{"id": "CVE-2006-0387", "bulletinFamily": "NVD", "title": "CVE-2006-0387", "description": "Stack-based buffer overflow in Safari in Mac OS X 10.4.5 and earlier, and 10.3.9 and earlier, allows remote attackers to execute arbitrary code via unspecified vectors involving a web page with crafted JavaScript, a different vulnerability than CVE-2005-4504.", "published": "2006-03-06T20:06:00", "modified": "2017-07-20T01:29:00", "cvss": {"score": 6.4, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:P"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-0387", "reporter": "cve@mitre.org", "references": ["http://secunia.com/advisories/19064", "http://lists.apple.com/archives/security-announce/2006/Mar/msg00000.html", "https://exchange.xforce.ibmcloud.com/vulnerabilities/25032", "http://www.vupen.com/english/advisories/2006/0791", "http://www.kb.cert.org/vuls/id/176732", "http://www.securityfocus.com/bid/16907", "http://www.us-cert.gov/cas/techalerts/TA06-062A.html", "http://docs.info.apple.com/article.html?artnum=303382", "http://securitytracker.com/id?1015713"], "cvelist": ["CVE-2006-0387"], "type": "cve", "lastseen": "2019-05-29T18:08:30", "history": [], "edition": 1, "hashmap": [{"key": "affectedSoftware", "hash": "3bac43dbce50ac5940cb4255693964d4"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "c3edfc0c8d0acb066e42d0b1d2a15b10"}, {"key": "cpe23", "hash": "c95c9cc402c0c467bc8140a638fa4c9b"}, {"key": "cvelist", "hash": "96d125c53c8803351d1b766190c10318"}, {"key": "cvss", "hash": "2004c9f19f804139a2bd4b20151bd451"}, {"key": "cvss2", "hash": "1dc2f667d36e0cf0a1d1984879d6264c"}, {"key": "cvss3", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cwe", "hash": "78a7a5cbaf09985c14389298e454e7db"}, {"key": "description", "hash": "16b03575b4fe50b253981af960e7e012"}, {"key": "href", "hash": "455a6fc571b85cac1b633f2750c8bdfc"}, {"key": "modified", "hash": "8beb21540db0e4c02532c0e597356857"}, {"key": "published", "hash": "5887224bb224dcbe09e6f02da80bc05a"}, {"key": "references", "hash": "de968133acba7dbe4a2e108df39cd76f"}, {"key": "reporter", "hash": "444c2b4dda4a55437faa8bef1a141e84"}, {"key": "title", "hash": "06e276ce1fbb72f3ae23a1dd84ff9adf"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "351818219e612e59e803847d7a53b21e5ad7d7d32f2a0542fb7fadb14a7f2d96", "viewCount": 0, "enchantments": {"dependencies": {"references": [{"type": "osvdb", "idList": ["OSVDB:23637"]}, {"type": "cert", "idList": ["VU:176732"]}, {"type": "nessus", "idList": ["MACOSX_SECUPD2006-001.NASL"]}], "modified": "2019-05-29T18:08:30"}, "score": {"value": 7.6, "vector": "NONE", "modified": "2019-05-29T18:08:30"}, "vulnersScore": 7.6}, "objectVersion": "1.3", "cpe": ["cpe:/o:apple:mac_os_x:10.3.4", "cpe:/o:apple:mac_os_x:10.3", "cpe:/o:apple:mac_os_x:10.3.3", "cpe:/o:apple:mac_os_x_server:10.3.8", "cpe:/o:apple:mac_os_x:10.4.3", "cpe:/o:apple:mac_os_x:10.3.7", "cpe:/o:apple:mac_os_x_server:10.3.7", "cpe:/o:apple:mac_os_x_server:10.3.1", "cpe:/a:apple:mac_os_x_server:10.3.9", "cpe:/o:apple:mac_os_x_server:10.4.5", "cpe:/a:apple:mac_os_x:10.4.2", "cpe:/o:apple:mac_os_x_server:10.4.2", "cpe:/o:apple:mac_os_x:10.3.8", "cpe:/o:apple:mac_os_x:10.4", "cpe:/a:apple:mac_os_x_server:10.4.2", "cpe:/a:apple:mac_os_x_server:10.3.6", "cpe:/a:apple:mac_os_x:10.4", "cpe:/a:apple:mac_os_x_server:10.3.7", "cpe:/a:apple:mac_os_x:10.3.1", "cpe:/a:apple:mac_os_x:10.3.4", "cpe:/a:apple:mac_os_x:10.4.3", "cpe:/a:apple:mac_os_x_server:10.3", "cpe:/a:apple:mac_os_x:10.3", "cpe:/a:apple:mac_os_x_server:10.3.8", "cpe:/o:apple:mac_os_x_server:10.3.4", "cpe:/o:apple:mac_os_x_server:10.4.4", "cpe:/a:apple:mac_os_x_server:10.4.3", "cpe:/a:apple:mac_os_x:10.3.8", "cpe:/a:apple:mac_os_x:10.3.2", "cpe:/a:apple:mac_os_x:10.3.3", "cpe:/a:apple:mac_os_x:10.4.1", "cpe:/o:apple:mac_os_x:10.3.2", "cpe:/o:apple:mac_os_x_server:10.4.1", "cpe:/a:apple:mac_os_x:10.3.5", "cpe:/o:apple:mac_os_x_server:10.3.6", "cpe:/a:apple:mac_os_x_server:10.4", "cpe:/o:apple:mac_os_x:10.3.9", "cpe:/a:apple:mac_os_x_server:10.3.5", "cpe:/a:apple:mac_os_x_server:10.3.1", "cpe:/o:apple:mac_os_x:10.4.1", "cpe:/o:apple:mac_os_x_server:10.3.2", "cpe:/o:apple:mac_os_x:10.4.2", "cpe:/a:apple:mac_os_x:10.3.6", "cpe:/a:apple:mac_os_x:10.4.4", "cpe:/a:apple:mac_os_x:10.3.9", "cpe:/o:apple:mac_os_x:10.3.1", "cpe:/o:apple:mac_os_x_server:10.3.9", "cpe:/o:apple:mac_os_x_server:10.3", "cpe:/a:apple:mac_os_x_server:10.3.2", "cpe:/o:apple:mac_os_x_server:10.4.3", "cpe:/o:apple:mac_os_x:10.3.6", "cpe:/a:apple:mac_os_x:10.4.5", "cpe:/a:apple:mac_os_x_server:10.4.5", "cpe:/o:apple:mac_os_x_server:10.3.5", "cpe:/a:apple:mac_os_x_server:10.4.4", "cpe:/a:apple:mac_os_x_server:10.4.1", "cpe:/o:apple:mac_os_x_server:10.3.3", "cpe:/o:apple:mac_os_x_server:10.4", "cpe:/a:apple:mac_os_x:10.3.7", "cpe:/o:apple:mac_os_x:10.3.5", "cpe:/o:apple:mac_os_x:10.4.5", "cpe:/o:apple:mac_os_x:10.4.4", "cpe:/a:apple:mac_os_x_server:10.3.3", "cpe:/a:apple:mac_os_x_server:10.3.4"], "affectedSoftware": [{"name": "apple mac_os_x_server", "operator": "eq", "version": "10.3.4"}, {"name": "apple mac_os_x_server", "operator": "eq", "version": "10.4.5"}, {"name": "apple mac_os_x", "operator": "eq", "version": "10.3.8"}, {"name": "apple mac_os_x", "operator": "eq", "version": "10.3.2"}, {"name": "apple mac_os_x", "operator": "eq", "version": "10.4"}, {"name": "apple mac_os_x_server", "operator": "eq", "version": "10.4.3"}, {"name": "apple mac_os_x_server", "operator": "eq", "version": "10.4.2"}, {"name": "apple mac_os_x_server", "operator": "eq", "version": "10.3.6"}, {"name": "apple mac_os_x", "operator": "eq", "version": "10.3"}, {"name": "apple mac_os_x", "operator": "eq", "version": "10.3.1"}, {"name": "apple mac_os_x", "operator": "eq", "version": "10.4.5"}, {"name": "apple mac_os_x_server", "operator": "eq", "version": "10.3.5"}, {"name": "apple mac_os_x_server", "operator": "eq", "version": "10.4"}, {"name": "apple mac_os_x_server", "operator": "eq", "version": "10.3"}, {"name": "apple mac_os_x_server", "operator": "eq", "version": "10.4.1"}, {"name": "apple mac_os_x", "operator": "eq", "version": "10.4.4"}, {"name": "apple mac_os_x_server", "operator": "eq", "version": "10.3.8"}, {"name": "apple mac_os_x", "operator": "eq", "version": "10.3.7"}, {"name": "apple mac_os_x_server", "operator": "eq", "version": "10.3.3"}, {"name": "apple mac_os_x", "operator": "eq", "version": "10.3.6"}, {"name": "apple mac_os_x", "operator": "eq", "version": "10.3.5"}, {"name": "apple mac_os_x", "operator": "eq", "version": "10.3.4"}, {"name": "apple mac_os_x_server", "operator": "eq", "version": "10.3.7"}, {"name": "apple mac_os_x_server", "operator": "eq", "version": "10.4.4"}, {"name": "apple mac_os_x", "operator": "eq", "version": "10.4.2"}, {"name": "apple mac_os_x", "operator": "eq", "version": "10.4.1"}, {"name": "apple mac_os_x_server", "operator": "eq", "version": "10.3.1"}, {"name": "apple mac_os_x", "operator": "eq", "version": "10.4.3"}, {"name": "apple mac_os_x_server", "operator": "eq", "version": "10.3.9"}, {"name": "apple mac_os_x", "operator": "eq", "version": "10.3.9"}, {"name": "apple mac_os_x", "operator": "eq", "version": "10.3.3"}, {"name": "apple mac_os_x_server", "operator": "eq", "version": "10.3.2"}], "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.4, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false}, "cvss3": {}, "cpe23": ["cpe:2.3:o:apple:mac_os_x_server:10.4.5:*:*:*:*:*:*:*", "cpe:2.3:o:apple:mac_os_x_server:10.3:*:*:*:*:*:*:*", "cpe:2.3:o:apple:mac_os_x_server:10.3.5:*:*:*:*:*:*:*", "cpe:2.3:o:apple:mac_os_x:10.4.5:*:*:*:*:*:*:*", "cpe:2.3:o:apple:mac_os_x_server:10.4.2:*:*:*:*:*:*:*", "cpe:2.3:o:apple:mac_os_x_server:10.3.8:*:*:*:*:*:*:*", "cpe:2.3:o:apple:mac_os_x:10.3.2:*:*:*:*:*:*:*", "cpe:2.3:o:apple:mac_os_x_server:10.4:*:*:*:*:*:*:*", "cpe:2.3:o:apple:mac_os_x_server:10.3.1:*:*:*:*:*:*:*", "cpe:2.3:o:apple:mac_os_x:10.3.3:*:*:*:*:*:*:*", "cpe:2.3:o:apple:mac_os_x:10.4.2:*:*:*:*:*:*:*", "cpe:2.3:o:apple:mac_os_x:10.3.7:*:*:*:*:*:*:*", "cpe:2.3:o:apple:mac_os_x:10.3.4:*:*:*:*:*:*:*", "cpe:2.3:o:apple:mac_os_x:10.3:*:*:*:*:*:*:*", "cpe:2.3:o:apple:mac_os_x_server:10.4.3:*:*:*:*:*:*:*", "cpe:2.3:o:apple:mac_os_x_server:10.3.3:*:*:*:*:*:*:*", "cpe:2.3:o:apple:mac_os_x:10.3.5:*:*:*:*:*:*:*", "cpe:2.3:o:apple:mac_os_x:10.4.1:*:*:*:*:*:*:*", "cpe:2.3:o:apple:mac_os_x_server:10.4.4:*:*:*:*:*:*:*", "cpe:2.3:o:apple:mac_os_x_server:10.4.1:*:*:*:*:*:*:*", "cpe:2.3:o:apple:mac_os_x:10.4:*:*:*:*:*:*:*", "cpe:2.3:o:apple:mac_os_x_server:10.3.9:*:*:*:*:*:*:*", "cpe:2.3:o:apple:mac_os_x:10.4.4:*:*:*:*:*:*:*", "cpe:2.3:o:apple:mac_os_x:10.3.1:*:*:*:*:*:*:*", "cpe:2.3:o:apple:mac_os_x_server:10.3.7:*:*:*:*:*:*:*", "cpe:2.3:o:apple:mac_os_x:10.3.9:*:*:*:*:*:*:*", "cpe:2.3:o:apple:mac_os_x:10.3.8:*:*:*:*:*:*:*", "cpe:2.3:o:apple:mac_os_x_server:10.3.4:*:*:*:*:*:*:*", "cpe:2.3:o:apple:mac_os_x:10.4.3:*:*:*:*:*:*:*", "cpe:2.3:o:apple:mac_os_x_server:10.3.2:*:*:*:*:*:*:*", "cpe:2.3:o:apple:mac_os_x:10.3.6:*:*:*:*:*:*:*", "cpe:2.3:o:apple:mac_os_x_server:10.3.6:*:*:*:*:*:*:*"], "cwe": ["NVD-CWE-Other"]}

{"osvdb": [{"lastseen": "2017-04-28T13:20:20", "bulletinFamily": "software", "description": "## Solution Description\nCurrently, there are no known workarounds or upgrades to correct this issue. However, Apple has released a patch (2006-001) to address this vulnerability.\n## References:\n[Vendor Specific Advisory URL](http://docs.info.apple.com/article.html?artnum=303382)\nSecurity Tracker: 1015713\n[Secunia Advisory ID:19064](https://secuniaresearch.flexerasoftware.com/advisories/19064/)\n[Related OSVDB ID: 23639](https://vulners.com/osvdb/OSVDB:23639)\n[Related OSVDB ID: 23646](https://vulners.com/osvdb/OSVDB:23646)\n[Related OSVDB ID: 23636](https://vulners.com/osvdb/OSVDB:23636)\n[Related OSVDB ID: 23640](https://vulners.com/osvdb/OSVDB:23640)\n[Related OSVDB ID: 23641](https://vulners.com/osvdb/OSVDB:23641)\n[Related OSVDB ID: 23642](https://vulners.com/osvdb/OSVDB:23642)\n[Related OSVDB ID: 23643](https://vulners.com/osvdb/OSVDB:23643)\n[Related OSVDB ID: 23648](https://vulners.com/osvdb/OSVDB:23648)\n[Related OSVDB ID: 23649](https://vulners.com/osvdb/OSVDB:23649)\n[Related OSVDB ID: 23638](https://vulners.com/osvdb/OSVDB:23638)\n[Related OSVDB ID: 23644](https://vulners.com/osvdb/OSVDB:23644)\n[Related OSVDB ID: 23645](https://vulners.com/osvdb/OSVDB:23645)\n[Related OSVDB ID: 23647](https://vulners.com/osvdb/OSVDB:23647)\nNews Article: http://www.informationweek.com/news/showArticle.jhtml;?articleID=181500394\n[CVE-2006-0387](https://vulners.com/cve/CVE-2006-0387)\n", "modified": "2006-02-28T06:02:40", "published": "2006-02-28T06:02:40", "href": "https://vulners.com/osvdb/OSVDB:23637", "id": "OSVDB:23637", "title": "Apple Safari JavaScript Processing Unspecified Overflow", "type": "osvdb", "cvss": {"score": 6.4, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:PARTIAL/"}}], "cert": [{"lastseen": "2019-10-09T19:51:39", "bulletinFamily": "info", "description": "### Overview \n\nApple Safari is vulnerable to a stack-based buffer overflow. This may allow a remote attacker to execute arbitrary code on a vulnerable system.\n\n### Description \n\n**Safari **\n\nApple [Safari](<http://www.apple.com/safari/>) is a web browser that comes with the [Mac OS X](<http://www.apple.com/macosx/>) operating system. \n \n**The Problem** \n \nApple Safari contains a stack-based buffer overflow. This vulnerability can be triggered by persuading a user to access a web page containing specially crafted JavaScript with Safari. \n \n--- \n \n### Impact \n\nA remote attacker may be able to execute arbitrary code on a vulnerable system. \n \n--- \n \n### Solution \n\n**Install an update**\n\nThis issue is corrected in [Apple Security Update 2006-001](<http://docs.info.apple.com/article.html?artnum=303382>). \n \n--- \n \n**Disable JavaScript in Safari**\n\n \nFor instructions on how to disable JavaScript in Safari, please refer to the Safari section of the [Securing Your Web Browser](<http://www.us-cert.gov/reading_room/securing_browser/#Safari>) document. \n \n--- \n \n### Vendor Information\n\n176732\n\nFilter by status: All Affected Not Affected Unknown\n\nFilter by content: __ Vendor has issued information\n\n__ Sort by: Status Alphabetical\n\nExpand all\n\n__ Affected __ Unknown __ Unaffected \n\n**Javascript is disabled. Click here to view vendors.**\n\n### __ Apple Computer, Inc.\n\nUpdated: March 03, 2006 \n\n### Status\n\n__ Vulnerable\n\n### Vendor Statement\n\nNo statement is currently available from the vendor regarding this vulnerability.\n\n### Vendor Information\n\nThe vendor has not provided us with any further information regarding this vulnerability.\n\n### Addendum\n\nSee <http://docs.info.apple.com/article.html?artnum=303382>.\n\nIf you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:cert@cert.org?Subject=VU%23176732 Feedback>).\n\n \n\n\n### CVSS Metrics \n\nGroup | Score | Vector \n---|---|--- \nBase | N/A | N/A \nTemporal | N/A | N/A \nEnvironmental | | N/A \n \n \n\n\n### References \n\n * <http://docs.info.apple.com/article.html?artnum=303382>\n * <http://secunia.com/advisories/19064/>\n\n### Acknowledgements\n\nThis issue was reported in Apple Security Update 2006-001. \n\nThis document was written by Jeff Gennari\n\n### Other Information\n\n**CVE IDs:** | [CVE-2006-0387](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-0387>) \n---|--- \n**Severity Metric:****** | 17.21 \n**Date Public:** | 2006-03-02 \n**Date First Published:** | 2006-03-03 \n**Date Last Updated: ** | 2006-03-03 15:02 UTC \n**Document Revision: ** | 10 \n", "modified": "2006-03-03T15:02:00", "published": "2006-03-03T00:00:00", "id": "VU:176732", "href": "https://www.kb.cert.org/vuls/id/176732", "type": "cert", "title": "Apple Safari vulnerable to buffer overflow", "cvss": {"score": 6.4, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:P"}}], "nessus": [{"lastseen": "2019-11-01T02:50:04", "bulletinFamily": "scanner", "description": "The remote host is running Apple Mac OS X, but lacks\nSecurity Update 2006-001.\n\nThis security update contains fixes for the following\napplications :\n\napache_mod_php\nautomount\nBom\nDirectory Services\niChat\nIPSec\nLaunchServices\nLibSystem\nloginwindow\nMail\nrsync\nSafari\nSyndication", "modified": "2019-11-02T00:00:00", "id": "MACOSX_SECUPD2006-001.NASL", "href": "https://www.tenable.com/plugins/nessus/20990", "published": "2006-03-02T00:00:00", "title": "Mac OS X Multiple Vulnerabilities (Security Update 2006-001)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(20990);\n script_version(\"1.23\");\n script_cvs_date(\"Date: 2018/07/14 1:59:35\");\n\n script_cve_id(\"CVE-2005-2713\", \"CVE-2005-2714\", \"CVE-2005-3319\", \"CVE-2005-3353\", \"CVE-2005-3391\",\n \"CVE-2005-3392\", \"CVE-2005-3706\", \"CVE-2005-3712\", \"CVE-2005-4217\", \"CVE-2005-4504\",\n \"CVE-2006-0383\", \"CVE-2006-0384\", \"CVE-2006-0386\", \"CVE-2006-0387\", \"CVE-2006-0388\",\n \"CVE-2006-0389\", \"CVE-2006-0391\", \"CVE-2006-0395\", \"CVE-2006-0848\");\n script_bugtraq_id(16736, 16907);\n\n script_name(english:\"Mac OS X Multiple Vulnerabilities (Security Update 2006-001)\");\n script_summary(english:\"Check for Security Update 2006-001\");\n\n script_set_attribute(attribute:\"synopsis\", value:\"The remote operating system is missing a vendor-supplied patch.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote host is running Apple Mac OS X, but lacks\nSecurity Update 2006-001.\n\nThis security update contains fixes for the following\napplications :\n\napache_mod_php\nautomount\nBom\nDirectory Services\niChat\nIPSec\nLaunchServices\nLibSystem\nloginwindow\nMail\nrsync\nSafari\nSyndication\");\n script_set_attribute(attribute:\"see_also\", value:\"http://docs.info.apple.com/article.html?artnum=303382\");\n script_set_attribute(attribute:\"solution\", value:\n\"Mac OS X 10.4 :\nhttp://www.apple.com/support/downloads/securityupdate2006001macosx1045ppc.html\nhttp://www.apple.com/support/downloads/securityupdate2006001macosx1045intel.html\n\nMac OS X 10.3 :\nhttp://www.apple.com/support/downloads/securityupdate20060011039client.html\nhttp://www.apple.com/support/downloads/securityupdate20060011039server.html\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Safari Archive Metadata Command Execution');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2005/12/21\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2006/03/03\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2006/03/02\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:apple:mac_os_x\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2006-2018 Tenable Network Security, Inc.\");\n script_family(english:\"MacOS X Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/MacOSX/packages\");\n exit(0);\n}\n\n\npackages = get_kb_item(\"Host/MacOSX/packages\");\nif ( ! packages ) exit(0);\n\n\nuname = get_kb_item(\"Host/uname\");\nif ( egrep(pattern:\"Darwin.* (7\\.[0-9]\\.|8\\.[0-5]\\.)\", string:uname) )\n{\n if (!egrep(pattern:\"^SecUpd(Srvr)?(2006-00[123467]|2007-003)\", string:packages)) security_hole(0);\n}\n", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}]}