About the security content of Safari 6.0.3

Summary

This document describes the security content of Safari 6.0.3, which can be downloaded and installed via Software Update preferences, or from Apple Downloads.

Products Affected

Product Security, Safari 6 (OS X Lion), Safari 6 (OS X Mountain Lion)

For the protection of our customers, Apple does not disclose, discuss, or confirm security issues until a full investigation has occurred and any necessary patches or releases are available. To learn more about Apple Product Security, see the Apple Product Security website.

For information about the Apple Product Security PGP Key, see "How to use the Apple Product Security PGP Key."

Where possible, CVE IDs are used to reference the vulnerabilities for further information.

To learn about other Security Updates, see "Apple Security Updates."
 

Safari 6.0.3

  • WebKit

    Available for: OS X Lion v10.7.5, OS X Lion Server v10.7.5, OS X Mountain Lion v10.8.2

    Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution

    Description: Multiple memory corruption issues existed in WebKit. These issues were addressed through improved memory handling.

    CVE-ID

    CVE-2012-2824 : miaubiz

    CVE-2012-2857 : Arthur Gerkis

    CVE-2013-0948 : Abhishek Arya (Inferno) of the Google Chrome Security Team

    CVE-2013-0949 : Abhishek Arya (Inferno) of the Google Chrome Security Team

    CVE-2013-0950 : Abhishek Arya (Inferno) of the Google Chrome Security Team

    CVE-2013-0951 : Apple

    CVE-2013-0952 : Abhishek Arya (Inferno) of the Google Chrome Security Team

    CVE-2013-0953 : Abhishek Arya (Inferno) of the Google Chrome Security Team

    CVE-2013-0954 : Dominic Cooney of Google and Martin Barbella of the Google Chrome Security Team

    CVE-2013-0955 : Apple

    CVE-2013-0956 : Apple Product Security

    CVE-2013-0958 : Abhishek Arya (Inferno) of the Google Chrome Security Team

    CVE-2013-0959 : Abhishek Arya (Inferno) of the Google Chrome Security Team

    CVE-2013-0960 : Apple

    CVE-2013-0961 : wushi of team509 working with iDefense VCP

  • WebKit

    Available for: OS X Lion v10.7.5, OS X Lion Server v10.7.5, OS X Mountain Lion v10.8.2

    Impact: Visiting a maliciously crafted website may lead to a cross-site scripting attack

    Description: A cross-site scripting issue existed in the handling of frame elements. This issue was addressed through improved origin tracking.

    CVE-ID

    CVE-2012-2889 : Sergey Glazunov

  • WebKit

    Available for: OS X Lion v10.7.5, OS X Lion Server v10.7.5, OS X Mountain Lion v10.8.2

    Impact: Copying and pasting content on a malicious website may lead to a cross-site scripting attack

    Description: A cross-site scripting issue existed in the handling of content pasted from a different origin. This issue was addressed through additional validation of pasted content.

    CVE-ID

    CVE-2013-0962 : Mario Heiderich of Cure53

Important: Mention of third-party websites and products is for informational purposes only and constitutes neither an endorsement nor a recommendation. Apple assumes no responsibility with regard to the selection, performance or use of information or products found at third-party websites. Apple provides this only as a convenience to our users. Apple has not tested the information found on these sites and makes no representations regarding its accuracy or reliability. There are risks inherent in the use of any information or products found on the Internet, and Apple assumes no responsibility in this regard. Please understand that a third-party site is independent from Apple and that Apple has no control over the content on that website. Please contact the vendor for additional information.
Not helpful Somewhat helpful Helpful Very helpful Solved my problem
Ask other users about this article
in Apple Support Communities
See all questions on this article See all questions I have asked