Use-after-free vulnerability in WebKit in Apple Safari before 4.0.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted XML document.

Various bugs in webkit have been fixed. The CVE id's are :

CVE-2009-0945, CVE-2009-1681, CVE-2009-1684, CVE-2009-1685, CVE-2009-1686, CVE-2009-1687, CVE-2009-1688, CVE-2009-1689, CVE-2009-1691, CVE-2009-1690, CVE-2009-1692, CVE-2009-1693, CVE-2009-1694, CVE-2009-1695, CVE-2009-1696, CVE-2009-1697, CVE-2009-1698, CVE-2009-1699, CVE-2009-1700, CVE-2009-1701, CVE-2009-1702, CVE-2009-1703, CVE-2009-1709, CVE-2009-1710, CVE-2009-1711, CVE-2009-1712, CVE-2009-1713, CVE-2009-1714, CVE-2009-1715, CVE-2009-1718, CVE-2009-1724, CVE-2009-1725, CVE-2009-2195, CVE-2009-2199, CVE-2009-2200, CVE-2009-2419, CVE-2009-2797, CVE-2009-2816, CVE-2009-2841, CVE-2009-3272, CVE-2009-3384, CVE-2009-3933, CVE-2009-3934, CVE-2010-0046, CVE-2010-0047, CVE-2010-0048, CVE-2010-0049, CVE-2010-0050, CVE-2010-0052, CVE-2010-0053, CVE-2010-0054, CVE-2010-0315, CVE-2010-0647, CVE-2010-0051, CVE-2010-0650, CVE-2010-0651, CVE-2010-0656, CVE-2010-0659, CVE-2010-0661, CVE-2010-1029, CVE-2010-1126, CVE-2010-1233, CVE-2010-1236, CVE-2010-1386, CVE-2010-1387, CVE-2010-1388, CVE-2010-1389, CVE-2010-1390, CVE-2010-1391, CVE-2010-1392, CVE-2010-1393, CVE-2010-1394, CVE-2010-1395, CVE-2010-1396, CVE-2010-1397, CVE-2010-1398, CVE-2010-1399, CVE-2010-1400, CVE-2010-1401, CVE-2010-1402, CVE-2010-1403, CVE-2010-1404, CVE-2010-1405, CVE-2010-1406, CVE-2010-1407, CVE-2010-1408, CVE-2010-1409, CVE-2010-1410, CVE-2010-1412, CVE-2010-1413, CVE-2010-1414, CVE-2010-1415, CVE-2010-1416, CVE-2010-1417, CVE-2010-1418, CVE-2010-1419, CVE-2010-1421, CVE-2010-1422, CVE-2010-1729, CVE-2010-1749, CVE-2010-1757, CVE-2010-1758, CVE-2010-1759, CVE-2010-1760, CVE-2010-1761, CVE-2010-1762, CVE-2010-1763, CVE-2010-1764, CVE-2010-1766, CVE-2010-1767, CVE-2010-1769, CVE-2010-1770, CVE-2010-1771, CVE-2010-1772, CVE-2010-1773, CVE-2010-1774, CVE-2010-1780, CVE-2010-1781, CVE-2010-1782, CVE-2010-1783, CVE-2010-1784, CVE-2010-1785, CVE-2010-1786, CVE-2010-1787, CVE-2010-1788, CVE-2010-1789, CVE-2010-1790, CVE-2010-1791, CVE-2010-1792, CVE-2010-1793, CVE-2010-1807, CVE-2010-1812, CVE-2010-1813, CVE-2010-1814, CVE-2010-1815, CVE-2010-1822, CVE-2010-1823, CVE-2010-1824, CVE-2010-1825, CVE-2010-2264, CVE-2010-2295, CVE-2010-2297, CVE-2010-2300, CVE-2010-2301, CVE-2010-2302, CVE-2010-2441, CVE-2010-3116, CVE-2010-3257, CVE-2010-3259, CVE-2010-3312, CVE-2010-3803, CVE-2010-3804, CVE-2010-3805, CVE-2010-3808, CVE-2010-3809, CVE-2010-3810, CVE-2010-3811, CVE-2010-3812, CVE-2010-3813, CVE-2010-3816, CVE-2010-3817, CVE-2010-3818, CVE-2010-3819, CVE-2010-3820, CVE-2010-3821, CVE-2010-3822, CVE-2010-3823, CVE-2010-3824, CVE-2010-3826, CVE-2010-3829, CVE-2010-3900, CVE-2010-4040

Includes fixes for :

  - khtml: CVE-2010-0046: CSS format() argument memory     corruption

    - solid hardware does not detect NFS drives

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple cross-site scripting, denial of service and arbitrary code execution security flaws were discovered in webkit.

Please consult the CVE web links for further information.

The updated packages have been upgraded to the latest version (1.2.7) to correct these issues.

A Bugzilla Security Advisory reports :

This advisory covers three security issues that have recently been fixed in the Bugzilla code :

- A weakness in Bugzilla could allow a user to gain unauthorized access to another Bugzilla account.

- A weakness in the Perl CGI.pm module allows injecting HTTP headers and content to users via several pages in Bugzilla.

- If you put a harmful 'javascript:' or 'data:' URL into Bugzilla's 'URL' field, then there are multiple situations in which Bugzilla will unintentionally make that link clickable.

- Various pages lack protection against cross-site request forgeries.

All affected installations are encouraged to upgrade as soon as possible.

A large number of security issues were discovered in the WebKit browser and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary code execution.

Please consult the bug listed at the top of this advisory to get the exact list of CVE numbers fixed for each release.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- fix multiple flaws in webkit: CVE-2010-0047,     CVE-2010-0648, CVE-2010-0656

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes several WebKit security issues: * CVE-2010-0046: CSS format() argument memory corruption * CVE-2010-0049: Use of free()d line boxes in mixed LTR/RTL text * CVE-2010-0050: Crash at HTMLParser after handling misnested style tags * CVE-2010-0051 (CVE-2010-0651):
Remote information disclosure * CVE-2010-0052: Cached page can result in accessing a destroyed HTMLInputElement

  - CVE-2010-0054: Use of stale HTMLImageElement pointer     This update includes bugfixes: * fixes the build on     SPARC64 and possibly some other non-x86 64-bit     platforms, * makes tablet detection work with the new     wacom drivers, * makes the QtMultimedia low-level sound     API work (by enabling the ALSA backend), and new     features: * adds Provides for qt-assistant-adp and     qt-assistant-adp-devel in preparation for an upcoming     package split.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote mobile host is a using a version of Apple iOS earlier than 4.0. Such versions are potentially affected by multiple vulnerabilities. Apple iOS 4.0 contains security fixes for the following components :

  - Application Sandbox

  - CFNetwork

  - ImageIO

  - LibSystem

  - libxml

  - Passcode Lock

  - Safari

  - Settings

  - WebKit

The version of Safari installed on the remote host is earlier than 4.0.5.  Such versions are potentially affected by several issues : 

  A buffer underflow in ImageIO's handling of TIFF images could lead to a crash or arbitrary code execution. (CVE-2009-2285)

  - An integer overflow in the handling of images with an embedded color profile could lead to a crash or arbitrary code execution. (CVE-2010-0040)

  - An uninitialized memory access issue in ImageIO's handling of BMP images could result in sending of data from Safari's memory to a website. (CVE-2010-0041)

  - An uninitialized memory access issue in ImageIO's handling of TIFF images could result in sending of data from Safari's memory to a website. (CVE-2010-0042)

  - A memory corruption issue in the handling of TIFF images could lead to a crash or arbitrary code execution. (CVE-2010-0043)

  - An implementation issue in the handling of cookies set by RSS and Atom feeds could result in a cookie being set when visiting or updating a feed even if Safari is configured to block cookies via the 'Accept Cookies' preference. (CVE-2010-0044)

  - An issue in Safari's handling of external URL schemes could cause a local file to be opened in response to a URL encountered on a web page, which could allow  a malicious web server to execute arbitrary code. (CVE-2010-0045)

  - A memory corruption issue in WebKit's handling of CSS format() arguments could lead to a crash or arbitrary code execution. (CVE-2010-0046)

  - A use-after-free issue in the handling of HTML object element fallback content could lead to a crash or arbitrary code execution. (CVE-2010-0047)

  - A use-after-free issue in WebKit's parsing of XML documents could lead to a crash or arbitrary code execution. (CVE-2010-0048)

  - A use-after-free issue in the handling of HTML elements containing right-to-left displayed text could lead to a crash or arbitrary code execution. (CVE-2010-0049)

  - A use-after-free issue in WebKit's handling of incorrectly nested  HTML tags could lead to a crash or arbitrary code execution. (CVE-2010-0050)

  - An implementation issue in WebKit''s handling of cross-origin stylesheet requests when visiting a malicious website could result in disclosure of the content of protected resources on another website. (CVE-2010-0051)

  - A use-after-free issue in WebKit's handling of callbacks for HTML elements could lead to a crash or arbitrary code execution. (CVE-2010-0052)

  - A use-after-free issue in the rendering of content with a CSS display property set to 'run-in' could lead to a crash or arbitrary code execution. (CVE-2010-0053)

  - A use-after-free issue in WebKit's handling of HTML image elements could lead to a crash or arbitrary code execution. (CVE-2010-0054)

The version of Safari installed on the remote Windows host is earlier than 4.0.5.  It thus is potentially affected by several issues :

  - A buffer underflow in ImageIO's handling of TIFF images     could lead to a crash or arbitrary code execution.
    (CVE-2009-2285)

  - An integer overflow in the handling of images with an     embedded color profile could lead to a crash or     arbitrary code execution. (CVE-2010-0040)

  - An uninitialized memory access issue in ImageIO's     handling of BMP images could result in sending of data     from Safari's memory to a website. (CVE-2010-0041)

  - An uninitialized memory access issue in ImageIO's     handling of TIFF images could result in the sending of     data from Safari's memory to a website. (CVE-2010-0042)

  - A memory corruption issue in the handling of TIFF     images could lead to a crash or arbitrary code     execution. (CVE-2010-0043)

  - An implementation issue in the handling of cookies set     by RSS and Atom feeds could result in a cookie being     set when visiting or updating a feed even if Safari is     configured to block cookies via the 'Accept Cookies'     preference. (CVE-2010-0044)

  - An issue in Safari's handling of external URL schemes     could cause a local file to be opened in response to a     URL encountered on a web page, which could allow a     malicious web server to execute arbitrary code.
    (CVE-2010-0045)

  - A memory corruption issue in WebKit's handling of CSS     format() arguments could lead to a crash or arbitrary     code execution. (CVE-2010-0046)

  - A use-after-free issue in the handling of HTML object     element fallback content could lead to a crash or     arbitrary code execution. (CVE-2010-0047)

  - A use-after-free issue in WebKit's parsing of XML     documents could lead to a crash or arbitrary code     execution. (CVE-2010-0048)

  - A use-after-free issue in the handling of HTML elements     containing right-to-left displayed text could lead to a     crash or arbitrary code execution. (CVE-2010-0049)

  - A use-after-free issue in WebKit's handling of     incorrectly nested HTML tags could lead to a crash or     arbitrary code execution. (CVE-2010-0050)

  - An implementation issue in WebKit's handling of cross-     origin stylesheet requests when visiting a malicious     website could result in disclosure of the content of     protected resources on another website. (CVE-2010-0051)

  - A use-after-free issue in WebKit's handling of     callbacks for HTML elements could lead to a crash or     arbitrary code execution. (CVE-2010-0052)

  - A use-after-free issue in the rendering of content with     a CSS display property set to 'run-in' could lead to a     crash or arbitrary code execution. (CVE-2010-0053)

  - A use-after-free issue in WebKit's handling of HTML     image elements could lead to a crash or arbitrary code     execution. (CVE-2010-0054)

The version of Apple Safari installed on the remote Mac OS X host is earlier than 4.0.5.  As such, it is potentially affected by several issues :

  - An implementation issue in the handling of cookies set     by RSS and Atom feeds could result in a cookie being     set when visiting or updating a feed even if Safari is     configured to block cookies via the 'Accept Cookies'     preference. (CVE-2010-0044)

  - A memory corruption issue in WebKit's handling of CSS     format() arguments could lead to a crash or arbitrary     code execution. (CVE-2010-0046)

  - A use-after-free issue in the handling of HTML object     element fallback content could lead to a crash or     arbitrary code execution. (CVE-2010-0047)

  - A use-after-free issue in WebKit's parsing of XML     documents could lead to a crash or arbitrary code     execution. (CVE-2010-0048)

  - A use-after-free issue in the handling of HTML elements     containing right-to-left displayed text could lead to a     crash or arbitrary code execution. (CVE-2010-0049)

  - A use-after-free issue in WebKit's handling of     incorrectly nested HTML tags could lead to a crash or     arbitrary code execution. (CVE-2010-0050)

  - An implementation issue in WebKit's handling of cross-     origin stylesheet requests when visiting a malicious     website could result in disclosure of the content of     protected resources on another website. (CVE-2010-0051)

  - A use-after-free issue in WebKit's handling of     callbacks for HTML elements could lead to a crash or     arbitrary code execution. (CVE-2010-0052)

  - A use-after-free issue in the rendering of content with     a CSS display property set to 'run-in' could lead to a     crash or arbitrary code execution. (CVE-2010-0053)

  - A use-after-free issue in WebKit's handling of HTML     image elements could lead to a crash or arbitrary code     execution. (CVE-2010-0054)

ID	Name	Product	Family	Severity
75629	openSUSE Security Update : libwebkit (openSUSE-SU-2011:0024-1)	Nessus	SuSE Local Security Checks	critical
56899	Fedora 16 : kdelibs-4.7.3-5.fc16 (2011-16151)	Nessus	Fedora Local Security Checks	high
53764	openSUSE Security Update : libwebkit (openSUSE-SU-2011:0024-1)	Nessus	SuSE Local Security Checks	critical
52523	Mandriva Linux Security Advisory : webkit (MDVSA-2011:039)	Nessus	Mandriva Local Security Checks	critical
51670	FreeBSD : bugzilla -- multiple serious vulnerabilities (c8c927e5-2891-11e0-8f26-00151735203a)	Nessus	FreeBSD Local Security Checks	high
50046	Ubuntu 9.10 / 10.04 LTS / 10.10 : webkit vulnerabilities (USN-1006-1)	Nessus	Ubuntu Local Security Checks	critical
47489	Fedora 13 : qt-4.6.2-17.fc13 (2010-8423)	Nessus	Fedora Local Security Checks	high
47488	Fedora 11 : qt-4.6.2-17.fc11 (2010-8379)	Nessus	Fedora Local Security Checks	high
47487	Fedora 12 : qt-4.6.2-17.fc12 (2010-8360)	Nessus	Fedora Local Security Checks	high
47365	Fedora 11 : qt-4.6.2-8.fc11 (2010-4524)	Nessus	Fedora Local Security Checks	high
47364	Fedora 13 : qt-4.6.2-8.fc13 (2010-4521)	Nessus	Fedora Local Security Checks	high
47363	Fedora 12 : qt-4.6.2-8.fc12 (2010-4518)	Nessus	Fedora Local Security Checks	high
5578	Apple iOS < 4.0 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	critical
5361	Safari < 4.0.5 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
45045	Safari < 4.0.5 Multiple Vulnerabilities	Nessus	Windows	high
45044	Mac OS X : Apple Safari < 4.0.5	Nessus	MacOS X Local Security Checks	high

Detections

Analytics

CVE-2010-0048

high

Tenable Plugins

critical

high

critical

critical

high

critical

high

high

high

high

high

high

critical

high

high

high