PT-2011-4324 · Apple · Safari

Jason Broccardo · Published 2011-10-14 · Updated 2017-08-29 · CVE-2011-3231

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apple Safari versions prior to 5.1.1

Description The issue concerns the SSL implementation in Apple Safari, which accesses uninitialized memory when processing X.509 certificates. This allows remote web servers to execute arbitrary code via a crafted certificate.

Recommendations For Apple Safari versions prior to 5.1.1, update to version 5.1.1 or later to resolve the issue.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2011-3231

Affected Products

Safari

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2011-3231 · Security Note
• http://lists.apple.com/archives/Security-announce/2011//Oct/msg00004.html · Vendor Advisory
• http://support.apple.com/kb/HT5000 · Vendor Advisory
• http://osvdb.org/76390 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/70568 · Note