About the security content of Safari 5.1.1

Summary

This document describes the security content of Safari 5.1.1.

Products Affected

Product Security, Safari 5.1 (Mac OS X 10.6), Safari 5.1 (OS X Lion), Safari 5.1 (Windows)

For the protection of our customers, Apple does not disclose, discuss, or confirm security issues until a full investigation has occurred and any necessary patches or releases are available. To learn more about Apple Product Security, see the Apple Product Security website.

For information about the Apple Product Security PGP Key, see "How to use the Apple Product Security PGP Key."

Where possible, CVE IDs are used to reference the vulnerabilities for further information.

To learn about other Security Updates, see "Apple Security Updates".

Safari 5.1.1

  • Safari

    Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8, OS X Lion v10.7.2, OS X Lion Server v10.7.2, Windows 7, Vista, XP SP2 or later

    Impact: Visiting a malicious website may cause the execution of arbitrary Javascript in the context of installed Safari Extensions

    Description: A directory traversal issue existed in the handling of safari-extension:// URLs. Visiting a malicious website may cause execution of arbitrary Javascript in the context of installed Safari Extensions, which may have context-dependent ramifications including files from the user's system being sent to a remote server.

    CVE-ID

    CVE-2011-3229 : Aaron Sigel of vtty.com

  • Safari

    Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8, OS X Lion v10.7.2, OS X Lion Server v10.7.2

    Impact: Visiting a malicious website may lead to arbitrary code execution

    Description: A policy issue existed in the handling of file:// URLs. This issue does not affect Windows systems.

    CVE-ID

    CVE-2011-3230 : Aaron Sigel of vtty.com

  • Safari

    Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8

    Impact: Visiting a malicious website may lead to arbitrary code execution

    Description: An uninitialized memory access issue existed in the handling of SSL certificates. This issue does not affect OS X Lion systems or Windows systems.

    CVE-ID

    CVE-2011-3231 : Jason Broccardo of Fermi National Accelerator Laboratory

  • WebKit

    Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8, OS X Lion v10.7.2, OS X Lion Server v10.7.2, Windows 7, Vista, XP SP2 or later

    Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution

    Description: Multiple memory corruption issues existed in WebKit.

    CVE-ID

    CVE-2011-1440 : Jose A. Vazquez of spa-s3c.blogspot.com

    CVE-2011-2338 : Abhishek Arya (Inferno) of Google Chrome Security Team using AddressSanitizer

    CVE-2011-2339 : Cris Neckar of the Google Chrome Security Team

    CVE-2011-2341 : wushi of team509 working with Verisign iDefense Labs

    CVE-2011-2351 : miaubiz

    CVE-2011-2352 : Apple

    CVE-2011-2354 : Apple

    CVE-2011-2356 : Adam Barth and Abhishek Arya of Google Chrome Security Team using AddressSanitizer

    CVE-2011-2359 : miaubiz

    CVE-2011-2788 : Mikolaj Malecki of Samsung

    CVE-2011-2790 : miaubiz

    CVE-2011-2792 : miaubiz

    CVE-2011-2797 : miaubiz

    CVE-2011-2799 : miaubiz

    CVE-2011-2809 : Abhishek Arya (Inferno) of Google Chrome Security Team

    CVE-2011-2811 : Apple

    CVE-2011-2813 : Cris Neckar of Google Chrome Security Team using AddressSanitizer

    CVE-2011-2814 : Abhishek Arya (Inferno) of Google Chrome Security Team using AddressSanitizer

    CVE-2011-2815 : SkyLined of Google Chrome Security Team

    CVE-2011-2816 : Apple

    CVE-2011-2817 : Abhishek Arya (Inferno) of Google Chrome Security Team using AddressSanitizer

    CVE-2011-2818 : Martin Barbella

    CVE-2011-2820 : Raman Tenneti and Philip Rogers of Google

    CVE-2011-2823 : SkyLined of Google Chrome Security Team

    CVE-2011-2827 : miaubiz

    CVE-2011-2831 : Abhishek Arya (Inferno) of Google Chrome Security Team using AddressSanitizer

    CVE-2011-3232 : Aki Helin of OUSPG

    CVE-2011-3233 : Sadrul Habib Chowdhury of the Chromium development community, Cris Neckar and Abhishek Arya (Inferno) of Google Chrome Security Team

    CVE-2011-3234 : miaubiz

    CVE-2011-3235 : Dimitri Glazkov, Kent Tamura, Dominic Cooney of the Chromium development community, and Abhishek Arya (Inferno) of Google Chrome Security Team

    CVE-2011-3236 : Abhishek Arya (Inferno) of Google Chrome Security Team using AddressSanitizer

    CVE-2011-3237 : Dimitri Glazkov, Kent Tamura, Dominic Cooney of the Chromium development community, and Abhishek Arya (Inferno) of Google Chrome Security Team

    CVE-2011-3238 : Martin Barbella

    CVE-2011-3239 : Slawomir Blazek

    CVE-2011-3241 : Apple

  • WebKit

    Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8, OS X Lion v10.7.2, OS X Lion Server v10.7.2, Windows 7, Vista, XP SP2 or later

    Impact: A maliciously crafted website may be able to track the URLs that a user visits within a frame

    Description: A cross-origin issue existed in the handling of the beforeload event.

    CVE-ID

    CVE-2011-2800 : Juho Nurminen

  • WebKit

    Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8, OS X Lion v10.7.2, OS X Lion Server v10.7.2, Windows 7, Vista, XP SP2 or later

    Impact: Visiting a maliciously crafted website may lead to a cross-site scripting attack

    Description: A cross-origin issue existed in the handling of the window.open method.

    CVE-ID

    CVE-2011-2805 : Sergey Glazunov

  • WebKit

    Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8, OS X Lion v10.7.2, OS X Lion Server v10.7.2, Windows 7, Vista, XP SP2 or later

    Impact: Visiting a maliciously crafted website may lead to a cross-site scripting attack

    Description: A cross-origin issue existed in the handling of the document.documentURI property.

    CVE-ID

    CVE-2011-2819 : Sergey Glazunov

  • WebKit

    Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8, OS X Lion v10.7.2, OS X Lion Server v10.7.2, Windows 7, Vista, XP SP2 or later

    Impact: Visiting a maliciously crafted website may lead to a cross-site scripting attack

    Description: A cross-origin issue existed in the handling of inactive DOM windows.

    CVE-ID

    CVE-2011-3243 : Sergey Glazunov

  • WebKit

    Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8, OS X Lion v10.7.2, OS X Lion Server v10.7.2

    Impact: In Private Browsing mode, cookies may be set even if "Block cookies" is set to "Always"

    Description: A logic issue existed in the handling of cookies in Private Browsing mode. This issue does not affect Windows systems.

    CVE-ID

    CVE-2011-3242 : John Adamczyk

Important: Mention of third-party websites and products is for informational purposes only and constitutes neither an endorsement nor a recommendation. Apple assumes no responsibility with regard to the selection, performance or use of information or products found at third-party websites. Apple provides this only as a convenience to our users. Apple has not tested the information found on these sites and makes no representations regarding its accuracy or reliability. There are risks inherent in the use of any information or products found on the Internet, and Apple assumes no responsibility in this regard. Please understand that a third-party site is independent from Apple and that Apple has no control over the content on that website. Please contact the vendor for additional information.
Not helpful Somewhat helpful Helpful Very helpful Solved my problem
Ask other users about this article
in Apple Support Communities
See all questions on this article See all questions I have asked