Vincenzo Iozzo

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions 4.x through 10.0 Mozilla Firefox version 3.6.28 and earlier Firefox ESR 10.x versions prior to 10.0.3 Thunderbird versions 5.0 through 10.0 Thunderbird version 3.1.20 and earlier Thunderbird ESR 10.x versions prior to 10.0.3 SeaMonkey version 2.8 and earlier **Description** The issue allows remote attackers to execute arbitrary code via vectors involving an empty argument to the `array.join` function in conjunction with the triggering of garbage collection. **Recommendations** For Mozilla Firefox versions 4.x through 10.0, update to a version after 10.0. For Mozilla Firefox version 3.6.28 and earlier, update to a version after 3.6.28. For Firefox ESR 10.x versions prior to 10.0.3, update to version 10.0.3 or later. For Thunderbird versions 5.0 through 10.0, update to a version after 10.0. For Thunderbird version 3.1.20 and earlier, update to a version after 3.1.20. For Thunderbird ESR 10.x versions prior to 10.0.3, update to version 10.0.3 or later. For SeaMonkey version 2.8 and earlier, update to a version after 2.8.

**Name of the Vulnerable Software and Affected Versions** WebKit versions prior to the version used in Apple Safari 5.0.5 Google Chrome versions prior to 10.0.648.133 Apple Safari versions prior to 5.0.5 Research In Motion (RIM) BlackBerry Torch 9800 firmware version 6.0.0.246 **Description** The issue allows remote attackers to execute arbitrary code via unknown vectors related to CSS "style handling" and a length value. This was demonstrated by Vincenzo Iozzo, Willem Pinckaers, and Ralf-Philipp Weinmann during a Pwn2Own competition at CanSecWest 2011. The vulnerability is related to integer overflow in WebKit. **Recommendations** For WebKit versions prior to the version used in Apple Safari 5.0.5, update to a version used in Apple Safari 5.0.5 or later. For Google Chrome versions prior to 10.0.648.133, update to version 10.0.648.133 or later. For Apple Safari versions prior to 5.0.5, update to version 5.0.5 or later. For Research In Motion (RIM) BlackBerry Torch 9800 firmware version 6.0.0.246, consider disabling CSS style handling as a temporary workaround until a patch is available.

Use-after-free vulnerability in JavaScriptCore in WebKit in Apple iTunes before 9.2 on Windows, and Apple iOS before 4 on the iPhone and iPod touch, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to page transitions, a different vulnerability than CVE-2010-1763 and CVE-2010-1769.

**Name of the Vulnerable Software and Affected Versions** Apple Safari versions prior to 5.0 on Mac OS X 10.5 through 10.6 and Windows Apple Safari versions prior to 4.1 on Mac OS X 10.4 Safari on Apple iPhone OS (affected versions not specified) **Description** The issue allows remote attackers to execute arbitrary code, cause a denial of service, or read sensitive data, such as the SMS database, via vectors related to attribute manipulation. This was demonstrated by Vincenzo Iozzo and Ralf Philipp Weinmann during a Pwn2Own competition at CanSecWest 2010. **Recommendations** For Apple Safari versions prior to 5.0 on Mac OS X 10.5 through 10.6 and Windows, update to version 5.0 or later. For Apple Safari versions prior to 4.1 on Mac OS X 10.4, update to version 4.1 or later. For Safari on Apple iPhone OS, at the moment, there is no information about a newer version that contains a fix for this vulnerability.