CVE-2008-2317

 

Published at: - 14-07-2008 08:41

Last modified: - 09-08-2022 03:46

Total changes: - 2

Description

WebCore in Apple Safari does not properly perform garbage collection of JavaScript document elements, which allows remote attackers to execute arbitrary code or cause a denial of service (heap corruption and application crash) via a reference to the ownerNode property of a copied CSSStyleSheet object of a STYLE element, as originally demonstrated on Apple iPhone before 2.0 and iPod touch before 2.0, a different vulnerability than CVE-2008-1590.

Common Vulnerability Scoring System (CVSS)

AV:N/AC:M/Au:N/C:C/I:C/A:C

 

Verification logic

 

Reference

• APPLE-SA-2008-07-11-Vendor Advisory
• 30186-
• http://www.zerodayinitiative.com/advisories/ZDI-08-045/
• 31074-Vendor Advisory
• APPLE-SA-2008-11-13-Vendor Advisory
• http://support.apple.com/kb/HT3298
• ADV-2008-2094-Vendor Advisory
• 32706-
• ipod-iphone-stylesheets-code-execution(43737)-
• 20080725 ZDI-08-045: Apple Safari StyleSheet ownerNode Heap Corruption Vulnerability-

 

Keywords

NVD

 

CVE-2008-2317

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures