Vulnerability-Lookup

CERTA-2009-AVI-223

Vulnerability from certfr_avis - Published: 2009-06-10 - Updated: 2009-06-10

De multiples vulnérabilités dans Apple Safari permettant, entre autre, l'exécution de code arbitraire à distance ont été corrigées.

Description

De multiples vulnérabilités dans Apple Safari ont été corrigées dont :

Des images identifiées comme des fichiers HTML permettent l'exécution automatique de Javascript ;
plusieurs corruptions mémoire affectant le composant CoreGraphics permettent l'exécution de code arbitraire (Microsoft Windows) à distance ;
plusieurs vulnérabilités affectent le composant WebKit et permettent, entre autre, des attaques en XSS ou l'exécution de code arbitraire à distance.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Les versions de Safari antérieures à 4.0 pour les systèmes d'exploitation suivants :

Mac OS X 10.4.x ;
Mac OS X 10.5.x ;
Mac OS X Server 10.4.x ;
Mac OS X Server 10.5.x ;
Windows XP ;
Windows Vista.

Impacted products

	Vendor	Product	Description

References

Title

Publication Time

Tags

Bulletin de sécurité Apple HT3613 du 8 juin 2009	None	vendor-advisory
Bulletin de sécurité Apple HT3613 du 08 juin 2009 :	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cp\u003eLes versions de Safari ant\u00e9rieures \u00e0  4.0 pour les syst\u00e8mes d\u0027exploitation suivants :  \u003cUL\u003e    \u003cLI\u003eMac OS X 10.4.x ;\u003c/LI\u003e    \u003cLI\u003eMac OS X 10.5.x ;\u003c/LI\u003e    \u003cLI\u003eMac OS X Server 10.4.x ;\u003c/LI\u003e    \u003cLI\u003eMac OS X Server 10.5.x ;\u003c/LI\u003e    \u003cLI\u003eWindows XP ;\u003c/LI\u003e    \u003cLI\u003eWindows Vista.\u003c/LI\u003e  \u003c/UL\u003e\u003c/p\u003e",
  "content": "## Description\n\nDe multiples vuln\u00e9rabilit\u00e9s dans Apple Safari ont \u00e9t\u00e9 corrig\u00e9es dont :\n\n-   Des images identifi\u00e9es comme des fichiers HTML permettent\n    l\u0027ex\u00e9cution automatique de Javascript ;\n-   plusieurs corruptions m\u00e9moire affectant le composant CoreGraphics\n    permettent l\u0027ex\u00e9cution de code arbitraire (Microsoft Windows) \u00e0\n    distance ;\n-   plusieurs vuln\u00e9rabilit\u00e9s affectent le composant WebKit et\n    permettent, entre autre, des attaques en XSS ou l\u0027ex\u00e9cution de code\n    arbitraire \u00e0 distance.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2006-2783",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-2783"
    },
    {
      "name": "CVE-2009-1702",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1702"
    },
    {
      "name": "CVE-2008-4226",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-4226"
    },
    {
      "name": "CVE-2009-1697",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1697"
    },
    {
      "name": "CVE-2008-4225",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-4225"
    },
    {
      "name": "CVE-2009-1710",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1710"
    },
    {
      "name": "CVE-2009-1694",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1694"
    },
    {
      "name": "CVE-2009-0153",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-0153"
    },
    {
      "name": "CVE-2009-1686",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1686"
    },
    {
      "name": "CVE-2009-1688",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1688"
    },
    {
      "name": "CVE-2008-3529",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-3529"
    },
    {
      "name": "CVE-2009-1685",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1685"
    },
    {
      "name": "CVE-2009-1696",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1696"
    },
    {
      "name": "CVE-2009-0040",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-0040"
    },
    {
      "name": "CVE-2009-1707",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1707"
    },
    {
      "name": "CVE-2009-1709",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1709"
    },
    {
      "name": "CVE-2009-1708",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1708"
    },
    {
      "name": "CVE-2009-1704",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1704"
    },
    {
      "name": "CVE-2009-1698",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1698"
    },
    {
      "name": "CVE-2009-1701",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1701"
    },
    {
      "name": "CVE-2009-1682",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1682"
    },
    {
      "name": "CVE-2009-1693",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1693"
    },
    {
      "name": "CVE-2009-1684",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1684"
    },
    {
      "name": "CVE-2009-1705",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1705"
    },
    {
      "name": "CVE-2009-1703",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1703"
    },
    {
      "name": "CVE-2008-2320",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-2320"
    },
    {
      "name": "CVE-2009-1712",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1712"
    },
    {
      "name": "CVE-2009-1714",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1714"
    },
    {
      "name": "CVE-2008-3281",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-3281"
    },
    {
      "name": "CVE-2009-1695",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1695"
    },
    {
      "name": "CVE-2008-3632",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-3632"
    },
    {
      "name": "CVE-2009-1681",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1681"
    },
    {
      "name": "CVE-2009-1718",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1718"
    },
    {
      "name": "CVE-2008-1588",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-1588"
    },
    {
      "name": "CVE-2008-4409",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-4409"
    },
    {
      "name": "CVE-2009-1691",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1691"
    },
    {
      "name": "CVE-2009-0145",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-0145"
    },
    {
      "name": "CVE-2009-1179",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1179"
    },
    {
      "name": "CVE-2009-1689",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1689"
    },
    {
      "name": "CVE-2009-1687",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1687"
    },
    {
      "name": "CVE-2009-1713",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1713"
    },
    {
      "name": "CVE-2009-1699",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1699"
    },
    {
      "name": "CVE-2009-0946",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-0946"
    },
    {
      "name": "CVE-2009-1716",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1716"
    },
    {
      "name": "CVE-2009-1706",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1706"
    },
    {
      "name": "CVE-2009-1700",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1700"
    },
    {
      "name": "CVE-2009-1690",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1690"
    },
    {
      "name": "CVE-2008-2321",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-2321"
    },
    {
      "name": "CVE-2009-1711",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1711"
    },
    {
      "name": "CVE-2008-4231",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-4231"
    },
    {
      "name": "CVE-2009-1715",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1715"
    }
  ],
  "initial_release_date": "2009-06-10T00:00:00",
  "last_revision_date": "2009-06-10T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Apple HT3613 du 08 juin 2009 :",
      "url": "http://support.apple.com/kb/HT3613"
    }
  ],
  "reference": "CERTA-2009-AVI-223",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2009-06-10T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s dans Apple Safari permettant, entre autre,\nl\u0027ex\u00e9cution de code arbitraire \u00e0 distance ont \u00e9t\u00e9 corrig\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Apple Safari",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apple HT3613 du 8 juin 2009",
      "url": null
    }
  ]
}

CVE-2009-1718 (GCVE-0-2009-1718)

Vulnerability from cvelistv5 – Published: 2009-06-10 17:37 – Updated: 2024-08-07 05:20

Summary

WebKit in Apple Safari before 4.0 allows user-assisted remote attackers to obtain sensitive information via vectors involving drag events and the dragging of content over a crafted web page.

Severity

No CVSS data available.

CWE

Assigner

mitre

References

8 references

URL	Tags
http://secunia.com/advisories/43068	third-party-advisoryx_refsource_SECUNIA
http://www.vupen.com/english/advisories/2011/0212	vdb-entryx_refsource_VUPEN
http://lists.apple.com/archives/security-announce…	vendor-advisoryx_refsource_APPLE
http://www.securityfocus.com/bid/35260	vdb-entryx_refsource_BID
http://www.vupen.com/english/advisories/2009/1522	vdb-entryx_refsource_VUPEN
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://secunia.com/advisories/35379	third-party-advisoryx_refsource_SECUNIA
http://support.apple.com/kb/HT3613	x_refsource_CONFIRM

Date Public

2009-06-08 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T05:20:35.191Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "43068",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/43068"
          },
          {
            "name": "ADV-2011-0212",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2011/0212"
          },
          {
            "name": "APPLE-SA-2009-06-08-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_APPLE",
              "x_transferred"
            ],
            "url": "http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html"
          },
          {
            "name": "35260",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/35260"
          },
          {
            "name": "ADV-2009-1522",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/1522"
          },
          {
            "name": "SUSE-SR:2011:002",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html"
          },
          {
            "name": "35379",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/35379"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://support.apple.com/kb/HT3613"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2009-06-08T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "WebKit in Apple Safari before 4.0 allows user-assisted remote attackers to obtain sensitive information via vectors involving drag events and the dragging of content over a crafted web page."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2011-02-17T10:00:00.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "43068",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/43068"
        },
        {
          "name": "ADV-2011-0212",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2011/0212"
        },
        {
          "name": "APPLE-SA-2009-06-08-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_APPLE"
          ],
          "url": "http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html"
        },
        {
          "name": "35260",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/35260"
        },
        {
          "name": "ADV-2009-1522",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/1522"
        },
        {
          "name": "SUSE-SR:2011:002",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html"
        },
        {
          "name": "35379",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/35379"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://support.apple.com/kb/HT3613"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2009-1718",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "WebKit in Apple Safari before 4.0 allows user-assisted remote attackers to obtain sensitive information via vectors involving drag events and the dragging of content over a crafted web page."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "43068",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/43068"
            },
            {
              "name": "ADV-2011-0212",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2011/0212"
            },
            {
              "name": "APPLE-SA-2009-06-08-1",
              "refsource": "APPLE",
              "url": "http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html"
            },
            {
              "name": "35260",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/35260"
            },
            {
              "name": "ADV-2009-1522",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/1522"
            },
            {
              "name": "SUSE-SR:2011:002",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html"
            },
            {
              "name": "35379",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/35379"
            },
            {
              "name": "http://support.apple.com/kb/HT3613",
              "refsource": "CONFIRM",
              "url": "http://support.apple.com/kb/HT3613"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2009-1718",
    "datePublished": "2009-06-10T17:37:00.000Z",
    "dateReserved": "2009-05-20T00:00:00.000Z",
    "dateUpdated": "2024-08-07T05:20:35.191Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted