Integer overflow in WebKit, as used on the Research In Motion (RIM) BlackBerry Torch 9800 with firmware 6.0.0.246, in Google Chrome before 10.0.648.133, and in Apple Safari before 5.0.5, allows remote attackers to execute arbitrary code via unknown vectors related to CSS "style handling," nodesets, and a length value, as demonstrated by Vincenzo Iozzo, Willem Pinckaers, and Ralf-Philipp Weinmann during a Pwn2Own competition at CanSecWest 2011.

Two issues in libwebkit have been fixed :

  - Webkit CSS Text Element Count remote code execution was     fixed. (CVE-2011-1290)

  - WebKit WBR Tag Removal remote code execution was fixed.
    (CVE-2011-1344)

The remote host has iTunes installed, a popular media player for Windows and Mac OS. 

Versions of iTunes earlier than 10.2.2 are potentially affected by several issues :

  - An integer overflow issue in the handling of nodesets could lead to a crash or arbitrary code execution. (CVE-2011-1290)

  - A use after free issue in the handling of text nodes could lead to a crash or arbitrary code execution. (CVE-2011-1344)

The version of Apple iTunes on the remote host is prior to version 10.2.2. It is, therefore, affected by multiple vulnerabilities in the WebKit component :

  - An integer overflow vulnerability exists in the handling     of nodesets that can be exploited by a remote attacker     to execute arbitrary code. (CVE-2011-1290)

  - A use-after-free vulnerability exists in the handling of     text nodes that can be exploited by a remote attacker to     execute arbitrary code. (CVE-2011-1344)

Note that these only affect WebKit for Windows.

The version of Apple iTunes installed on the remote Windows host is older than 10.2.2.  As such, it is potentially affected by several issues :

  - An integer overflow issue in the handling of nodesets     could lead to a crash or arbitrary code execution.
    (CVE-2011-1290)

  - A use after free issue in the handling of text nodes     could lead to a crash or arbitrary code execution.
    (CVE-2011-1344)

According to its banner, the remote Apple iOS device is missing a security update.  Versions of Apple iOS 4.2.5 or 4.2.6 are affected by vulnerabilities within the following components :

  - Certificate Trust Policy

  - QuickLook

  - WebKit

The remote mobile host is a using a version of Apple iOS earlier than 4.3.2. Such versions are potentially affected by multiple vulnerabilities. Apple iOS 4.3.2 contains security fixes for the following components :

  - Certificate Trust Policy

  - libxslt

  - QuickLook

  - WebKit

The version of Safari installed on the remote Windows host is earlier than 5.0.5.  It therefore is potentially affected by several issues :

  - An integer overflow issue in the handling of nodesets     could lead to a crash or arbitrary code execution.
    (CVE-2011-1290)

  - A use-after-free issue in the handling of text nodes     could lead to a crash or arbitrary code execution.
    (CVE-2011-1344)

The version of Apple Safari installed on the remote Mac OS X host is earlier than 5.0.5.  As such, it is potentially affected by several issues :

  - An integer overflow issue in the handling of nodesets     could lead to a crash or arbitrary code execution.
    (CVE-2011-1290)

  - A use-after-free issue in the handling of text nodes     could lead to a crash or arbitrary code execution.
    (CVE-2011-1344)

Several vulnerabilities were discovered in the Chromium browser. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2011-0779     Google Chrome before 9.0.597.84 does not properly handle     a missing key in an extension, which allows remote     attackers to cause a denial of service (application     crash) via a crafted extension.

  - CVE-2011-1290     Integer overflow in WebKit allows remote attackers to     execute arbitrary code via unknown vectors, as     demonstrated by Vincenzo Iozzo, Willem Pinckaers, and     Ralf-Philipp Weinmann during a Pwn2Own competition at     CanSecWest 2011.

Versions of Google Chrome earlier than 10.0.648.133 are potentially affected by a memory corruption vulnerability in style handling.  By tricking a user into opening a specially crafted web page, a remote unauthenticated attacker could execute arbitrary script code on the host subject to the privileges of the user running the affected application.

The version of Google Chrome installed on the remote host is earlier than 10.0.648.133.  Such versions are reportedly affected by a memory corruption vulnerability in style handling.

By tricking a user into opening a specially crafted web page, a remote unauthenticated attacker could execute arbitrary script code on the host subject to the privileges of the user running the affected application.

The remote host has Safari installed.

Versions of Safari earlier than 5.0.5 are potentially affected by several issues in the following component :

  - WebKit

The remote host has Safari installed. 

Versions of Safari earlier than 5.0.5 are potentially affected by several issues in the following component :

  - WebKit

ID	Name	Product	Family	Severity
64202	SuSE 11.2 Security Update : libwebkit (SAT Patch Number 7114)	Nessus	SuSE Local Security Checks	critical
5894	iTunes < 10.2.2 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
53489	Apple iTunes < 10.2.2 Multiple Vulnerabilities (uncredentialed check)	Nessus	Peer-To-Peer File Sharing	high
53488	Apple iTunes < 10.2.2 Multiple (credentialed check)	Nessus	Windows	high
5889	Apple iOS 4.2.5 and 4.2.6 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	critical
5888	Apple iOS < 4.3.2 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	critical
53411	Safari < 5.0.5 Multiple Vulnerabilities	Nessus	Windows	high
53410	Mac OS X : Apple Safari < 5.0.5	Nessus	MacOS X Local Security Checks	high
52674	Debian DSA-2192-1 : chromium-browser - several vulnerabilities	Nessus	Debian Local Security Checks	critical
800907	Google Chrome < 10.0.648.133 Code Execution Vulnerability	Log Correlation Engine	Web Clients	high
5818	Google Chrome < 10.0.648.133 Code Execution	Nessus Network Monitor	Web Clients	high
52657	Google Chrome < 10.0.648.133 Code Execution	Nessus	Windows	high
801002	Safari < 5.0.5 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
5890	Safari < 5.0.5 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
51069	FreeBSD : chromium -- multiple vulnerabilities (6887828f-0229-11e0-b84d-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2011-1290

critical

Tenable Plugins

critical

high

high

high

critical

critical

high

high

critical

high

high

high

high

high

critical