Apple Safari up to 5.1.7 WebKit buffer overflow

VulDB: Apple Safari up to 5.1.7 WebKit buffer overflow

General

Apple

scipID: 5815
Affected: Apple Safari up to 5.1.7
Published: 07/25/2012 (Stephen Chenney)
Risk: critical
Entry: 90.3% complete
Created: 08/02/2012
Updated: 09/03/2012

Summary

A vulnerability classified as critical was found in Apple Safari up to 5.1.7. Affected by this vulnerability is an unknown function of the component WebKit. The manipulation with an unknown input leads to a buffer overflow vulnerability. As an impact it is known to affect confidentiality, integrity, and availability.

The weakness was published 07/25/2012 by Stephen Chenney with Chromium Development Community as HT5400 as knowledge base article (Apple Security Announce). The advisory is shared for download at support.apple.com. The public release has been coordinated with Apple. This vulnerability is known as CVE-2012-3615 since 06/19/2012. The exploitability is known to be difficult. The attack can be launched remotely. The exploitation doesn’t need any form of authentication. Technical details are unknown but a private exploit is available.

Upgrading to version 6 eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability. The vulnerability is also documented in the databases at OSVDB (84158) and Secunia (SA50058).