Integer overflow in the PCRE regular expression compiler (JavaScriptCore/pcre/pcre_compile.cpp) in Apple WebKit, as used in Safari before 3.1.1, allows remote attackers to execute arbitrary code via a regular expression with large, nested repetition counts, which triggers a heap-based buffer overflow.

The version of Safari installed on the remote host reportedly is affected by several issues :

  - A malicious website can spoof window titles and URL bars     (CVE-2007-2398).

  - A memory corruption issue in the file downloading     capability could lead to a crash or arbitrary code     execution (CVE-2008-1024).

  - A cross-site scripting vulnerability exists in WebKit's     handling of URLs that contain a colon character in     the host name (CVE-2008-1025).

  - A heap-based buffer overflow exists in WebKit's handling     of JavaScript regular expressions (CVE-2008-1026).

The version of Apple Safari installed on the remote host reportedly is affected by several issues :

  - A cross-site scripting vulnerability exists in WebKit's     handling of URLs that contain a colon character in     the host name (CVE-2008-1025).

  - A heap buffer overflow exists in WebKit's handling of     JavaScript regular expressions (CVE-2008-1026).

The remote host is running a version of Apple Safari that is less than 3.1.1.

This version of Safari is vulnerable to a remote exploit.  An attacker exploiting this flaw would need to be able to entice a user to browse to a malicious URI and further entice the user to download a file.  Successful exploitation would result in the attacker executing arbitary code.  In addition, this version of Safari is running a version of AppleWebKit that is less than 525.18.  There are a number of flaws associated with that version of AppleWebKit as well.

ID	Name	Product	Family	Severity
31993	Safari < 3.1.1 Multiple Vulnerabilities	Nessus	Windows	high
31992	Mac OS X : Apple Safari < 3.1.1	Nessus	MacOS X Local Security Checks	high
4472	Safari < 3.1.1 PCRE Nested Repetition Count Overflow	Nessus Network Monitor	Web Clients	high
801008	Safari < 3.1.1 PCRE Nested Repetition Count Overflow	Log Correlation Engine	Web Clients	medium

Detections

Analytics

CVE-2008-1026

critical

Tenable Plugins

high

high

high

medium