PT-2007-4773 · Apple · Safari

Published 2007-07-03 · Updated 2012-10-30 · CVE-2007-3514

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:N/C:C/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apple Safari for Windows version 3.0.2

Description A cross-domain issue allows remote attackers to bypass the Same Origin Policy, accessing restricted information from other domains. This is achieved via JavaScript that overwrites the document variable and sets the document.domain attribute to a file:// location.

Recommendations For Apple Safari for Windows version 3.0.2, consider disabling JavaScript execution from file:// locations as a temporary workaround until a patch is available. Restrict access to sensitive information to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2007-3514

Affected Products

Safari

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2007-3514 · Security Note
• http://osvdb.org/38861 · Note
• http://0x000000.com/?i=371 · Note