Heap-based buffer overflow in WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a JavaScript string object.

Various bugs in webkit have been fixed. The CVE id's are :

CVE-2009-0945, CVE-2009-1681, CVE-2009-1684, CVE-2009-1685, CVE-2009-1686, CVE-2009-1687, CVE-2009-1688, CVE-2009-1689, CVE-2009-1691, CVE-2009-1690, CVE-2009-1692, CVE-2009-1693, CVE-2009-1694, CVE-2009-1695, CVE-2009-1696, CVE-2009-1697, CVE-2009-1698, CVE-2009-1699, CVE-2009-1700, CVE-2009-1701, CVE-2009-1702, CVE-2009-1703, CVE-2009-1709, CVE-2009-1710, CVE-2009-1711, CVE-2009-1712, CVE-2009-1713, CVE-2009-1714, CVE-2009-1715, CVE-2009-1718, CVE-2009-1724, CVE-2009-1725, CVE-2009-2195, CVE-2009-2199, CVE-2009-2200, CVE-2009-2419, CVE-2009-2797, CVE-2009-2816, CVE-2009-2841, CVE-2009-3272, CVE-2009-3384, CVE-2009-3933, CVE-2009-3934, CVE-2010-0046, CVE-2010-0047, CVE-2010-0048, CVE-2010-0049, CVE-2010-0050, CVE-2010-0052, CVE-2010-0053, CVE-2010-0054, CVE-2010-0315, CVE-2010-0647, CVE-2010-0051, CVE-2010-0650, CVE-2010-0651, CVE-2010-0656, CVE-2010-0659, CVE-2010-0661, CVE-2010-1029, CVE-2010-1126, CVE-2010-1233, CVE-2010-1236, CVE-2010-1386, CVE-2010-1387, CVE-2010-1388, CVE-2010-1389, CVE-2010-1390, CVE-2010-1391, CVE-2010-1392, CVE-2010-1393, CVE-2010-1394, CVE-2010-1395, CVE-2010-1396, CVE-2010-1397, CVE-2010-1398, CVE-2010-1399, CVE-2010-1400, CVE-2010-1401, CVE-2010-1402, CVE-2010-1403, CVE-2010-1404, CVE-2010-1405, CVE-2010-1406, CVE-2010-1407, CVE-2010-1408, CVE-2010-1409, CVE-2010-1410, CVE-2010-1412, CVE-2010-1413, CVE-2010-1414, CVE-2010-1415, CVE-2010-1416, CVE-2010-1417, CVE-2010-1418, CVE-2010-1419, CVE-2010-1421, CVE-2010-1422, CVE-2010-1729, CVE-2010-1749, CVE-2010-1757, CVE-2010-1758, CVE-2010-1759, CVE-2010-1760, CVE-2010-1761, CVE-2010-1762, CVE-2010-1763, CVE-2010-1764, CVE-2010-1766, CVE-2010-1767, CVE-2010-1769, CVE-2010-1770, CVE-2010-1771, CVE-2010-1772, CVE-2010-1773, CVE-2010-1774, CVE-2010-1780, CVE-2010-1781, CVE-2010-1782, CVE-2010-1783, CVE-2010-1784, CVE-2010-1785, CVE-2010-1786, CVE-2010-1787, CVE-2010-1788, CVE-2010-1789, CVE-2010-1790, CVE-2010-1791, CVE-2010-1792, CVE-2010-1793, CVE-2010-1807, CVE-2010-1812, CVE-2010-1813, CVE-2010-1814, CVE-2010-1815, CVE-2010-1822, CVE-2010-1823, CVE-2010-1824, CVE-2010-1825, CVE-2010-2264, CVE-2010-2295, CVE-2010-2297, CVE-2010-2300, CVE-2010-2301, CVE-2010-2302, CVE-2010-2441, CVE-2010-3116, CVE-2010-3257, CVE-2010-3259, CVE-2010-3312, CVE-2010-3803, CVE-2010-3804, CVE-2010-3805, CVE-2010-3808, CVE-2010-3809, CVE-2010-3810, CVE-2010-3811, CVE-2010-3812, CVE-2010-3813, CVE-2010-3816, CVE-2010-3817, CVE-2010-3818, CVE-2010-3819, CVE-2010-3820, CVE-2010-3821, CVE-2010-3822, CVE-2010-3823, CVE-2010-3824, CVE-2010-3826, CVE-2010-3829, CVE-2010-3900, CVE-2010-4040

The remote mobile host is a using a version of Apple iOS earlier than 4.2. Such versions are potentially affected by multiple vulnerabilities. Apple iOS 4.2 contains security fixes for the following components :

  - Configuration Policies

  - CoreGraphics

  - FreeType

  - iAd Content Display

  - ImageIO

  - libxml

  - Mail

  - Networking

  - OfficeImport

  - Photos

  - Safari

  - Telephony

  - WebKit

  - Multiple components

The remote host has iTunes installed, a popular media player for Windows and Mac OS.

Versions of iTunes earlier than 10.0 are potentially affected by multiple vulnerabilities in the WebKit component.  Note that these issues only affect WebKit for Windows.

The version of Apple iTunes on the remote host is prior to version 10.0. It is, therefore, affected by multiple vulnerabilities in the WebKit component. Note that these only affect WebKit for Windows.

The version of Apple iTunes installed on the remote Windows host is older than 10.0. Such versions are affected by numerous issues in the WebKit component.

The remote host has Safari installed.

Versions of Safari earlier than 4.1.1 / 5.0.1 are potentially affected by multiple vulnerabilities :

  - Safari's AutoFill feature may disclose information to websites without user interaction. (CVE-2010-1796)

  - A use after free issue exists in WebKit's handling of element focus may lead to an application crash or arbitrary code execution. (CVE-2010-1780)

  - A memory corruption issue exists in WebKit's rendering of inline elements . (CVE-2010-1782)

  - A memory corruption issue exists in WebKit's handling of dynamic modifications to text nodes .

  - A memory corruption issue exists in WebKit's handling of CSS counters . (CVE-2010-1784)

  - An uninitialized memory access issue exists in WebKit's handling of the ':first-letter' and ':first-line' pseudo-elements in SVG text elements . (CVE-2010-1785)

  - A use after free issue exists in WebKit's handling of foreignObject elements in SVG documents. (CVE-2010-1786)

  - A memory corruption issue exists in WebKit's handling of floating elements in SVG documents. (CVE-2010-1787)

  - A memory corruption issue exists in WebKit's handling of 'use' elements in SVG documents. (CVE-2010-1788)

  - A heap buffer overflow exist sin WebKit's handling of JavaScript string objects. (CVE-2010-1789)

  - A re-entrancy issue exists in WebKit's handling of just-in-time compiled JavaScript stubs. (CVE-2010-1790)

  - A signedness issue exists in WebKit's handling of JavaScript arrays. (CVE-2010-1791)

  - A memory corruption issue exists in WebKit's handling of regular expressions. (CVE-2010-1792)

  - A use after free issue exists in WebKit's handling of 'font-face' and 'use' elements in SVG documents. (CVE-2010-1793)

The remote host has Safari installed. 

Versions of Safari earlier than 4.1.1 / 5.0.1 are potentially affected by multiple vulnerabilities :

  - Safari's AutoFill feature may disclose information to websites without user interaction. (CVE-2010-1796)

  - A use after free issue exists in WebKit's handling of element focus may lead to an application crash or arbitrary code execution. (CVE-2010-1780)

  - A memory corruption issue exists in WebKit's rendering of inline elements . (CVE-2010-1782)

  - A memory corruption issue exists in WebKit's handling of dynamic modifications to text nodes .

  - A memory corruption issue exists in WebKit's handling of CSS counters . (CVE-2010-1784)

  - An uninitialized memory access issue exists in WebKit's handling of the ':first-letter' and ':first-line' pseudo-elements in SVG text elements . (CVE-2010-1785)

  - A use after free issue exists in WebKit's handling of foreignObject elements in SVG documents. (CVE-2010-1786)

  - A memory corruption issue exists in WebKit's handling of floating elements in SVG documents. (CVE-2010-1787)

  - A memory corruption issue exists in WebKit's handling of 'use' elements in SVG documents. (CVE-2010-1788)

  - A heap buffer overflow exist sin WebKit's handling of JavaScript string objects. (CVE-2010-1789)

  - A re-entrancy issue exists in WebKit's handling of just-in-time compiled JavaScript stubs. (CVE-2010-1790)

  - A signedness issue exists in WebKit's handling of JavaScript arrays. (CVE-2010-1791)

  - A memory corruption issue exists in WebKit's handling of regular expressions. (CVE-2010-1792)

  - A use after free issue exists in WebKit's handling of 'font-face' and 'use' elements in SVG documents. (CVE-2010-1793)

The version of Safari installed on the remote Windows host is earlier than 5.0.1.  Such versions are potentially affected by numerous issues in the following components :

  - Safari

  - WebKit

The version of Apple Safari installed on the remote Mac OS X host is earlier than 5.0.1 / 4.1.1.  As such, it is potentially affected by numerous issues in the following components :

  - Safari

  - WebKit

ID	Name	Product	Family	Severity
75629	openSUSE Security Update : libwebkit (openSUSE-SU-2011:0024-1)	Nessus	SuSE Local Security Checks	critical
53764	openSUSE Security Update : libwebkit (openSUSE-SU-2011:0024-1)	Nessus	SuSE Local Security Checks	critical
5715	Apple iOS < 4.2 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	critical
5653	iTunes < 10.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
49087	Apple iTunes < 10.0 Multiple Vulnerabilities (uncredentialed check)	Nessus	Peer-To-Peer File Sharing	high
49086	Apple iTunes < 10.0 Multiple (credentialed check)	Nessus	Windows	high
801006	Safari < 4.1.1 / 5.0.1 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
5617	Safari < 4.1.1 / 5.0.1 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
47888	Safari < 5.0.1 Multiple Vulnerabilities	Nessus	Windows	high
47887	Mac OS X : Apple Safari < 5.0.1 / 4.1.1	Nessus	MacOS X Local Security Checks	high

Detections

Analytics

CVE-2010-1789

high

Tenable Plugins

critical

critical

critical

high

high

high

high

high

high

high