PT-2007-3733 · Apple · Safari

Ed Rowe + 2 · Published 2007-06-25 · Updated 2022-08-09 · CVE-2007-2400

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apple Safari versions 3 Beta through 3.0.2 Apple Safari on iPhone version prior to 1.0.1

Description The issue allows remote attackers to bypass the JavaScript security model and modify pages outside of the security domain, conducting cross-site scripting (XSS) attacks via vectors related to page updating and HTTP redirects.

Recommendations For Apple Safari versions 3 Beta through 3.0.2, update to version 3.0.2 or later to resolve the issue. For Apple Safari on iPhone version prior to 1.0.1, update to version 1.0.1 or later to resolve the issue.

Fix

XSS

Race Condition

Weakness Enumeration

CWE-79

CWE-362

Related Identifiers

CVE-2007-2400

Affected Products

Safari

References · 10

• http://vupen.com/english/advisories/2007/2731 · Vendor Advisory
• http://secunia.com/advisories/26287 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-2400 · Security Note
• http://vupen.com/english/advisories/2007/2316 · Vendor Advisory
• http://securitytracker.com/id?1018282 · Patch
• http://docs.info.apple.com/article.html?artnum=306173 · Vendor Advisory
• http://lists.apple.com/archives/Security-announce/2007/Jun/msg00004.html · Vendor Advisory
• http://securityfocus.com/bid/24599 · Patch
• http://osvdb.org/36452 · Note
• http://kb.cert.org/vuls/id/289988 · Note