Apple Safari up to 5.1.7 WebKit buffer overflow

VulDB: Apple Safari up to 5.1.7 WebKit buffer overflow

General

Apple

scipID: 5832
Affected: Apple Safari up to 5.1.7
Published: 07/25/2012 (Slawomir Blazek)
Risk: critical
Entry: 89.5% complete
Created: 08/03/2012
Updated: 09/03/2012

Summary

A vulnerability classified as critical has been found in Apple Safari up to 5.1.7. Affected is an unknown function of the component WebKit. The manipulation with an unknown input leads to a buffer overflow vulnerability. This is going to have an impact on confidentiality, integrity, and availability.

The weakness was disclosed 07/25/2012 by Slawomir Blazek as HT5400 as knowledge base article (Apple Security Announce). The advisory is shared for download at support.apple.com. The public release has been coordinated in cooperation with the vendor. This vulnerability is traded as CVE-2012-3641 since 06/19/2012. The exploitability is known to be difficult. It is possible to launch the attack remotely. The exploitation doesn’t require any form of authentication. Technical details are unknown but a private exploit is available.

Upgrading to version 6 eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability. The vulnerability is also documented in the databases at OSVDB (84175) and Secunia (SA50058).