PT-2011-3075 · Apple+1 · Webkit+3
Publicado
2011-03-10
·
Atualizado
2022-08-09
·
CVE-2011-1344
CVSS v2.0
6.8
Média
| Vetor | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Apple Safari versions prior to 5.0.5
iOS versions prior to 4.3.2 for iPhone, iPod, and iPad
iOS versions prior to 4.2.7 for iPhone 4 (CDMA)
Description
The issue allows remote attackers to execute arbitrary code by exploiting a use-after-free vulnerability in WebKit. This can be achieved by adding children to a WBR tag and then removing the tag, related to text nodes. The vulnerability was demonstrated by Chaouki Bekrar during a Pwn2Own competition at CanSecWest 2011.
Recommendations
For Apple Safari versions prior to 5.0.5, update to version 5.0.5 or later.
For iOS versions prior to 4.3.2 for iPhone, iPod, and iPad, update to version 4.3.2 or later.
For iOS versions prior to 4.2.7 for iPhone 4 (CDMA), update to version 4.2.7 or later.
As a temporary workaround, consider restricting access to WebKit until a patch is available.
Correção
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Safari
Suse
Webkit
Ios