Use-after-free vulnerability in WebKit, as used in Apple Safari before 5.0.5; iOS before 4.3.2 for iPhone, iPod, and iPad; iOS before 4.2.7 for iPhone 4 (CDMA); and possibly other products allows remote attackers to execute arbitrary code by adding children to a WBR tag and then removing the tag, related to text nodes, as demonstrated by Chaouki Bekrar during a Pwn2Own competition at CanSecWest 2011.

Two issues in libwebkit have been fixed :

  - Webkit CSS Text Element Count remote code execution was     fixed. (CVE-2011-1290)

  - WebKit WBR Tag Removal remote code execution was fixed.
    (CVE-2011-1344)

The remote host has iTunes installed, a popular media player for Windows and Mac OS. 

Versions of iTunes earlier than 10.2.2 are potentially affected by several issues :

  - An integer overflow issue in the handling of nodesets could lead to a crash or arbitrary code execution. (CVE-2011-1290)

  - A use after free issue in the handling of text nodes could lead to a crash or arbitrary code execution. (CVE-2011-1344)

The version of Apple iTunes on the remote host is prior to version 10.2.2. It is, therefore, affected by multiple vulnerabilities in the WebKit component :

  - An integer overflow vulnerability exists in the handling     of nodesets that can be exploited by a remote attacker     to execute arbitrary code. (CVE-2011-1290)

  - A use-after-free vulnerability exists in the handling of     text nodes that can be exploited by a remote attacker to     execute arbitrary code. (CVE-2011-1344)

Note that these only affect WebKit for Windows.

The version of Apple iTunes installed on the remote Windows host is older than 10.2.2.  As such, it is potentially affected by several issues :

  - An integer overflow issue in the handling of nodesets     could lead to a crash or arbitrary code execution.
    (CVE-2011-1290)

  - A use after free issue in the handling of text nodes     could lead to a crash or arbitrary code execution.
    (CVE-2011-1344)

According to its banner, the remote Apple iOS device is missing a security update.  Versions of Apple iOS 4.2.5 or 4.2.6 are affected by vulnerabilities within the following components :

  - Certificate Trust Policy

  - QuickLook

  - WebKit

The remote mobile host is a using a version of Apple iOS earlier than 4.3.2. Such versions are potentially affected by multiple vulnerabilities. Apple iOS 4.3.2 contains security fixes for the following components :

  - Certificate Trust Policy

  - libxslt

  - QuickLook

  - WebKit

The version of Safari installed on the remote Windows host is earlier than 5.0.5.  It therefore is potentially affected by several issues :

  - An integer overflow issue in the handling of nodesets     could lead to a crash or arbitrary code execution.
    (CVE-2011-1290)

  - A use-after-free issue in the handling of text nodes     could lead to a crash or arbitrary code execution.
    (CVE-2011-1344)

The version of Apple Safari installed on the remote Mac OS X host is earlier than 5.0.5.  As such, it is potentially affected by several issues :

  - An integer overflow issue in the handling of nodesets     could lead to a crash or arbitrary code execution.
    (CVE-2011-1290)

  - A use-after-free issue in the handling of text nodes     could lead to a crash or arbitrary code execution.
    (CVE-2011-1344)

The remote host has Safari installed.

Versions of Safari earlier than 5.0.5 are potentially affected by several issues in the following component :

  - WebKit

The remote host has Safari installed. 

Versions of Safari earlier than 5.0.5 are potentially affected by several issues in the following component :

  - WebKit

ID	Name	Product	Family	Severity
64202	SuSE 11.2 Security Update : libwebkit (SAT Patch Number 7114)	Nessus	SuSE Local Security Checks	critical
5894	iTunes < 10.2.2 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
53489	Apple iTunes < 10.2.2 Multiple Vulnerabilities (uncredentialed check)	Nessus	Peer-To-Peer File Sharing	high
53488	Apple iTunes < 10.2.2 Multiple (credentialed check)	Nessus	Windows	high
5889	Apple iOS 4.2.5 and 4.2.6 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	critical
5888	Apple iOS < 4.3.2 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	critical
53411	Safari < 5.0.5 Multiple Vulnerabilities	Nessus	Windows	high
53410	Mac OS X : Apple Safari < 5.0.5	Nessus	MacOS X Local Security Checks	high
801002	Safari < 5.0.5 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
5890	Safari < 5.0.5 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high

Detections

Analytics

CVE-2011-1344

high

Tenable Plugins

critical

high

high

high

critical

critical

high

high

high

high