PT-2007-3733 · Apple · Safari

Ed Rowe + 2 · Publicado 2007-06-25 · Atualizado 2022-08-09 · CVE-2007-2400

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apple Safari versions 3 Beta through 3.0.2 Apple Safari on iPhone version prior to 1.0.1

Description The issue allows remote attackers to bypass the JavaScript security model and modify pages outside of the security domain, conducting cross-site scripting (XSS) attacks via vectors related to page updating and HTTP redirects.

Recommendations For Apple Safari versions 3 Beta through 3.0.2, update to version 3.0.2 or later to resolve the issue. For Apple Safari on iPhone version prior to 1.0.1, update to version 1.0.1 or later to resolve the issue.

Correção

XSS

Race Condition

Enumeração de Fraquezas

CWE-79

CWE-362

Identificadores relacionados

CVE-2007-2400

Produtos afetados

Safari

Referências · 10

• http://vupen.com/english/advisories/2007/2731 · Aviso do Fabricante
• http://secunia.com/advisories/26287 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2007-2400 · Nota de Segurança
• http://vupen.com/english/advisories/2007/2316 · Aviso do Fabricante
• http://securitytracker.com/id?1018282 · Correção
• http://docs.info.apple.com/article.html?artnum=306173 · Aviso do Fabricante
• http://osvdb.org/36452 · Nota
• http://lists.apple.com/archives/Security-announce/2007/Jun/msg00004.html · Aviso do Fabricante
• http://securityfocus.com/bid/24599 · Correção
• http://kb.cert.org/vuls/id/289988 · Nota