Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to a layout change during selection rendering and the DOCUMENT_POSITION_DISCONNECTED attribute in a container of an unspecified type.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - WebKit: use-after-free vulnerability in handling of attribute manipulation (CVE-2010-1119)

  - WebKit: off-by-one memory read out of bounds vulnerability in handling of HTML lists (CVE-2010-1773)

  - Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and     Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a     denial of service (application crash) via vectors related to the contentEditable attribute and removing     container elements. (CVE-2010-1396)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

Various bugs in webkit have been fixed. The CVE id's are :

CVE-2009-0945, CVE-2009-1681, CVE-2009-1684, CVE-2009-1685, CVE-2009-1686, CVE-2009-1687, CVE-2009-1688, CVE-2009-1689, CVE-2009-1691, CVE-2009-1690, CVE-2009-1692, CVE-2009-1693, CVE-2009-1694, CVE-2009-1695, CVE-2009-1696, CVE-2009-1697, CVE-2009-1698, CVE-2009-1699, CVE-2009-1700, CVE-2009-1701, CVE-2009-1702, CVE-2009-1703, CVE-2009-1709, CVE-2009-1710, CVE-2009-1711, CVE-2009-1712, CVE-2009-1713, CVE-2009-1714, CVE-2009-1715, CVE-2009-1718, CVE-2009-1724, CVE-2009-1725, CVE-2009-2195, CVE-2009-2199, CVE-2009-2200, CVE-2009-2419, CVE-2009-2797, CVE-2009-2816, CVE-2009-2841, CVE-2009-3272, CVE-2009-3384, CVE-2009-3933, CVE-2009-3934, CVE-2010-0046, CVE-2010-0047, CVE-2010-0048, CVE-2010-0049, CVE-2010-0050, CVE-2010-0052, CVE-2010-0053, CVE-2010-0054, CVE-2010-0315, CVE-2010-0647, CVE-2010-0051, CVE-2010-0650, CVE-2010-0651, CVE-2010-0656, CVE-2010-0659, CVE-2010-0661, CVE-2010-1029, CVE-2010-1126, CVE-2010-1233, CVE-2010-1236, CVE-2010-1386, CVE-2010-1387, CVE-2010-1388, CVE-2010-1389, CVE-2010-1390, CVE-2010-1391, CVE-2010-1392, CVE-2010-1393, CVE-2010-1394, CVE-2010-1395, CVE-2010-1396, CVE-2010-1397, CVE-2010-1398, CVE-2010-1399, CVE-2010-1400, CVE-2010-1401, CVE-2010-1402, CVE-2010-1403, CVE-2010-1404, CVE-2010-1405, CVE-2010-1406, CVE-2010-1407, CVE-2010-1408, CVE-2010-1409, CVE-2010-1410, CVE-2010-1412, CVE-2010-1413, CVE-2010-1414, CVE-2010-1415, CVE-2010-1416, CVE-2010-1417, CVE-2010-1418, CVE-2010-1419, CVE-2010-1421, CVE-2010-1422, CVE-2010-1729, CVE-2010-1749, CVE-2010-1757, CVE-2010-1758, CVE-2010-1759, CVE-2010-1760, CVE-2010-1761, CVE-2010-1762, CVE-2010-1763, CVE-2010-1764, CVE-2010-1766, CVE-2010-1767, CVE-2010-1769, CVE-2010-1770, CVE-2010-1771, CVE-2010-1772, CVE-2010-1773, CVE-2010-1774, CVE-2010-1780, CVE-2010-1781, CVE-2010-1782, CVE-2010-1783, CVE-2010-1784, CVE-2010-1785, CVE-2010-1786, CVE-2010-1787, CVE-2010-1788, CVE-2010-1789, CVE-2010-1790, CVE-2010-1791, CVE-2010-1792, CVE-2010-1793, CVE-2010-1807, CVE-2010-1812, CVE-2010-1813, CVE-2010-1814, CVE-2010-1815, CVE-2010-1822, CVE-2010-1823, CVE-2010-1824, CVE-2010-1825, CVE-2010-2264, CVE-2010-2295, CVE-2010-2297, CVE-2010-2300, CVE-2010-2301, CVE-2010-2302, CVE-2010-2441, CVE-2010-3116, CVE-2010-3257, CVE-2010-3259, CVE-2010-3312, CVE-2010-3803, CVE-2010-3804, CVE-2010-3805, CVE-2010-3808, CVE-2010-3809, CVE-2010-3810, CVE-2010-3811, CVE-2010-3812, CVE-2010-3813, CVE-2010-3816, CVE-2010-3817, CVE-2010-3818, CVE-2010-3819, CVE-2010-3820, CVE-2010-3821, CVE-2010-3822, CVE-2010-3823, CVE-2010-3824, CVE-2010-3826, CVE-2010-3829, CVE-2010-3900, CVE-2010-4040

Multiple cross-site scripting, denial of service and arbitrary code execution security flaws were discovered in webkit.

Please consult the CVE web links for further information.

The updated packages have been upgraded to the latest version (1.2.7) to correct these issues.

A large number of security issues were discovered in the WebKit browser and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary code execution.

Please consult the bug listed at the top of this advisory to get the exact list of CVE numbers fixed for each release.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote mobile host is a using a version of Apple iOS earlier than 4.0. Such versions are potentially affected by multiple vulnerabilities. Apple iOS 4.0 contains security fixes for the following components :

  - Application Sandbox

  - CFNetwork

  - ImageIO

  - LibSystem

  - libxml

  - Passcode Lock

  - Safari

  - Settings

  - WebKit

Versions of iTunes older than 9.2 are potentially affected by multiple vulnerabilities :

  - A heap buffer overflow in the handling of images with an embedded ColorSync profile may lead to an application crash or arbitrary code execution. (CVE-2009-1726)

  - Multiple integer overflows in ImageIO's handling of TIFF files may lead to an application crash or arbitrary code execution. (CVE-2010-1411)

  - Multiple vulnerabilities in WebKit may have a variety of effects, including arbitrary code execution. (CVE-2010-0544, CVE-2010-1119, CVE-2010-1387, CVE-2010-1390, CVE-2010-1392, CVE-2010-1393, CVE-2010-1395, CVE-2010-1396, CVE-2010-1397, CVE-2010-1398, CVE-2010-1399, CVE-2010-1400, CVE-2010-1401, CVE-2010-1402, CVE-2010-1403, CVE-2010-1404, CVE-2010-1405, CVE-2010-1408, CVE-2010-1409, CVE-2010-1410, CVE-2010-1412, CVE-2010-1414, CVE-2010-1415, CVE-2010-1416, CVE-2010-1417, CVE-2010-1418, CVE-2010-1419, CVE-2010-1421, CVE-2010-1422, CVE-2010-1749, CVE-2010-1758, CVE-2010-1759, CVE-2010-1761, CVE-2010-1763, CVE-2010-1769, CVE-2010-1770, CVE-2010-1771, CVE-2010-1774)

The version of Apple iTunes on the remote host is prior to version 9.2. It is, therefore, affected by multiple vulnerabilities :

  - A heap-based buffer overflow vulnerability exists in the     handling of images with an embedded ColorSync profile.
    By using a specially crafted image, a remote attacker     can exploit this to cause a denial of service or execute     arbitrary code. (CVE-2009-1726)

  - Multiple integer overflow vulnerabilities exist in     ImageIO's handling of TIFF files. By using a specially     crafted TIFF file, a remote attacker can exploit these     to cause a denial of service or execute arbitrary code.
    (CVE-2010-1411)

  - The WebKit component contains multiple vulnerabilities     that can be exploited, including the execution of     arbitrary code.
    (CVE-2010-0544, CVE-2010-1119, CVE-2010-1387,     CVE-2010-1390, CVE-2010-1392, CVE-2010-1393,     CVE-2010-1395, CVE-2010-1396, CVE-2010-1397,     CVE-2010-1398, CVE-2010-1399, CVE-2010-1400,     CVE-2010-1401, CVE-2010-1402, CVE-2010-1403,     CVE-2010-1404, CVE-2010-1405, CVE-2010-1408,     CVE-2010-1409, CVE-2010-1410, CVE-2010-1412,     CVE-2010-1414, CVE-2010-1415, CVE-2010-1416,     CVE-2010-1417, CVE-2010-1418, CVE-2010-1419,     CVE-2010-1421, CVE-2010-1422, CVE-2010-1749,     CVE-2010-1758, CVE-2010-1759, CVE-2010-1761,     CVE-2010-1763, CVE-2010-1769, CVE-2010-1770,     CVE-2010-1771, CVE-2010-1774)

The version of Apple iTunes installed on the remote Windows host is older than 9.2. As such, it may be affected by multiple vulnerabilities :

  - A heap-based buffer overflow in the handling of images     with an embedded ColorSync profile may lead to an     application crash or arbitrary code execution.
    (CVE-2009-1726)

  - Multiple integer overflows in ImageIO's handling of     TIFF files may lead to an application crash or     arbitrary code execution. (CVE-2010-1411)

  - Multiple vulnerabilities WebKit may have a variety of     effects, including arbitrary code execution.
    (CVE-2010-0544, CVE-2010-1119, CVE-2010-1387,     CVE-2010-1390, CVE-2010-1392, CVE-2010-1393,     CVE-2010-1395, CVE-2010-1396, CVE-2010-1397,     CVE-2010-1398, CVE-2010-1399, CVE-2010-1400,     CVE-2010-1401, CVE-2010-1402, CVE-2010-1403,     CVE-2010-1404, CVE-2010-1405, CVE-2010-1408,     CVE-2010-1409, CVE-2010-1410, CVE-2010-1412,     CVE-2010-1414, CVE-2010-1415, CVE-2010-1416,     CVE-2010-1417, CVE-2010-1418, CVE-2010-1419,     CVE-2010-1421, CVE-2010-1422, CVE-2010-1749,     CVE-2010-1758, CVE-2010-1759, CVE-2010-1761,     CVE-2010-1763, CVE-2010-1769, CVE-2010-1770,     CVE-2010-1771, CVE-2010-1774)

Versions of Safari earlier than 4.1 / 5.0 are potentially affected by multiple vulnerabilities :

  - A heap buffer overflow exists in the handling of images with an embedded ColorSync profile. (CVE-2009-1726)

  - Safari supports the inclusion of user information in URLs, which allows the URL to specify a username and password to authenticate the user to the named server. (CVE-2010-1384)

  - A use after free issue exists in Safari's management of windows. (CVE-2010-1750)

  - An implementation issue exists in WebKit's handling of URLs in the clipboard. (CVE-2010-1388)

  - Dragging or pasting a selection from one site to another may allow scripts contained in the selection to be executed in the context of the new site. (CVE-2010-1389)

  - A cononicalization issue exists in WebKit's handling of UTF-7 encoded text. (CVE-2010-1390)

  - A path traversal issue exists in WebKit's support for Local Storage and Web SQL database. (CVE-2010-1391)

  - A use after free issue exists in WebKit's rendering of HTML buttons. (CVE-2010-1392)

  - An information disclosure issue exists in WebKit's handling of Cascading Stylesheets. (CVE-2010-1393)

  - A use after free issue exists in WebKit's handling of attribute manipulation. (CVE-2010-1119)

  - A design issue exists in WebKit's handling of HTML document fragments. (CVE-2010-1394)

  - An implementation issue exists in WebKit's handling of keyboard focus. (CVE-2010-1422)

  - A scope management issue exists in WebKit's handling of DOM constructor objects. (CVE-2010-1395)

  - A use after free issue exists in WebKit's handling of the removal of container elements. (CVE-2010-1396)

  - A use after free issue exists in WebKit's rendering of a selection when the layout changes. (CVE-2010-1397)

  - A memory corruption issue exists in WebKit's handling of ordered list insertions. (CVE-2010-1398)

  - An uninitialized memory access issue exists in WebKit's handling of selection changes on form input elements. (CVE-2010-1399)

  - A use after free issue exists in WebKit's handling of caption elements. (CVE-2010-1400)

  - A use after free issue exists in WebKit's handling of the ':first-letter' pseudo-element in cascading stylesheets. (CVE-2010-1401)

  - a double free issue exists in WebKit's handling of event listeners in SVG documents. (CVE-2010-1402)

  - An uninitialized memory access issue exists in WebKit's handling of 'use' elements in SVG documents. (CVE-2010-1403)

  - A use after free issue exists in WebKit's handling of SVG documents with multiple 'use' elements. (CVE-2010-1404)

  - A memory corruption issue exists in WebKit's handling of nested 'use' elements in SVG documents. (CVE-2010-1410)

  - A use after free issue exists in WebKit's handling of CSS run-ins. (CVE-2010-1749)

  - A use after free issue exists in WebKit's handling of HTML elements with custom vertical positioning. (CVE-2010-1405)

  - When WebKit is redirected from an HTTPS site to an HTTP site, the Referer header is passed to the HTTP site. (CVE-2010-1406)

  - An integer truncation issue exists in WebKit's handling of requests to non-default TCP ports. (CVE-2010-1408)

  - Common IRC service ports are not included in WebKit's port blacklist. (CVE-2010-1409)

  - A use after free issue exists in WebKit's handling of hover events. (CVE-2010-1412)

  - In certain circumstances, WebKit may send NTLM credentials in plain text. (CVE-2010-1413)

  - A use after free issue exists in WebKit's handling of the removeChild DOM method. (CVE-2010-1414)

  - An API abuse issue exists in WebKit's handling of libxml contexts. (CVE-2010-1415)

  - A cross-site image capture issue exists in WebKit. (CVE-2010-1416)

  - A memory corruption issue exists in WebKit's rendering of CSS-styled HTML content with multiple :after pseudo-selectors. (CVE-2010-1417)

  - An input validation issue exists in WebKit's handling of the src attribute of the frame element (CVE-2010-1418)

  - A use after free issue exists in WebKit's handling of drag and drop when the window acting as a source of a drag operation is closed before the drag operation is completed. (CVE-2010-1419)

  - A design issue exists in the implementation of the JavaScript function execCommand. (CVE-2010-1421)

  - An issue in WebKit's handling of malformed URLs may result in a cross-site scripting attack when visiting a maliciously crafted website. (CVE-2010-0544)

  - A use after free issue exists in WebKit's handling of DOM Range objects. (CVE-2010-1758)

  - A use after free issue exists in WebKit's handling of the Node.normalize method. (CVE-2010-1759)

  - A use after free issue exist sin WebKit's rendering of HTML document subtrees. (CVE-2010-1761)

  - A design issue exists in the handling of HTML contained in textarea elements. (CVE-2010-1762)

  - A design issue exists in WebKit's handling of HTTP redirects. (CVE-2010-1764)

  - A type checking issue exists in WebKit's handling of text nodes. (CVE-2010-1770)

  - A use after free issue exists in WebKit's handling of fonts. (CVE-2010-1771)

  - An out of bounds memory access issue exists in WebKit's handling of HTML tables. (CVE-2010-1774)

  - A design issue exists in WebKit's handling of the CSS :visited pseudo-class.

The version of Safari installed on the remote Windows host is earlier than 5.0.  As such, it is potentially affected by numerous issues in the following components :

  - ColorSync

  - Safari

  - WebKit

The version of Apple Safari installed on the remote Mac OS X host is earlier than 5.0 / 4.1. As such, it is potentially affected by numerous issues in the following components :

  - Safari

  - WebKit

ID	Name	Product	Family	Severity
198573	RHEL 6 : qt (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
75629	openSUSE Security Update : libwebkit (openSUSE-SU-2011:0024-1)	Nessus	SuSE Local Security Checks	critical
53764	openSUSE Security Update : libwebkit (openSUSE-SU-2011:0024-1)	Nessus	SuSE Local Security Checks	critical
52523	Mandriva Linux Security Advisory : webkit (MDVSA-2011:039)	Nessus	Mandriva Local Security Checks	critical
50046	Ubuntu 9.10 / 10.04 LTS / 10.10 : webkit vulnerabilities (USN-1006-1)	Nessus	Ubuntu Local Security Checks	critical
5578	Apple iOS < 4.0 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	critical
5573	iTunes < 9.2 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
47038	Apple iTunes < 9.2 Multiple Vulnerabilities (uncredentialed check)	Nessus	Peer-To-Peer File Sharing	high
47037	Apple iTunes < 9.2 Multiple Vulnerabilities (credentialed check)	Nessus	Windows	high
801012	Safari < 4.1 / 5.0 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
5566	Safari < 4.1 / 5.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	critical
46838	Safari < 5.0 Multiple Vulnerabilities	Nessus	Windows	high
46837	Mac OS X : Apple Safari < 5.0 / 4.1	Nessus	MacOS X Local Security Checks	high

Detections

Analytics

CVE-2010-1397

high

Tenable Plugins

high

critical

critical

critical

critical

critical

medium

high

high

high

critical

high

high