Design/Logic Flaw

CFNetwork in Apple Safari before 4.0 on Windows does not properly protect the temporary files created for downloads, which allows local users to obtain sensitive information by reading these files...

CVE-2009-1704

CFNetwork in Apple Safari before 4.0 misinterprets downloaded image files as local HTML documents in unspecified circumstances, which allows remote attackers to execute arbitrary JavaScript code by placing it in an image file...

Code injection

CFNetwork in Apple Safari before 4.0 misinterprets downloaded image files as local HTML documents in unspecified circumstances, which allows remote attackers to execute arbitrary JavaScript code by placing it in an image file...

CVE-2009-1704

CVE-2009-1704 affects Apple Safari (pre-4.0) with CFNetwork/WebKit handling of downloaded image files. The vulnerability arises when Safari misinterprets certain image files as local HTML documents, causing embedded JavaScript to run in the local security context and potentially enabling remote c...

CVE-2009-1704

CFNetwork in Apple Safari before 4.0 misinterprets downloaded image files as local HTML documents in unspecified circumstances, which allows remote attackers to execute arbitrary JavaScript code by placing it in an image file...

CVE-2009-1716: Undefined Security Weakness

CFNetwork in Apple Safari before 4.0 on Windows does not properly protect the temporary files created for downloads, which allows local users to obtain sensitive information by reading these files...

CVE-2009-1704: Improper Control of Generation of Code

CFNetwork in Apple Safari before 4.0 misinterprets downloaded image files as local HTML documents in unspecified circumstances, which allows remote attackers to execute arbitrary JavaScript code by placing it in an image file...

Safari < 4.0 Multiple Vulnerabilities

The version of Safari installed on the remote Windows host is earlier than 4.0. It therefore is potentially affected by numerous issues in the following components : - CFNetwork - CoreGraphics - ImageIO - International Components for Unicode - libxml - Safari - Safari Windows Installer - WebKit C...

n.runs-SA-2009.001 - OS X CFNetwork advisory

n.runs AG http://www.nruns.com/ securityatnruns.com n.runs-SA-2009.001 15-May-2009 Vendor: Apple Inc., http://www.apple.com Affected Products: Mac OS X 10.5.6 Vulnerability: Heap-based buffer overflow in CFNetwork component remote Risk: HIGH Vendor communication: 2009/04/17 Initial notification o...

Heap overflow

Heap-based buffer overflow in CFNetwork in Apple Mac OS X 10.5 before 10.5.7 allows remote web servers to execute arbitrary code or cause a denial of service application crash via long HTTP headers...

Design/Logic Flaw

CFNetwork in Apple Mac OS X 10.5 before 10.5.7 does not properly parse noncompliant Set-Cookie headers, which allows remote attackers to obtain sensitive information by sniffing the network for "secure cookies" that are sent over unencrypted HTTP connections...

CVE-2009-0157

Heap-based buffer overflow in CFNetwork in Apple Mac OS X 10.5 before 10.5.7 allows remote web servers to execute arbitrary code or cause a denial of service application crash via long HTTP headers...

CVE-2009-0144

CFNetwork in Apple Mac OS X 10.5 before 10.5.7 does not properly parse noncompliant Set-Cookie headers, which allows remote attackers to obtain sensitive information by sniffing the network for "secure cookies" that are sent over unencrypted HTTP connections...

CVE-2009-0157

CVE-2009-0157 is a heap-based buffer overflow in Mac OS X 10.5’s CFNetwork that can be triggered by overly long HTTP headers from a remote web server. The vulnerability allows remote code execution or an application crash when visiting a crafted site, due to a flaw in CFNetwork’s HTTP header hand...

CVE-2009-0144

CFNetwork in Apple Mac OS X 10.5 before 10.5.7 does not properly parse noncompliant Set-Cookie headers, which allows remote attackers to obtain sensitive information by sniffing the network for "secure cookies" that are sent over unencrypted HTTP connections...

CVE-2009-0144

CVE-2009-0144 concerns CFNetwork in Apple Mac OS X 10.5.x (before 10.5.7). The issue arises from improper parsing of noncompliant Set-Cookie headers, which may cause certain cookies (including sensitive ones) to be sent over unencrypted HTTP connections. Affected: Mac OS X 10.5 through 10.5.6 (se...

CVE-2009-0157

Heap-based buffer overflow in CFNetwork in Apple Mac OS X 10.5 before 10.5.7 allows remote web servers to execute arbitrary code or cause a denial of service application crash via long HTTP headers...

CVE-2009-0157: Improper Restriction of Operations within the Bounds of a Memory Buffer

Heap-based buffer overflow in CFNetwork in Apple Mac OS X 10.5 before 10.5.7 allows remote web servers to execute arbitrary code or cause a denial of service application crash via long HTTP headers...

CVE-2009-0144: Undefined Security Weakness

CFNetwork in Apple Mac OS X 10.5 before 10.5.7 does not properly parse noncompliant Set-Cookie headers, which allows remote attackers to obtain sensitive information by sniffing the network for "secure cookies" that are sent over unencrypted HTTP connections...

Mac OS X 10.5.x < 10.5.7 Multiple Vulnerabilities

The remote host is running a version of Mac OS X 10.5.x that is prior to 10.5.7. Mac OS X 10.5.7 contains security fixes for the following products : - Apache - ATS - BIND - CFNetwork - CoreGraphics - Cscope - CUPS - Disk Images - enscript - Flash Player plug-in - Help Viewer - iChat -...