved
handling of 'text/plain' content.
CVE-ID
CVE-2010-1420 : Hidetake Jo working with Microsoft Vulnerability
Research (MSVR), Neal Poole of Matasano Security
CFNetwork
Available for: Windows 7, Vista, XP SP2 or later
Impact: Authenticating to a maliciously crafted website may lead to
arbitrary code execution
Description: The NTLM authentication protocol is susceptible to a
replay attack referred to as credential reflection. Authenticating to
a maliciously crafted website may lead to arbitrary code execution.
To mitigate this issue, Safari has been updated to utilize protection
mechanisms recently added to Windows. This issue does not affect Mac
OS X systems.
CVE-ID
CVE-2010-1383 : Takehiro Takahashi of IBM X-Force Research
CFNetwork
Available for: Windows 7, Vista, XP SP2 or later
Impact: A root certificate that is disabled may still be trusted
Description: CFNetwork did not properly validate that a certificate
was trusted for use by a SSL server. As a result, if the user had
marked a system root certificate as not trusted, Safari would still
accept certificates signed by that root. This issue is addressed
through improved certificate validation. This issue does not affect
Mac OS X systems.
CVE-ID
CVE-2011-0214 : An anonymous reporter
ColorSync
Available for: Windows 7, Vista, XP SP2 or later
Impact: Viewing a maliciously crafted image with an embedded
ColorSync profile may lead to an unexpected application termination
or arbitrary code execution
Description: An integer overflow existed in the handling of images
with an embedded ColorSync profile, which may lead to a heap buffer
overflow. Opening a maliciously crafted image with an embedded
ColorSync profile may lead to an unexpected application termination
or arbitrary code execution. For Mac OS X v10.5 systems, this issue
is addressed in Security Update 2011-004.
CVE-ID
CVE-2011-0200 : binaryproof working with TippingPoint's Zero Day
Initiative
CoreFoundation
Available for: Windows 7, Vista, XP SP2 or later
Impact: Applications that use the CoreFoundation framework may be
vulnerable to an unexpected application termination or arbitrary code
execution
Description: An off-by-one buffer overflow issue existed in the
handling of CFStrings. Applications that use the CoreFoundation
framework may be vulnerable to an unexpected application termination
or arbitrary code execution. For Mac OS X v10.6 systems, this issue
is addressed in Mac OS X v10.6.8.
CVE-ID
CVE-2011-0201 : Harry Sintonen
CoreGraphics
Available for: Windows 7, Vista, XP SP2 or later
Impact: Opening a maliciously crafted PDF file may lead to an
unexpected application termination or arbitrary code execution
Description: An integer overflow issue existed in the handling of
Type 1 fonts. Viewing or downloading a document containing a
maliciously crafted embedded font may lead to arbitrary code
execution. For Mac OS X v10.6 systems, this issue is addressed in Mac
OS X v10.6.8. For Mac OS X v10.5 systems, this issue is addressed in
Security Update 2011-004.
CVE-ID
CVE-2011-0202 : Cristian Draghici of Modulo Consulting, Felix Grobert
of the Google Security Team
International Components for Unicode
Available for: Windows 7, Vista, XP SP2 or later
Impact: Applications that use ICU may be vulnerable to an unexpected
application termination or arbitrary code execution
Description: A buffer overflow issue existed in ICU's handling of
uppercase strings. Applications that use ICU may be vulnerable to an
unexpected application termination or arbitrary code execution. For
Mac OS X v10.6 systems, this issue is addressed in Mac OS X v10.6.8.
CVE-ID
CVE-2011-0206 : David Bienvenu of Mozilla
ImageIO
Available for: Windows 7, Vista, XP SP2 or later
Impact: Viewing a maliciously crafted TIFF image may lead to an
unexpected application termination or arbitrary code execution
Description: A heap buffer overflow existed in ImageIO's handling of
TIFF images. Viewing a maliciously crafted TIFF image may lead to an
unexpected application termination or arbitrary code execution. For
Mac OS X v10.6 systems, this issue is addressed in Mac OS X v10.6.8.
For Mac OS X v10.5 systems, this issue is addressed in Security
Update 2011-004.
CVE-ID
CVE-2011-0204 : Dominic Chell of NGS Secure
ImageIO
Available for: Windows 7, Vista, XP SP2 or later
Impact: Viewing a maliciously crafted TIFF image may lead to an
unexpected application termination or arbitrary code execution
Description: A heap buffer overflow existed in ImageIO's handling of
CCITT Group 4 encoded TIFF images. Viewing a maliciously crafted TIFF
image may lead to an unexpected application termination or arbitrary
code execution.
CVE-ID
CVE-2011-0241 : Cyril CATTIAUX of Tessi Technologies
ImageIO
Available for: Windows 7, Vista, XP SP2 or later
Impact: Viewing a maliciously crafted TIFF image may lead to an
unexpected application termination or arbitrary code execution
Description: A reentrancy issue existed in ImageIO's handling of
TIFF images. Viewing a maliciously crafted TIFF image may lead to an
unexpected application termination or arbitrary code execution. This
issue does not affect Mac OS X systems.
CVE-ID
CVE-2011-0215 : Juan Pablo Lopez Yacubian working with iDefense VCP
ImageIO
Available for: Windows 7, Vista, XP SP2 or later
Impact: Viewing a maliciously crafted TIFF image may lead to an
unexpected application termination or arbitrary code execution
Description: A heap buffer overflow existed in ImageIO's handling of
TIFF images. Viewing a maliciously crafted TIFF image may lead to an
unexpected application termination or arbitrary code execution. For
Mac OS X v10.6 systems, this issue is addressed in Mac OS X v10.6.8.
For Mac OS X v10.5 systems, this issue is addressed in Security
Update 2011-004.
CVE-ID
CVE-2011-0204 : Dominic Chell of NGS Secure
libxslt
Available for: Windows 7, Vista, XP SP2 or later
Impact: Visiting a maliciously crafted website may lead to the
disclosure of addresses on the heap
Description: libxslt's implementation of the generate-id() XPath
function disclosed the address of a heap buffer. Visiting a
maliciously crafted website may lead to the disclosure of addresses
on the heap. This issue is addressed by generating an ID based on the
difference between the addresses of two heap buffers. For Mac OS X
v10.6 systems, this issue is addressed in Mac OS X v10.6.8. For Mac
OS X v10.5 systems, this issue is addressed in Security Update
2011-004.
CVE-ID
CVE-2011-0195 : Chris Evans of the Google Chrome Security Team
libxml
Available for: Windows 7, Vista, XP SP2 or later
Impact: Visiting a maliciously crafted website may lead to an
unexpected application termination or arbitrary code execution
Description: A one-byte heap buffer overflow existed in libxml's
handling of XML data. Visiting a maliciously crafted website may lead
to an unexpected application termination or arbitrary code execution.
CVE-ID
CVE-2011-0216 : Billy Rios of the Google Security Team
Safari
Available for: Mac OS X v10.6.8 or later,
Mac OS X Server v10.6.8 or later, Windows 7, Vista, XP SP2 or later
Impact: If the "AutoFill web forms" feature is enabled, visiting a
maliciously crafted website and typing may lead to the disclosure of
information from the user's Address Book
Description: Safari's "AutoFill web forms" feature filled in non-
visible form fields, and the information was accessible by scripts on
the site before the user submitted the form. This issue is addressed
by displaying all fields that will be filled, and requiring the
user's consent before AutoFill information is available to the form.
CVE-ID
CVE-2011-0217 : Florian Rienhardt of BSI, Alex Lambert, [Jeremiah
Grossman]
Safari
Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8,
Mac OS X v10.6.8 or later, Mac OS X Server v10.6.8 or later,
Windows 7, Vista, XP SP2 or later
Impact: With a certain Java configuration, visiting a malicious
website may lead to unexpected text being displayed on other sites
Description: A cross origin issue existed in the handling of Java
Applets. This applies when Java is enabled in Safari, and Java is
configured to run within the browser process. Fonts loaded by a Java
applet could affect the display of text content from other sites.
This issue is addressed by running Java applets in a separate
process.
CVE-ID
CVE-2011-0219 : Joshua Smith of Kaon Interactive
WebKit
Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8,
Mac OS X v10.6.8 or later, Mac OS X Server v10.6.8 or later,
Windows 7, Vista, XP SP2 or later
Impact: Visiting a maliciously crafted website may lead to an
unexpected application termination or arbitrary code execution
Description: Multiple memory corruption issues existed in WebKit.
Visiting a maliciously crafted website may lead to an unexpected
application termination or arbitrary code execution.
CVE-ID
CVE-2010-1823 : David Weston of Microsoft and Microsoft Vulnerability
Research (MSVR), wushi of team509, and Yong Li of Research In Motion
Ltd
CVE-2011-0164 : Apple
CVE-2011-0218 : SkyLined of Google Chrome Security Team
CVE-2011-0221 : Abhishek Arya (Inferno) of Google Chrome Security
Team
CVE-2011-0222 : Nikita Tarakanov and Alex Bazhanyuk of the CISS
Research Team, and Abhishek Arya (Inferno) of Google Chrome Security
Team
CVE-2011-0223 : Jose A. Vazquez of spa-s3c.blogspot.com working with
iDefense VCP
CVE-2011-0225 : Abhishek Arya (Inferno) of Google Chrome Security
Team
CVE-2011-0232 : J23 working with TippingPoint's Zero Day Initiative
CVE-2011-0233 : wushi of team509 working with TippingPoint's Zero Day
Initiative
CVE-2011-0234 : Rob King working with TippingPoint's Zero Day
Initiative, wushi of team509 working with TippingPoint's Zero Day
Initiative, wushi of team509 working with iDefense VCP
CVE-2011-0235 : Abhishek Arya (Inferno) of Google Chrome Security
Team
CVE-2011-0237 : wushi of team509 working with iDefense VCP
CVE-2011-0238 : Adam Barth of Google Chrome Security Team
CVE-2011-0240 : wushi of team509 working with iDefense VCP
CVE-2011-0253 : Richard Keen
CVE-2011-0254 : An anonymous researcher working with TippingPoint's
Zero Day Initiative
CVE-2011-0255 : An anonymous researcher working with TippingPoint's
Zero Day Initiative
CVE-2011-0981 : Rik Cabanier of Adobe Systems, Inc
CVE-2011-0983 : Martin Barbella
CVE-2011-1109 : Sergey Glazunov
CVE-2011-1114 : Martin Barbella
CVE-2011-1115 : Martin Barbella
CVE-2011-1117 : wushi of team509
CVE-2011-1121 : miaubiz
CVE-2011-1188 : Martin Barbella
CVE-2011-1203 : Sergey Glazunov
CVE-2011-1204 : Sergey Glazunov
CVE-2011-1288 : Andreas Kling of Nokia
CVE-2011-1293 : Sergey Glazunov
CVE-2011-1296 : Sergey Glazunov
CVE-2011-1449 : Marek Majkowski, wushi of team 509 working with
iDefense VCP
CVE-2011-1451 : Sergey Glazunov
CVE-2011-1453 : wushi of team509 working with TippingPoint's Zero Day
Initiative
CVE-2011-1457 : John Knottenbelt of Google
CVE-2011-1462 : wushi of team509
CVE-2011-1797 : wushi of team509
WebKit
Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8,
Mac OS X v10.6.8 or later, Mac OS X Server v10.6.8 or later,
Windows 7, Vista, XP SP2 or later
Impact: Visiting a maliciously crafted website may lead to arbitrary
code execution
Description: A configuration issue existed in WebKit's use of
libxslt. Visiting a maliciously crafted website may lead to arbitrary
files being created with the privileges of the user, which may lead
to arbitrary code execution. This issue is addressed through improved
libxslt security settings.
CVE-ID
CVE-2011-1774 : Nicolas Gregoire of Agarri
WebKit
Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8,
Mac OS X v10.6.8 or later, Mac OS X Server v10.6.8 or later,
Windows 7, Vista, XP SP2 or later
Impact: Visiting a maliciously crafted website may lead to an
information disclosure
Description: A cross-origin issue existed in the handling of Web
Workers. Visiting a maliciously crafted website may lead to an
information disclosure.
CVE-ID
CVE-2011-1190 : Daniel Divricean of divricean.ro
WebKit
Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8,
Mac OS X v10.6.8 or later, Mac OS X Server v10.6.8 or later,
Windows 7, Vista, XP SP2 or later
Impact: Visiting a maliciously crafted website may lead to a cross-
site scripting attack
Description: A cross-origin issue existed in the handling of URLs
with an embedded username. Visiting a maliciously crafted website may
lead to a cross-site scripting attack. This issue is addressed
through improved handling of URLs with an embedded username.
CVE-ID
CVE-2011-0242 : Jobert Abma of Online24
WebKit
Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8,
Mac OS X v10.6.8 or later, Mac OS X Server v10.6.8 or later,
Windows 7, Vista, XP SP2 or later
Impact: Visiting a maliciously crafted website may lead to a cross-
site scripting attack
Description: A cross-origin issue existed in the handling of DOM
nodes. Visiting a maliciously crafted website may lead to a cross-
site scripting attack.
CVE-ID
CVE-2011-1295 : Sergey Glazunov
WebKit
Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8,
Mac OS X v10.6.8 or later, Mac OS X Server v10.6.8 or later,
Windows 7, Vista, XP SP2 or later
Impact: A maliciously crafted website may be able to cause a
different URL to be shown in the address bar
Description: A URL spoofing issue existed in the handling of the DOM
history object. A maliciously crafted website may have been able to
cause a different URL to be shown in the address bar.
CVE-ID
CVE-2011-1107 : Jordi Chancel
WebKit
Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8,
Mac OS X v10.6.8 or later, Mac OS X Server v10.6.8 or later,
Windows 7, Vista, XP SP2 or later
Impact: Subscribing to a maliciously crafted RSS feed and clicking
on a link within it may lead to an information disclosure
Description: A canonicalization issue existed in the handling of
URLs. Subscribing to a maliciously crafted RSS feed and clicking on a
link within it may lead to arbitrary files being sent from the user's
system to a remote server. This update addresses the issue through
improved handling of URLs.
CVE-ID
CVE-2011-0244 : Jason Hullinger
WebKit
Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8,
Mac OS X v10.6.8 or later, Mac OS X Server v10.6.8 or later,
Windows 7, Vista, XP SP2 or later
Impact: Applications that use WebKit, such as mail clients, may
connect to an arbitrary DNS server upon processing HTML content
Description: DNS prefetching was enabled by default in WebKit.
Applications that use WebKit, such a s mail clients, may connect to
an arbitrary DNS server upon processing HTML content. This update
addresses the issue by requiring applications to opt in to DNS
prefetching.
CVE-ID
CVE-2010-3829 : Mike Cardwell of Cardwell IT Ltd.
Note: Safari 5.1 is included with OS X Lion.
Safari 5.1 and Safari 5.0.6 address the same set of security
issues. Safari 5.1 is provided for Mac OS X v10.6,
and Windows systems. Safari 5.0.6 is provided for
Mac OS X v10.5 systems.
Safari 5.1 is available via the Apple Software Update
application, or Apple's Safari download site at:
http://www.apple.com/safari/download/
Safari 5.0.6 is available via the Apple Software Update
application, or Apple's Software Downloads web site:
http://www.apple.com/support/downloads/
Safari for Mac OS X v10.6.8 and later
The download file is named: Safari5.1SnowLeopard.dmg
Its SHA-1 digest is: 2c3cef8e06c5aa586379b1a5fd5cf7b54e8acc24
Safari for Mac OS X v10.5.8
The download file is named: Safari5.0.6Leopard.dmg
Its SHA-1 digest is: ea970375d2116a7b74094a2a7669bebc306b6e6f
Safari for Windows 7, Vista or XP
The download file is named: SafariSetup.exe
Its SHA-1 digest is: d00b791c694b1ecfc22d6a1ec9aa21cc14fd8e36
Safari for Windows 7, Vista or XP from the Microsoft Choice Screen
The download file is named: Safari_Setup.exe
Its SHA-1 digest is: ccb3bb6b06468a430171d9f62708a1a6d917f45b
Safari+QuickTime for Windows 7, Vista or XP
The file is named: SafariQuickTimeSetup.exe
Its SHA-1 digest is: 1273e0ee742a294d65e4f25a9b3e36f79fb517c9
Information will also be posted to the Apple Security Updates
web site: http://support.apple.com/kb/HT1222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.9 (Darwin)
iQEcBAEBAgAGBQJOJI45AAoJEGnF2JsdZQeezHQIALKZms5tzYgYxUSdxmo+DmYw
up9gAmEVcltZvCeVS1lUxfjqnRiGRSWyuou8Ynt9PfGQCz9GfLvzlrCHc5rsnKaD
MeYY1IH7lQc6aqmV0hwb4nUL5qJntP6G5Ai0E/0UiRQNC/ummS+qnmdsiFo78ODY
nKaB5cAWhqGHgOAPnUG0JwmxpYgR2HEtGYJSqlYykMwt1vnlAr5hHVNaUJcJ3Hlb
vesN6fB7zQMiJVo8+iJBixCvIYlbII5HnVAmD1ToyKgENg4Iguo46YBMVr8DPgF/
KD2s0+VF/O4utYVX0GiRGReVyq1PMvz/HI23ym8U3LjbezXD/AALQET0Q2hUEYQ=
=fOfF
-----END PGP SIGNATURE-----
| VAR-201103-0216 | CVE-2011-0115 | plural Apple Product WebKit Vulnerable to arbitrary code execution |
CVSS V2: 7.6 CVSS V3: - Severity: HIGH |
The DOM level 2 implementation in WebKit, as used in Apple iTunes before 10.2 on Windows and Apple Safari, does not properly handle DOM manipulations associated with event listeners during processing of range objects, which allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other CVEs listed in APPLE-SA-2011-03-02-1. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple Safari's WebKit. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within how WebKit processes a range object as defined with the DOM level 2 specification. When processing the contents of a range, WebKit will fail to accommodate for manipulation of the DOM due to an event listener. This can lead to code execution under the context of the application. WebKit is prone to multiple memory-corruption vulnerabilities.
An attacker may exploit these issues by enticing victims into viewing a malicious webpage.
This BID is being retired. The following individual records exists to better document the issues:
46684 WebKit CVE-2011-0111 Unspecified Memory Corruption Vulnerability
46686 WebKit CVE-2011-0117 Unspecified Memory Corruption Vulnerability
46687 WebKit CVE-2011-0118 Unspecified Memory Corruption Vulnerability
46688 WebKit CVE-2011-0119 Unspecified Memory Corruption Vulnerability
46689 WebKit CVE-2011-0141 Unspecified Memory Corruption Vulnerability
46690 WebKit CVE-2011-0136 Unspecified Memory Corruption Vulnerability
46691 WebKit CVE-2011-0114 Unspecified Memory Corruption Vulnerability
46692 WebKit CVE-2011-0128 Unspecified Memory Corruption Vulnerability
46693 WebKit CVE-2011-0129 Unspecified Memory Corruption Vulnerability
46694 WebKit CVE-2011-0120 Unspecified Memory Corruption Vulnerability
46695 WebKit CVE-2011-0143 Unspecified Memory Corruption Vulnerability
46696 WebKit CVE-2011-0121 Unspecified Memory Corruption Vulnerability
46698 WebKit CVE-2011-0123 Unspecified Memory Corruption Vulnerability
46699 WebKit CVE-2011-0144 Unspecified Memory Corruption Vulnerability
46700 WebKit CVE-2011-0130 Unspecified Memory Corruption Vulnerability
46701 WebKit CVE-2011-0125 Unspecified Memory Corruption Vulnerability
46702 WebKit CVE-2011-0147 Unspecified Memory Corruption Vulnerability
46703 WebKit CVE-2011-0164 Unspecified Memory Corruption Vulnerability
46704 WebKit CVE-2011-0131 Unspecified Memory Corruption Vulnerability
46705 WebKit CVE-2011-0127 Unspecified Memory Corruption Vulnerability
46706 WebKit CVE-2011-0142 Unspecified Memory Corruption Vulnerability
46707 WebKit CVE-2011-0137 Unspecified Memory Corruption Vulnerability
46708 WebKit CVE-2011-0148 Unspecified Memory Corruption Vulnerability
46709 WebKit CVE-2011-0135 Unspecified Memory Corruption Vulnerability
46710 WebKit CVE-2011-0145 Unspecified Memory Corruption Vulnerability
46711 WebKit CVE-2011-0134 Unspecified Memory Corruption Vulnerability
46712 WebKit CVE-2011-0139 Unspecified Memory Corruption Vulnerability
46713 WebKit CVE-2011-0138 Unspecified Memory Corruption Vulnerability
46714 WebKit CVE-2011-0140 Unspecified Memory Corruption Vulnerability
46715 WebKit CVE-2011-0146 Unspecified Memory Corruption Vulnerability
46716 WebKit CVE-2011-0165 Unspecified Memory Corruption Vulnerability
46717 WebKit CVE-2011-0150 Unspecified Memory Corruption Vulnerability
46718 WebKit CVE-2011-0152 Unspecified Memory Corruption Vulnerability
46719 WebKit CVE-2011-0151 Unspecified Memory Corruption Vulnerability
46720 WebKit CVE-2011-0153 Unspecified Memory Corruption Vulnerability
46721 WebKit CVE-2011-0155 Unspecified Memory Corruption Vulnerability
46722 WebKit CVE-2011-0168 Unspecified Memory Corruption Vulnerability
46723 WebKit CVE-2011-0122 Unspecified Memory Corruption Vulnerability
46724 WebKit CVE-2011-0156 Unspecified Memory Corruption Vulnerability
46725 WebKit CVE-2011-0124 Unspecified Memory Corruption Vulnerability
46726 WebKit CVE-2011-0112 Unspecified Memory Corruption Vulnerability
46727 WebKit CVE-2011-0126 Unspecified Memory Corruption Vulnerability
46728 WebKit CVE-2011-0113 Unspecified Memory Corruption Vulnerability
46744 WebKit CVE-2011-0149 'HTMLBRElement' Style Memory Corruption Vulnerability
46745 WebKit CVE-2011-0154 Javascript 'sort()' Method Memory Corruption Vulnerability
46746 WebKit Range Object Remote Code Execution Vulnerability
46747 WebKit CVE-2011-0116 'setOuterText()' Method Memory Corruption Remote Code Execution Vulnerability
46748 WebKit 'Runin' Box CVE-2011-0132 Use-After-Free Memory Corruption Vulnerability
46749 WebKit CVE-2011-0133 Glyph Data Memory Corruption Vulnerability.
NOTE: This issue was previously discussed in BID 46654 (WebKit Multiple Memory Corruption Vulnerabilities) but has been given its own record to better document it. WebKit is a set of open source web browser engines jointly developed by companies such as KDE, Apple (Apple), and Google (Google), and is currently used by browsers such as Apple Safari and Google Chrome. ----------------------------------------------------------------------
Get a tax break on purchases of Secunia Solutions!
If you are a U.S. company, you may be qualified for a tax break for your software purchases. Learn more at:
http://secunia.com/products/corporate/vim/section_179/
----------------------------------------------------------------------
TITLE:
Apple iTunes Multiple Vulnerabilities
SECUNIA ADVISORY ID:
SA43582
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/43582/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=43582
RELEASE DATE:
2011-03-03
DISCUSS ADVISORY:
http://secunia.com/advisories/43582/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/43582/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=43582
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
Multiple vulnerabilities have been reported in Apple iTunes, which
can be exploited by malicious people to compromise a user's system.
1) Some errors exists due to the use of a vulnerable libpng library.
For more information:
SA40302
2) An array indexing error in the CoreGraphics library (ImageIO) when
processing the International Color Consortium (ICC) profile within a
JPEG image can be exploited to corrupt heap-based memory.
3) An error in the libTIFF library when handling JPEG encoded TIFF
images can be exploited to cause a buffer overflow.
4) A boundary error in the libTIFF library when handling CCITT Group
4 encoded TIFF images.
For more information:
SA43593
5) A double free error in the libxml library when handling XPath
expressions.
For more information:
SA42721
6) An error exists in the libxml library when traversing the XPath.
8) An error in the WebKit component when elements are being appended
to the DOM tree during the display of an error message can be
exploited to access a freed element via a specially crafted
document.
10) A use-after-free error in the "setOuterText()" method in the
htmlelement library (WebKit) when tracking DOM manipulations can be
exploited to dereference freed memory.
11) A use-after-free error in the WebKit component when promoting a
run-in element can be exploited to dereference freed memory.
12) An error in the WebKit component when performing layout
operations for a floating block of a pseudo-element can be exploited
to dereference uninitialised glyph data.
13) An error in the WebKit component when parsing a Root
HTMLBRElement element can be exploited to call an unmapped dangling
pointer.
14) An error in the Javascript array "sort()" method (WebKit) can be
exploited to manipulate elements outside of the array's boundary.
SOLUTION:
Update to version 10.2.
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
PROVIDED AND/OR DISCOVERED BY:
2) Andrzej Dyjak via iDefense VCP
3, 4) Reported by the vendor
8, 11 - 13) wushi of team509 via ZDI
9) J23 via ZDI
10, 14) An anonymous person via ZDI
11) Jose A. Vazquez via ZDI
The vendor also credits:
5) Yang Dingning of NCNIPC, Graduate University of Chinese Academy of
Sciences
6) Bui Quang Minh, Bkis
8) kuzcc
9) Emil A Eklund, Google Inc
13) SkyLined, Google Chrome Security Team
The vendor provides a bundled list of credits for vulnerabilities in
#7:
Sergey Glazunov
Andreas Kling, Nokia
Yuzo Fujishima, Google Inc.
Abhishek Arya (Inferno), Google, Inc.
Mihai Parparita, Google, Inc.
Emil A Eklund, Google, Inc.
Michal Zalewski, Google, Inc.
Chris Evans, Google Chrome Security Team
SkyLined, Google Chrome Security Team
Chris Rohlf, Matasano Security
Aki Helin, OUSPG
Dirk Schulze
Slawomir Blazek
David Bloom
Famlam
Jan Tosovsky
Michael Gundlach
ORIGINAL ADVISORY:
Apple:
http://support.apple.com/kb/HT4554
iDefense VCP:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=897
ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-11-095/
http://www.zerodayinitiative.com/advisories/ZDI-11-096/
http://www.zerodayinitiative.com/advisories/ZDI-11-097/
http://www.zerodayinitiative.com/advisories/ZDI-11-098/
http://www.zerodayinitiative.com/advisories/ZDI-11-099/
http://www.zerodayinitiative.com/advisories/ZDI-11-100/
http://www.zerodayinitiative.com/advisories/ZDI-11-101/
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
.
-- Vendor Response:
Apple has issued an update to correct this vulnerability. More
details can be found at:
http://support.apple.com/kb/HT4554
-- Disclosure Timeline:
2010-11-05 - Vulnerability reported to vendor
2011-03-02 - Coordinated public release of advisory
-- Credit:
This vulnerability was discovered by:
* J23 -- http://twitter.com/HansJ23
-- About the Zero Day Initiative (ZDI):
Established by TippingPoint, The Zero Day Initiative (ZDI) represents
a best-of-breed model for rewarding security researchers for responsibly
disclosing discovered vulnerabilities.
Researchers interested in getting paid for their security research
through the ZDI can find more information and sign-up at:
http://www.zerodayinitiative.com
The ZDI is unique in how the acquired vulnerability information is
used. TippingPoint does not re-sell the vulnerability details or any
exploit code. Instead, upon notifying the affected product vendor,
TippingPoint provides its customers with zero day protection through
its intrusion prevention technology. Explicit details regarding the
specifics of the vulnerability are not exposed to any parties until
an official vendor patch is publicly available. Furthermore, with the
altruistic aim of helping to secure a broader user base, TippingPoint
provides this vulnerability information confidentially to security
vendors (including competitors) who have a vulnerability protection or
mitigation product.
Our vulnerability disclosure policy is available online at:
http://www.zerodayinitiative.com/advisories/disclosure_policy/
Follow the ZDI on Twitter:
http://twitter.com/thezdi
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
| VAR-201103-0141 | CVE-2010-4754 | FreeBSD Used in etc. libc of glob Service disruption in implementation (DoS) Vulnerabilities |
CVSS V2: 4.0 CVSS V3: - Severity: MEDIUM |
The glob implementation in libc in FreeBSD 7.3 and 8.1, NetBSD 5.0.2, and OpenBSD 4.7, and Libsystem in Apple Mac OS X before 10.6.8, allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632. FreeBSD , NetBSD , OpenBSD Used in etc. libc and Apple Mac OS X of Libsystem There is a service disruption (CPU And memory corruption ) There is a vulnerability that becomes a condition. This vulnerability CVE-2010-2632 Is a different vulnerability.Crafted by a remotely authenticated user that does not match any pathname glob Service disruption through format (CPU And memory corruption ) There is a possibility of being put into a state. OpenBSD, NetBSD, and FreeBSD are all popular BSD operating systems, which are derivative systems of Unix. Vulnerabilities exist in the glob implementation in FreeBSD 7.3 and 8.1, NetBSD 5.0.2, and OpenBSD 4.7
| VAR-201106-0064 | CVE-2011-1924 | Tor of policy_summarize Buffer overflow vulnerability in functions |
CVSS V2: 5.0 CVSS V3: - Severity: MEDIUM |
Buffer overflow in the policy_summarize function in or/policies.c in Tor before 0.2.1.30 allows remote attackers to cause a denial of service (directory authority crash) via a crafted policy that triggers creation of a long port list. Tor is a second generation onion routing implementation. Tor is prone to a denial-of-service vulnerability that affects directory authority.
Versions prior to Tor 0.2.1.30 are vulnerable. ----------------------------------------------------------------------
Join Secunia @ FIRST Conference, 12-17 June, Hilton Vienna, Austria
See to the presentation "The Dynamics and Threats of End-Point Software Portfolios" by Secunia's Research Analyst Director, Stefan Frei.
For more information:
SA43548
SOLUTION:
Apply updated packages via the yum utility ("yum update tor"). ----------------------------------------------------------------------
Meet Secunia @ Microsoft Management Summit (MMS) in Las Vegas, USA (21-25 March).
http://secunia.com/company/events/mms_2011/
----------------------------------------------------------------------
TITLE:
Tor "policy_summarize()" Directory Authority Denial of Service
Vulnerability
SECUNIA ADVISORY ID:
SA43548
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/43548/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=43548
RELEASE DATE:
2011-03-20
DISCUSS ADVISORY:
http://secunia.com/advisories/43548/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/43548/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=43548
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
A vulnerability has been reported in Tor, which can be exploited by
malicious people to cause a DoS (Denial of Service).
SOLUTION:
Update to version 0.2.1.30.
PROVIDED AND/OR DISCOVERED BY:
The vendor credits piebeer.
ORIGINAL ADVISORY:
https://lists.torproject.org/pipermail/tor-announce/2011-February/000000.html
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201110-13
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: High
Title: Tor: Multiple vulnerabilities
Date: October 18, 2011
Bugs: #351920, #359789
ID: 201110-13
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities were found in Tor, the most severe of which
may allow a remote attacker to execute arbitrary code.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-misc/tor < 0.2.1.30 >= 0.2.1.30
Description
===========
Multiple vulnerabilities have been discovered in Tor. Please review the
CVE identifiers referenced below for details.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All Tor users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-misc/tor-0.2.1.30"
NOTE: This is a legacy GLSA. Updates for all affected architectures are
available since April 2, 2011. It is likely that your system is already
no longer affected by this issue.
References
==========
[ 1 ] CVE-2011-0015
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0015
[ 2 ] CVE-2011-0016
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0016
[ 3 ] CVE-2011-0427
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0427
[ 4 ] CVE-2011-0490
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0490
[ 5 ] CVE-2011-0491
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0491
[ 6 ] CVE-2011-0492
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0492
[ 7 ] CVE-2011-0493
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0493
[ 8 ] CVE-2011-1924
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1924
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201110-13.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2011 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
| VAR-201103-0292 | CVE-2011-0193 | Apple Mac OS X Image RAW Multiple Buffer Overflow Vulnerabilities |
CVSS V2: 6.8 CVSS V3: - Severity: MEDIUM |
Multiple buffer overflows in Image RAW in Apple Mac OS X before 10.6.7 allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted Canon RAW image. Apple Mac OS X is prone to multiple buffer-overflow vulnerabilities because it fails to properly bounds check user-supplied input.
Successful exploits may allow an attacker to execute arbitrary code in the context of the application. Failed exploit attempts will result in a denial-of-service condition.
Versions prior to OS X 10.6.7 are vulnerable.
NOTE: This issue was previously discussed in BID 46950 (Apple Mac OS X Prior to 10.6.7 Multiple Security Vulnerabilities) but has been given its own record to better document it. Apple Mac OS X is a dedicated operating system developed by Apple for Mac computers. ----------------------------------------------------------------------
Meet Secunia @ Microsoft Management Summit (MMS) in Las Vegas, USA (21-25 March).
http://secunia.com/company/events/mms_2011/
----------------------------------------------------------------------
TITLE:
Apple Mac OS X Multiple Vulnerabilities
SECUNIA ADVISORY ID:
SA43814
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/43814/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=43814
RELEASE DATE:
2011-03-22
DISCUSS ADVISORY:
http://secunia.com/advisories/43814/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/43814/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=43814
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
Apple has issued a security update for Mac OS X, which fixes multiple
vulnerabilities.
1) A divide-by-zero error in AirPort when handling Wi-Fi frames can
be exploited to cause a system reset.
2) Multiple vulnerabilities in Apache can be exploited by malicious
people to disclose potentially sensitive information and by malicious
users and malicious people to cause a DoS (Denial of Service).
For more information:
SA40206
3) A format string error within AppleScript Studio when handling
certain commands via dialogs can be exploited to potentially execute
arbitrary code.
4) An unspecified error in the handling of embedded OpenType fonts in
Apple Type Services (ATS) can be exploited to cause a heap-based
buffer overflow when a specially crafted document is viewed or
downloaded.
5) Multiple unspecified errors in the handling of embedded TrueType
fonts in Apple Type Services (ATS) can be exploited to cause a buffer
overflow when a specially crafted document is viewed or downloaded.
6) Multiple unspecified errors in the handling of embedded Type 1
fonts in Apple Type Services (ATS) can be exploited to cause a buffer
overflow when a specially crafted document is viewed or downloaded.
7) Multiple unspecified errors in the handling of SFNT tables in
embedded fonts in Apple Type Services (ATS) can be exploited to cause
a buffer overflow when a specially crafted document is viewed or
downloaded.
8) An integer overflow error in bzip2 can be exploited to terminate
an application using the library or execute arbitrary code via a
specially crafted archive.
For more information:
SA41452
9) An error within the "FSFindFolder()" API in CarbonCore when used
with the "kTemporaryFolderType" flag can be exploited to disclose the
contents of arbitrary directories.
10) Multiple errors in ClamAV can be exploited by malicious people to
cause a DoS (Denial of Service) and potentially compromise a
vulnerable system.
For more information:
SA41503
SA42426
11) An unspecified error in the handling of embedded fonts in
CoreText can be exploited to corrupt memory when a specially crafted
document is viewed or downloaded.
12) An integer overflow error within the handling of the
F_READBOOTSTRAP ioctl in HFS, HFS+, and HFS+J filesystems can be
exploited to read arbitrary files.
13) An error in ImageIO within the handling of JPEG files can be
exploited to cause a heap-based buffer overflow.
15) An error in libTIFF within the handling of JPEG encoded TIFF
files can be exploited to cause a buffer overflow.
16) An error in libTIFF within the handling of CCITT Group 4 encoded
TIFF files can be exploited to cause a buffer overflow.
17) An integer overflow error in ImageIO within the handling of JPEG
encoded TIFF files can be exploited to potentially execute arbitrary
code.
19) An error in the Install Helper when handling URLs can be
exploited to install an arbitrary agent by tricking the user into
visiting a malicious website.
20) Multiple errors in Kerberos can be exploited by malicious users
and malicious people to conduct spoofing attacks and bypass certain
security features.
22) An integer truncation error within Libinfo when handling NFS RPC
packets can be exploited to cause NFS RPC services to become
unresponsive.
23) An error exists in the libxml library when traversing the XPath.
For more information:
SA42175
24) A double free error exists in the libxml library when handling
XPath expressions.
For more information:
SA42721
25) Two errors in Mailman can be exploited by malicious users to
conduct script insertion attacks.
For more information:
SA41265
26) Multiple errors in PHP can be exploited by malicious users and
malicious people to bypass certain security restrictions and by
malicious people to cause a DoS (Denial of Service) and potentially
compromise a vulnerable system.
For more information:
SA39573
SA41724
27) Multiple errors in PHP can be exploited by malicious users and
malicious people to bypass certain security restrictions.
For more information:
SA41724
28) An error in the OfficeImport framework when processing records
containing formulas shared between multiple cells can be exploited to
corrupt memory and potentially execute arbitrary code.
29) An error in QuickLook when handling certain Microsoft Office
files can be exploited to corrupt memory when a specially crafted
document is downloaded.
30) Multiple unspecified errors in QuickTime when handling JPEG2000,
FlashPix, and panorama atoms in QTVR (QuickTime Virtual Reality)
movie files can be exploited to corrupt memory via specially crafted
files.
31) An integer overflow error in QuickTime when handling certain
movie files can be exploited to potentially execute arbitrary code
when a specially crafted file is viewed.
32) An error within QuickTime plug-in when handling cross-site
redirects can be exploited to disclose video data.
33) An integer truncation error within the Ruby BigDecimal class can
be exploited to potentially execute arbitrary code.
This vulnerability only affects 64-bit Ruby processes.
34) A boundary error in Samba can be exploited by malicious people to
potentially compromise a vulnerable system.
For more information:
SA41354
35) A security issue in Subversion can be exploited by malicious
people to bypass certain security restrictions.
For more information:
SA41652
36) A weakness in Terminal uses SSH version 1 as the default protocol
version when using ssh via the "New Remote Connection" dialog.
37) Some vulnerabilities in FreeType can be exploited to cause a DoS
(Denial of Service) or potentially compromise an application using
the library.
For more information:
SA41738
SOLUTION:
Update to version 10.6.7 or apply Security Update 2011-001.
PROVIDED AND/OR DISCOVERED BY:
15, 16, 33) Reported by the vendor.
The vendor credits:
3) Alexander Strange.
5) Christoph Diehl of Mozilla, Felix Grobert of the Google Security
Team, Marc Schoenefeld of Red Hat Security Response Team, and Tavis
Ormandy and Will Drewry of Google Security Team.
6) Felix Grobert, Google Security Team and geekable via ZDI.
7) Marc Schoenefeld, Red Hat Security Response Team.
11) Christoph Diehl, Mozilla.
12) Dan Rosenberg, Virtual Security Research.
13) Andrzej Dyjak via iDefense.
14) Harry Sintonen.
17) Dominic Chell, NGS Secure.
18) Paul Harrington, NGS Secure.
19) Aaron Sigel, vtty.com.
21) Jeff Mears.
22) Peter Schwenk, University of Delaware.
28) Tobias Klein via iDefense.
29) Charlie Miller and Dion Blazakis via ZDI.
30) Will Dormann of CERT/CC, Damian Put and an anonymous researcher
via ZDI, and Rodrigo Rubira Branco of Check Point Vulnerability
Discovery Team.
31) Honggang Ren, Fortinet's FortiGuard Labs.
32) Nirankush Panchbhai and Microsoft Vulnerability Research (MSVR).
36) Matt Warren, HNW Inc.
ORIGINAL ADVISORY:
Apple:
http://support.apple.com/kb/HT4581
iDefense:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=898
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------