PT-2012-1694 · Apple · Webkit+1

Published 2012-03-02 · Updated 2012-03-02 · CVE-2011-3443

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apple Safari versions prior to 5.0.6

Description The issue is related to a use-after-free vulnerability in WebKit, which can be exploited by remote attackers to execute arbitrary code or cause a denial of service. This is achieved through improper list management for Cascading Style Sheets (CSS) @font-face rules, leading to heap memory corruption and application crash.

Recommendations For versions prior to 5.0.6, update to version 5.0.6 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2011-3443

Affected Products

Safari

Webkit

References · 6

• https://ubuntu.com/security/CVE-2011-3443 · Vendor Advisory
• http://support.apple.com/kb/HT4808 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2011-3443 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2011-3443 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2011-3443 · Security Note
• http://verisigninc.com/products-and-services/network-intelligence-availability/idefense/public-vulnerability-reports/articles/index.xhtml?id=962 · Note