A large number of security issues were discovered in the WebKit browser and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary code execution.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Safari installed on the remote host reportedly is affected by several issues :

  - Two unspecified errors exist that can allow malicious     sites to perform cross-site scripting attacks.
    (CVE-2011-3046, CVE-2011-3056)

  - An unspecified memory corruption error exists that can     allow malicious sites to crash the application or     potentially execute arbitrary code. (CVE-2012-0672)

  - A state-tracking issue exists that can allow malicious     sites to populate HTML form values of other sites with     arbitrary data. (CVE-2012-0676)

The version of Apple iTunes on the remote Windows host is prior to version 10.6.3. It is, therefore, affected by the following vulnerabilities :

  - A memory corruption vulnerability exists in the WebKit     component. By using a specially crafted website, an     attacker can exploit this to cause a denial of service     or execute arbitrary code. Note that this vulnerability     was addressed on Mac OS X systems by an update for     Safari and, therefore, may not necessarily affect the     remote host. (CVE-2012-0672)

  - Stack and heap based buffer overflow errors exist in     the handling of 'm3u' playlist files. An attacker can     exploit these to cause a denial of service or execute     arbitrary code. (CVE-2012-0677)

The version of Apple Safari installed on the remote Mac OS X host is earlier than 5.1.7.  It is, therefore, potentially affected by several issues :

   - Two unspecified errors exist that can allow malicious     sites to perform cross-site scripting attacks.
    (CVE-2011-3046, CVE-2011-3056)

  - An unspecified memory corruption error exists that can     allow malicious sites to crash the application or     potentially execute arbitrary code. (CVE-2012-0672)

  - A state-tracking issue exists that can allow malicious     sites to populate HTML form values of other sites with     arbitrary data. (CVE-2012-0676)

The version of Apple iTunes installed on the remote Windows host is older than 10.6.3 and is, therefore, affected by the following issues :

  - A memory corruption issue exists in WebKit that can     allow malicious websites to crash the application and     possibly to execute arbitrary code. (CVE-2012-0672)

  - Stack and heap based buffer overflow errors related to     the handling of 'm3u' playlist files. These errors can     cause the application to crash or possibly allow     arbitrary code execution. (CVE-2012-0677)

The mobile device is running a version of iOS that is older than version 5.1.1.  Version 5.1.1 contains numerous security-related fixes for the following vulnerabilities :

  - Attackers can use a vulnerability in WebKit to perform     cross-site scripting attacks, possibly leaking data such     as cookies, user information, and passwords.
    (CVE-2011-3046, CVE-2011-3056)

  - A remote code execution vulnerability in WebKit could     allow a malicious site to run code on the host iOS     device giving the attacker access to critical data on     the phone.(CVE-2012-0672)

  - Vulnerabilities in Safari can allow malicious sites to     spoof the address in the address bar of the browser.
    This attack allows an attacker to redirect victims to a     malicious site without the user's ability to notice.
    (CVE-2012-0674)

The remote host has iTunes installed, a popular media player for Windows and Mac OS. 

Versions of iTunes earlier than 10.6.3 are reportedly affected by the following issues:

  - A memory corruption issue exists in WebKit that can allow malicious websites to crash the application and possibly execute arbitrary code. (CVE-2012-0672)

  - A heap-based buffer overflow exists related to the handling of 'm3u' playlist files. This error can cause the application to crash or possibly allow arbitrary code execution. (CVE-2012-0677)


The remote host has Safari installed. 

Versions of Safari earlier than 5.1.7 are reportedly affected by several issues :

  - Two unspecified errors that can allow malicious sites to perform cross-site scripting attacks. (CVE-2011-3046, CVE-2011-3056)

  - An unspecified memory corruption error exists that can allows malicious sites to crash the application or potentially execute arbitrary code. (CVE-2012-0672)

  - A state-tracking issue exists that can allow malicious sites to populate HTML form values of other sites with arbitrary data. (CVE-2012-0676)


According to its banner, the remote Apple iOS device is missing a security update.  Versions of Apple iOS 3.0 through 5.1.0 are affected by vulnerabilities within the following components :

 - Safari
 - WebKit

The remote host has Safari installed. 

Versions of Safari earlier than 5.1.7 are reportedly affected by several issues :

  - Two unspecified errors that can allow malicious sites to perform cross-site scripting attacks. (CVE-2011-3046, CVE-2011-3056)

  - An unspecified memory corruption error exists that can allows malicious sites to crash the application or potentially execute arbitrary code. (CVE-2012-0672)

  - A state-tracking issue exists that can allow malicious sites to populate HTML form values of other sites with arbitrary data. (CVE-2012-0676)

ID	Name	Product	Family	Published	Updated	Severity
61458	Ubuntu 12.04 LTS : webkit vulnerabilities (USN-1524-1)	Nessus	Ubuntu Local Security Checks	8/9/2012	9/19/2019	critical
59069	Safari < 5.1.7 Multiple Vulnerabilities	Nessus	Windows	5/10/2012	7/27/2018	high
59498	Apple iTunes < 10.6.3 Multiple Vulnerabilities (uncredentialed check)	Nessus	Peer-To-Peer File Sharing	6/14/2012	7/12/2018	high
59068	Mac OS X : Apple Safari < 5.1.7 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	5/10/2012	7/14/2018	high
59497	Apple iTunes < 10.6.3 Multiple Vulnerabilities (credentialed check)	Nessus	Windows	6/14/2012	7/12/2018	high
60027	Apple iOS < 5.1.1 Multiple Vulnerabilities	Nessus	Mobile Devices	2/14/2012	12/30/2024	critical
6500	iTunes < 10.6.3 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	6/19/2012	3/6/2019	high
6483	Safari < 5.1.7 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	5/10/2012	3/6/2019	high
6481	Apple iOS < 5.1.1 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	5/8/2012	3/6/2019	high
800989	Safari < 5.1.7 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	5/10/2012		high

Detections

Analytics

Plugins Search

critical

high

high

high

high

critical

high

high

high

high