Eric Seidel

**Name of the Vulnerable Software and Affected Versions** WebKit versions prior to those used in Apple iOS 8 and Apple TV 7 WebKit, as used in Apple iTunes (affected versions not specified) **Description** The issue allows remote attackers to execute arbitrary code or cause a denial of service, resulting in memory corruption and application crash, via a crafted web site. This is a distinct issue from other WebKit vulnerabilities. **Recommendations** For WebKit versions prior to those used in Apple iOS 8 and Apple TV 7, update to the version used in Apple iOS 8 or Apple TV 7 or later. For WebKit, as used in Apple iTunes, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Safari versions prior to 5.0 on Mac OS X 10.5 through 10.6 Safari versions prior to 4.1 on Mac OS X 10.4 **Description** The issue arises from improper handling of clipboard operations for URLs, specifically drag and paste actions, allowing user-assisted remote attackers to read arbitrary files via a crafted HTML document. **Recommendations** For Safari versions prior to 5.0 on Mac OS X 10.5 through 10.6, update to version 5.0 or later to resolve the issue. For Safari versions prior to 4.1 on Mac OS X 10.4, update to version 4.1 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Apple Safari versions prior to 4.0 Description: The issue allows user-assisted remote attackers to obtain sensitive information via vectors involving drag events and the dragging of content over a crafted web page. Recommendations: For versions prior to 4.0, update to Apple Safari version 4.0 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Apple Safari versions prior to 3.1 **Description** A buffer overflow issue in WebKit, used by Apple Safari, allows remote attackers to execute arbitrary code via crafted regular expressions in JavaScript. **Recommendations** For versions prior to 3.1, update to version 3.1 or later to resolve the issue.