Lucene search

K
zdiWushi of team509ZDI-10-144
HistoryAug 09, 2010 - 12:00 a.m.

Apple Webkit Rendering Counter Remote Code Execution Vulnerability

2010-08-0900:00:00
wushi of team509
www.zerodayinitiative.com
17

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.23 Low

EPSS

Percentile

96.5%

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple Safari’s Webkit. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within Webkit’s support for generated content. When utilizing generated content on a particular element, the library will insert more than one reference of the generated element element. During page destruction the application will navigate through the reference to discover more elements to destroy. This can lead to code execution under the context of the application.

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.23 Low

EPSS

Percentile

96.5%