CVE-2008-2303

CVE-2008-2303 affects Safari on Apple iPhone before 2.0 and iPod touch before 2.0. It is caused by an integer signedness error in handling JavaScript array indices, which can trigger an out-of-bounds access. The result can be remote arbitrary code execution or a denial of service (application cra...

CVE-2008-1589

Safari on Apple iPhone before 2.0 and iPod touch before 2.0 misinterprets a menu button press as user confirmation for visiting a web site with a 1 self-signed or 2 invalid certificate, which makes it easier for remote attackers to spoof web sites...

PT-2008-3144 · Apple · Iphone +2

Name of the Vulnerable Software and Affected Versions: Safari versions prior to 2.0 on Apple iPhone and iPod touch Description: The issue allows remote attackers to spoof the address bar via Unicode ideographic spaces in the URL. Recommendations: For Safari versions prior to 2.0 on Apple iPhone a...

PT-2008-3146 · Apple · Javascriptcore +3

Name of the Vulnerable Software and Affected Versions: WebKit versions prior to 2.0 on Apple iPhone WebKit versions prior to 2.0 on iPod touch Description: The issue is related to improper runtime garbage collection in JavaScriptCore, which can lead to memory corruption. This can be exploited by...

PT-2008-3794 · Apple · Iphone +2

Name of the Vulnerable Software and Affected Versions: Safari versions prior to 2.0 on Apple iPhone Safari versions prior to 2.0 on iPod touch Description: The issue is related to an integer signedness error that can be triggered via JavaScript array indices, leading to an out-of-bounds access...

Apple iPhone和iPod Touch 2.0版修复多个安全漏洞

BUGTRAQ ID: 30186 CVECAN ID: CVE-2008-1588,CVE-2008-1589,CVE-2008-2303,CVE-2008-2317,CVE-2008-1590 iPod touch（也被称为iTouch）是苹果公司发布的MP4播放器，iPhone是其发布的智能手机。 iPhone和iPod Touch都内嵌了Safari浏览器，远程攻击者可以利用该浏览器中的多个安全漏洞导致拒绝服务、读取敏感信息或执行任意代码。 CVE-2008-1588...

PT-2008-3145 · Apple · Safari

Name of the Vulnerable Software and Affected Versions: Safari versions prior to 2.0 on Apple iPhone and iPod touch Description: The issue misinterprets a menu button press as user confirmation for visiting a web site with a self-signed or invalid certificate. This makes it easier for remote...

JVN#88676089 Safari installed in iPod touch and iPhone vulnerable in handling server certificates

Safari is a web browser provided by Apple. Safari installed in iPod touch and iPhone accepts a self-signed or invalid server cerficate without the user's explicit concent when connecting via SSL/TLS. According to Apple, "When Safari accesses a website that uses a self-signed or invalid certificat...

Apple iPhone Apple iPod Touch 2.0 - Multiple Remote Vulnerabilities

Apple iPhone Apple iPod Touch 2.0 - Multiple Remote Vulnerabilities source: https://www.securityfocus.com/bid/30186/info Apple iPhone and iPod touch are prone to multiple remote vulnerabilities: 1. A vulnerability that may allow users to spoof websites. 2. An information-disclosure vulnerability...

Multiple Vendor DNS Protocol Insufficient Transaction ID Randomization DNS Spoofing Vulnerability

Description Multiple vendors' implementations of the DNS protocol are prone to a DNS-spoofing vulnerability because the software fails to securely implement random values when performing DNS queries. Successfully exploiting this issue allows remote attackers to spoof DNS replies, allowing them to...

PT-2008-1163 · Apple +2 · Iphone +4

Name of the Vulnerable Software and Affected Versions: Apple iPod touch versions 1.1 through 2.0.2 Apple iPhone versions 1.0 through 2.0.2 Qt affected versions not specified Description: The issue is related to a use-after-free vulnerability in WebKit and an error in resource management in the Qt...

Apple Safari (webkit) Remote Denial of Service Exploit (iphone/osx/win)

No description provided by source. !-- Even though Georgi Guninski retired from the scene, his old code is still finding new bugs. iphone fw:1.1.4 : locks up safari win32 : crashes safari osx : crashes looped the x's on milw0rm to find the bug...

Apple Safari (webkit) (iPhoneOSXWindows) - Remote Denial of Service

Apple Safari webkit iPhoneOSXWindows - Remote Denial of Service Copyright Georgi Guninski Cannot be used in vulnerability databases Especially securityfocus/mitre/cve/cert var s=String.fromCharCode257; var ki=""; var me=""; fori=0;i milw0rm.com 2008-03-17...

Apple Safari (webkit) Remote Denial of Service Exploit (iphone/osx/win)

Exploit for multiple platform in category dos / poc ======================================================================= Apple Safari webkit Remote Denial of Service Exploit iphone/osx/win ======================================================================= Copyright Georgi Guninski Cannot ...

safariphone-dos.txt

Copyright Georgi Guninski Cannot be used in vulnerability databases Especially securityfocus/mitre/cve/cert var s=String.fromCharCode257; var ki=""; var me=""; fori=0;i...

Apple Safari (webkit) (iPhone/OSX/Windows) - Remote Denial of Service

Copyright Georgi Guninski Cannot be used in vulnerability databases Especially securityfocus/mitre/cve/cert var s=String.fromCharCode257; var ki=""; var me=""; fori=0;i milw0rm.com 2008-03-17...

Apple iPhone和iPod Touch Foundation参数内存破坏漏洞

BUGTRAQ ID: 27296 CVECAN ID: CVE-2008-0035 iPod touch（也被称为iTouch）是苹果公司发布的MP4播放器，iPhone是其发布的智能手机。 iPhone和iPod Touch所内嵌的Safari浏览器处理畸形URL时存在漏洞，远程攻击者可能利用此漏洞控制用户系统。 Safari浏览器没有正确地处理URL中的Foundation参数，如果用户受骗跟随了恶意链接的话，就可能触发内存破坏，导致浏览器崩溃或执行任意指令。 Apple iPhone 1.0 - 1.1.2 Apple iTouch 1.1 - 1.1.2 Apple -----...

CVE-2008-0729

Mobile Safari on Apple iPhone 1.1.2 and 1.1.3 allows remote attackers to cause a denial of service memory exhaustion and device crash via certain JavaScript code that constructs a long string and an array containing long string elements, possibly a related issue to CVE-2006-3677. NOTE: some of...

Design/Logic Flaw

Mobile Safari on Apple iPhone 1.1.2 and 1.1.3 allows remote attackers to cause a denial of service memory exhaustion and device crash via certain JavaScript code that constructs a long string and an array containing long string elements, possibly a related issue to CVE-2006-3677. NOTE: some of...

CVE-2008-0729

Technical details for CVE-2008-0729 are not publicly available in the provided documents. Connected records discuss related Mozilla/SeaMonkey CVEs (e.g., 2006-3677) but do not describe this CVE’s affected products, impact, or fix. Monitor for updates.