Buffer overflow in WebKit, as used in Apple Safari before 3.1, allows remote attackers to execute arbitrary code via crafted regular expressions in JavaScript.

Updated WebKit packages are available which fix two security vulnerabilities: CVE-2008-1010 (Arbitrary code execution) and CVE-2008-1011 (Cross-Site Scripting).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Mac OS X host is running a version of Safari that is older than version 3.1. The remote version of this software contains several security vulnerabilities that may allow an attacker to execute arbitrary code or a cross-site scripting attack on the remote host.  To exploit these flaws, an attacker would need to convince a victim to visit a rogue web site or open a malicious HTML file.

The version of Apple Safari installed on the remote host is older than version 3.1.

The remote version of this software contains several security vulnerabilities that may allow an attacker to execute arbitrary code or launch a cross-site scripting attack on the remote host.

To exploit these flaws, an attacker would need to lure a victim into visiting a rogue website or opening a malicious HTML file.

ID	Name	Product	Family	Severity
32107	Fedora 7 : WebKit-1.0.0-0.8.svn31787.fc7 / midori-0.0.17-3.fc7 (2008-3415)	Nessus	Fedora Local Security Checks	medium
32038	Fedora 8 : WebKit-1.0.0-0.8.svn31787.fc8 / kazehakase-0.5.4-2.fc8 / midori-0.0.17-3.fc8 (2008-3229)	Nessus	Fedora Local Security Checks	medium
4434	Safari < 3.1 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
31604	Mac OS X : Apple Safari < 3.1	Nessus	MacOS X Local Security Checks	critical
800994	Mac OS X Safari < 3.1 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high

Detections

Analytics

CVE-2008-1010

high

Tenable Plugins

medium

medium

high

critical

high