WebCore in Apple Safari does not properly perform garbage collection of JavaScript document elements, which allows remote attackers to execute arbitrary code or cause a denial of service (heap corruption and application crash) via a reference to the ownerNode property of a copied CSSStyleSheet object of a STYLE element, as originally demonstrated on Apple iPhone before 2.0 and iPod touch before 2.0, a different vulnerability than CVE-2008-1590.

The version of Safari installed on the remote Windows host is earlier than 3.2.  Such versions are potentially affected by several issues : 


  - Safari includes a version of zlib that is affected by multiple vulnerabilities. (CVE-2005-2096)
  - A heap buffer overflow issue in the libxslt library could lead to a crash or arbitrary code execution. (CVE-2008-1767)
  - A signedness issue in Safari's handling of JavaScript array indices could lead to a crash or arbitrary code execution. (CVE-2008-2303)
  - A memory corruption issue in WebCore's handling of style sheet elements could lead to a crash or arbitrary code execution. (CVE-2008-2317)
  - Multiple uninitialized memory access issues in libTIFF's handling of LZW-encoded TIFF images could lead to a crash or arbitrary code execution. (CVE-2008-2327)
  - A memory corruption issue in ImageIO's handling of TIFF images could lead to a crash or arbitrary code execution. (CVE-2008-2332).
  - A memory corruption issue in ImageIO's handling of embedded ICC profiles in JPEG images could lead to a crash or arbitrary code execution. (CVE-2008-3608)
  - A heap buffer overflow in CoreGraphics' handling of color spaces could lead to a crash or arbitrary code execution. (CVE-2008-3623)
  - A buffer overflow in the handling of images with an embedded ICC profile could lead to a crash or arbitrary code execution. (CVE-2008-3642)
  - Disabling autocomplete on a form field may not prevent the data in the field from being stored in the browser page cache. (CVE-2008-3644)
  - WebKit's plug-in interface does not block plug-ins from launching local URLs, which could allow a remote attacker to launch local files in Safari and lead to the disclosure of sensitive information. (CVE-2008-4216)

The version of Apple Safari installed on the remote Mac OS X host is earlier than 3.2.  As such, it is potentially affected by several issues :

  - A signedness issue in Safari's handling of JavaScript     array indices could lead to a crash or arbitrary code     execution. (CVE-2008-2303)

  - A memory corruption issue in WebCore's handling of style     sheet elements could lead to a crash or arbitrary code     execution. (CVE-2008-2317)

  - Disabling autocomplete on a form field may not prevent     the data in the field from being stored in the browser     page cache. (CVE-2008-3644)

  - WebKit's plug-in interface does not block plug-ins from     launching local URLs, which could allow a remote     attacker to launch local files in Safari and lead to the     disclosure of sensitive information. (CVE-2008-4216)

The version of Safari installed on the remote Windows host is earlier than 3.2.  Such versions are potentially affected by several issues :

  - Safari includes a version of zlib that is affected by     multiple vulnerabilities. (CVE-2005-2096)

  - A heap-based buffer overflow issue in the libxslt library     could lead to a crash or arbitrary code execution.
    (CVE-2008-1767)

  - A signedness issue in Safari's handling of JavaScript     array indices could lead to a crash or arbitrary code     execution. (CVE-2008-2303)

  - A memory corruption issue in WebCore's handling of style     sheet elements could lead to a crash or arbitrary code     execution. (CVE-2008-2317)

  - Multiple uninitialized memory access issues in libTIFF's     handling of LZW-encoded TIFF images could lead to a     crash or arbitrary code execution. (CVE-2008-2327)

  - A memory corruption issue in ImageIO's handling of TIFF     images could lead to a crash or arbitrary code     execution. (CVE-2008-2332).

  - A memory corruption issue in ImageIO's handling of     embedded ICC profiles in JPEG images could lead to a     crash or arbitrary code execution. (CVE-2008-3608)

  - A heap-based buffer overflow in CoreGraphics' handling     of color spaces could lead to a crash or arbitrary code     execution. (CVE-2008-3623)

  - A buffer overflow in the handling of images with an     embedded ICC profile could lead to a crash or arbitrary     code execution. (CVE-2008-3642)

  - Disabling autocomplete on a form field may not prevent     the data in the field from being stored in the browser     page cache. (CVE-2008-3644)

  - WebKit's plug-in interface does not block plug-ins from     launching local URLs, which could allow a remote     attacker to launch local files in Safari and lead to the     disclosure of sensitive information. (CVE-2008-4216)

The version of Safari installed on the remote Windows host is earlier than 3.2.  Such versions are potentially affected by several issues : 


  - Safari includes a version of zlib that is affected by multiple vulnerabilities. (CVE-2005-2096)
  - A heap buffer overflow issue in the libxslt library could lead to a crash or arbitrary code execution. (CVE-2008-1767)
  - A signedness issue in Safari's handling of JavaScript array indices could lead to a crash or arbitrary code execution. (CVE-2008-2303)
  - A memory corruption issue in WebCore's handling of style sheet elements could lead to a crash or arbitrary code execution. (CVE-2008-2317)
  - Multiple uninitialized memory access issues in libTIFF's handling of LZW-encoded TIFF images could lead to a crash or arbitrary code execution. (CVE-2008-2327)
  - A memory corruption issue in ImageIO's handling of TIFF images could lead to a crash or arbitrary code execution. (CVE-2008-2332).
  - A memory corruption issue in ImageIO's handling of embedded ICC profiles in JPEG images could lead to a crash or arbitrary code execution. (CVE-2008-3608)
  - A heap buffer overflow in CoreGraphics' handling of color spaces could lead to a crash or arbitrary code execution. (CVE-2008-3623)
  - A buffer overflow in the handling of images with an embedded ICC profile could lead to a crash or arbitrary code execution. (CVE-2008-3642)
  - Disabling autocomplete on a form field may not prevent the data in the field from being stored in the browser page cache. (CVE-2008-3644)
  - WebKit's plug-in interface does not block plug-ins from launching local URLs, which could allow a remote attacker to launch local files in Safari and lead to the disclosure of sensitive information. (CVE-2008-4216)

 
IAVB Reference : 2008-B-0078
STIG Finding Severity : Category I

ID	Name	Product	Family	Severity
4754	Safari < 3.2 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
34773	Mac OS X : Apple Safari < 3.2	Nessus	MacOS X Local Security Checks	high
34772	Safari < 3.2 Multiple Vulnerabilities	Nessus	Windows	high
801019	Safari < 3.2 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high

Detections

Analytics

CVE-2008-2317

high

Tenable Plugins

high

high

high

high