CVE-2007-2401

The CVE-2007-2401 entry concerns a CRLF injection in Apple’s WebCore XMLHttpRequest handling. Vulnerable: WebCore in Mac OS X 10.3.9, 10.4.9 and later, and iPhone prior to 1.0.1. Nature: remote attacker can inject arbitrary HTTP headers by sending LF characters in an XMLHttpRequest and exploiting...

CVE-2007-2401

CRLF injection vulnerability in WebCore in Apple Mac OS X 10.3.9, 10.4.9 and later, and iPhone before 1.0.1, allows remote attackers to inject arbitrary HTTP headers via LF characters in an XMLHttpRequest request, which are not filtered when serializing headers via the setRequestHeader function...

PT-2007-3732 · Apple · Iphone +2

Name of the Vulnerable Software and Affected Versions: Apple Mac OS X versions 10.3.9 through 10.4.9 Apple iPhone version prior to 1.0.1 Description: The issue allows remote attackers to execute arbitrary code via unspecified frame sets that trigger memory corruption due to an invalid type...

PT-2007-3733 · Apple · Safari

Name of the Vulnerable Software and Affected Versions: Apple Safari versions 3 Beta through 3.0.2 Apple Safari on iPhone version prior to 1.0.1 Description: The issue allows remote attackers to bypass the JavaScript security model and modify pages outside of the security domain, conducting...

CVE-2007-2399: Undefined Security Weakness

WebKit in Apple Mac OS X 10.3.9, 10.4.9 and later, and iPhone before 1.0.1 performs an "invalid type conversion", which allows remote attackers to execute arbitrary code via unspecified frame sets that trigger memory corruption...

CVE-2007-2400: Improper Neutralization of Input During Web Page Generation

Race condition in Apple Safari 3 Beta before 3.0.2 on Mac OS X, Windows XP, Windows Vista, and iPhone before 1.0.1, allows remote attackers to bypass the JavaScript security model and modify pages outside of the security domain and conduct cross-site scripting XSS attacks via vectors related to...

CVE-2007-2401: Improper Neutralization of Input During Web Page Generation

CRLF injection vulnerability in WebCore in Apple Mac OS X 10.3.9, 10.4.9 and later, and iPhone before 1.0.1, allows remote attackers to inject arbitrary HTTP headers via LF characters in an XMLHttpRequest request, which are not filtered when serializing headers via the setRequestHeader function...

PT-2007-3734 · Apple · Iphone +1

Name of the Vulnerable Software and Affected Versions: Apple Mac OS X versions 10.3.9 through 10.4.9 and later iPhone version before 1.0.1 Description: The issue allows remote attackers to inject arbitrary HTTP headers via LF characters in an XMLHttpRequest request. This is possible because the L...

Apple iOS MobileMail LibTIFF Buffer Overflow

This module exploits a buffer overflow in the version of libtiff shipped with firmware versions 1.00, 1.01, 1.02, and 1.1.1 of the Apple iPhone. iPhones which have not had the BSD tools installed will need to use a special payload. Module Options msf use exploit/apple/ios/email/mobilemaillibtiff...