The khtml::RenderTableSection::ensureRows function in KHTMLParser in Apple Mac OS X 10.4.3 and earlier, as used by Safari and TextEdit, allows remote attackers to cause a denial of service (memory consumption and application crash) via HTML files with a large ROWSPAN attribute in a TD tag.

The remote host is running Apple Mac OS X, but lacks Security Update 2006-001.

This security update contains fixes for the following applications :

apache_mod_php automount Bom Directory Services iChat IPSec LaunchServices LibSystem loginwindow Mail rsync Safari Syndication

The remote host is running a version of Mac OS X 10.4 that is older than version 10.4.3.  Mac OS X 10.4.3 contains several security fixes for :

- Finder
- Software Update
- memberd
- KeyChain
- Kernel 

The remote host is running a version of PHP that is older than 5.0.6. This version has a flaw where remote attackers can reenable the 'register_globals' parameter.  In addition, a remote attacker may be able to overwrite the 'GLOBAL' variable.  This may lead to another more serious exploitation.

ID	Name	Product	Family	Severity
20990	Mac OS X Multiple Vulnerabilities (Security Update 2006-001)	Nessus	MacOS X Local Security Checks	high
3275	Mac OS X < 10.4.3 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	medium
801113	PHP < 5.0.6 GLOBAL Variable Overwrite	Log Correlation Engine	Web Servers	high

Detections

Analytics

CVE-2005-4504

high

Tenable Plugins

high

medium

high