Design/Logic Flaw

2010-03-3018:30:00

PRIOn knowledge base

www.prio-n.com

7.4 High

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

70.6%

JSON

Incomplete blacklist vulnerability in CoreTypes in Apple Mac OS X before 10.6.3 makes it easier for user-assisted remote attackers to execute arbitrary JavaScript via a web page that offers a download with a Content-Type value that is not on the list of possibly unsafe content types for Safari, as demonstrated by the values for the (1) .ibplugin and (2) .url extensions.

CPENameOperatorVersion
mac_os_xeq10.5.8
mac_os_xeq10.5.6
mac_os_xeq10.5.5
mac_os_xeq10.5.1
mac_os_xeq10.5.3
mac_os_xeq10.5.0
mac_os_xeq10.5
mac_os_xeq10.5.2
mac_os_xle10.6.2
mac_os_xeq10.6.1

Name	Operator	Version
mac_os_x	eq	10.5.8
mac_os_x	eq	10.5.6
mac_os_x	eq	10.5.5
mac_os_x	eq	10.5.1
mac_os_x	eq	10.5.3
mac_os_x	eq	10.5.0
mac_os_x	eq	10.5
mac_os_x	eq	10.5.2
mac_os_x	le	10.6.2
mac_os_x	eq	10.6.1