Off-by-one error in the CoreFoundation framework in Apple Mac OS X before 10.6.8 allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via a CFString object that triggers a buffer overflow.

The version of Safari installed on the remote Windows host is earlier than 5.1.  As such, it is potentially affected by numerous issues in the following components :

  - CFNetwork
  - ColorSync
  - CoreFoundation
  - CoreGraphics
  - International Components for Unicode
  - ImageIO
  - libxslt
  - libxml
  - Safari
  - WebKit

The version of Apple Safari installed on the remote macOS or Mac OS X host is prior to 11.1. It is, therefore, affected by multiple vulnerabilities as described in the HT4808 security advisory.

The remote host has Safari installed.

Versions of Safari earlier than 5.1 are potentially affected by several issues in the following component :

  - CFNetwork

  - ColorSync

  - CoreFoundation

  - CoreGraphics

  - International Components for Unicode

  - ImageIO

  - libxslt

  - libxml

  - Safari

  - WebKit

The remote host has Safari installed. 

Versions of Safari earlier than 5.1 are potentially affected by several issues in the following component :

  - CFNetwork

  - ColorSync

  - CoreFoundation

  - CoreGraphics

  - International Components for Unicode

  - ImageIO

  - libxslt

  - libxml

  - Safari

  - WebKit

The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.8. This update contains security-related fixes for the following components :

  - App Store
  - ATS
  - Certificate Trust Policy
  - CoreFoundation
  - CoreGraphics
  - FTP Server
  - ImageIO
  - International Components for Unicode
  - Kernel
  - Libsystem
  - libxslt
  - MobileMe
  - MySQL
  - OpenSSL
  - patch
  - QuickLook
  - QuickTime
  - Samba
  - servermgrd
  - subversion

Versions of Mac OS X 10.6 earlier than 10.6.8 are potentially affected by a security issue.  Mac OS X 10.6.8 contains a security fix for the following products :

  - App Store

  - ATS

  - Certificate Trust Policy

  - CoreFoundation

  - CoreGraphics

  - FTP Server

  - ImageIO

  - International Components for Unicode

  - Kernel

  - Libsystem

  - libxslt

  - MobileMe

  - MySQL

  - OpenSSL

  - patch

  - QuickLook

  - QuickTime

  - Samba

  - servermgrd

  - subversion
IAVA Reference : 2011-A-0160
IAVB Reference : 2012-B-0038
STIG Finding Severity : Category I

Versions of Mac OS X 10.6 earlier than 10.6.8 are potentially affected by a security issue.  Mac OS X 10.6.8 contains a security fix for the following products :

  - App Store

  - ATS

  - Certificate Trust Policy

  - CoreFoundation

  - CoreGraphics

  - FTP Server

  - ImageIO

  - International Components for Unicode

  - Kernel

  - Libsystem

  - libxslt

  - MobileMe

  - MySQL

  - OpenSSL

  - patch

  - QuickLook

  - QuickTime

  - Samba

  - servermgrd

  - subversion

ID	Name	Product	Family	Severity
55639	Safari < 5.1 Multiple Vulnerabilities	Nessus	Windows	high
55638	Mac OS X : Apple Safari < 5.1 / 5.0.6	Nessus	MacOS X Local Security Checks	critical
800988	Safari < 5.1 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
5992	Safari < 5.1 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
55416	Mac OS X 10.6.x < 10.6.8 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
800790	Mac OS X 10.6 < 10.6.8 Multiple Vulnerabilities	Log Correlation Engine	Operating System Detection	high
5968	Mac OS X 10.6 < 10.6.8 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical

Detections

Analytics

CVE-2011-0201

critical

Tenable Plugins

high

critical

high

high

critical

high

critical