About the security content of Safari 5.1 and Safari 5.0.6

This document describes the security content of Safari 5.1 and Safari 5.0.6. Safari 5.1 is included with OS X Lion.

For the protection of our customers, Apple does not disclose, discuss or confirm security issues until a full investigation has occurred and any necessary patches or releases are available. To find out more about Apple Product Security, see the Apple Product Security website.

For information about the Apple Product Security PGP Key, see "How to use the Apple Product Security PGP Key."

Where possible, CVE IDs are used to reference the vulnerabilities for further information.

To find out more about other Security Updates, see "Apple Security Updates".

Safari 5.1 and Safari 5.0.6

• CFNetwork

  Available for: Windows 7, Vista, XP SP2 or later

  Impact: Visiting a maliciously crafted website may lead to a cross-site scripting attack

  Description: In certain situations, Safari may treat a file as HTML, even if it is served with the 'text/plain' content type. This may lead to a cross-site scripting attack on sites that allow untrusted users to post text files. This issue is addressed through improved handling of 'text/plain' content.

  CVE-ID

  CVE-2010-1420: Hidetake Jo working with Microsoft Vulnerability Research (MSVR), Neal Poole of Matasano Security

• CFNetwork

  Available for: Windows 7, Vista, XP SP2 or later

  Impact: Authenticating to a maliciously crafted website may lead to arbitrary code execution

  Description: The NTLM authentication protocol is susceptible to a replay attack referred to as credential reflection. Authenticating to a maliciously crafted website may lead to arbitrary code execution. To mitigate this issue, Safari has been updated to utilise protection mechanisms recently added to Windows. This issue does not affect Mac OS X systems.

  CVE-ID

  CVE-2010-1383: Takehiro Takahashi of IBM X-Force Research

• CFNetwork

  Available for: Windows 7, Vista, XP SP2 or later

  Impact: A root certificate that is disabled may still be trusted

  Description: CFNetwork did not properly validate that a certificate was trusted for use by a SSL server. As a result, if the user had marked a system root certificate as not trusted, Safari would still accept certificates signed by that root. This issue is addressed through improved certificate validation. This issue does not affect Mac OS X systems.

  CVE-ID

  CVE-2011-0214: an anonymous reporter

• ColorSync

  Available for: Windows 7, Vista, XP SP2 or later

  Impact: Viewing a maliciously crafted image with an embedded ColorSync profile may lead to an unexpected application termination or arbitrary code execution

  Description: An integer overflow existed in the handling of images with an embedded ColorSync profile, which may lead to a heap buffer overflow. Opening a maliciously crafted image with an embedded ColorSync profile may lead to an unexpected application termination or arbitrary code execution. For Mac OS X v10.5 systems, this issue is addressed in Security Update 2011-004.

  CVE-ID

  CVE-2011-0200: binaryproof working with TippingPoin’s Zero Day Initiative

• CoreFoundation

  Available for: Windows 7, Vista, XP SP2 or later

  Impact: Applications that use the CoreFoundation framework may be vulnerable to an unexpected application termination or arbitrary code execution

  Description: An off-by-one buffer overflow issue existed in the handling of CFStrings. Applications that use the CoreFoundation framework may be vulnerable to an unexpected application termination or arbitrary code execution. For Mac OS X v10.6 systems, this issue is addressed in Mac OS X v10.6.8.

  CVE-ID

  CVE-2011-0201: Harry Sintonen

• CoreGraphics

  Available for: Windows 7, Vista, XP SP2 or later

  Impact: Opening a maliciously crafted PDF file may lead to an unexpected application termination or arbitrary code execution

  Description: An integer overflow issue existed in the handling of Type 1 fonts. Viewing or downloading a document containing a maliciously crafted embedded font may lead to arbitrary code execution. For Mac OS X v10.6 systems, this issue is addressed in Mac OS X v10.6.8. For Mac OS X v10.5 systems, this issue is addressed in Security Update 2011-004.

  CVE-ID

  CVE-2011-0202: Cristian Draghici of Modulo Consulting, Felix Grobert of the Google Security Team

• International Components for Unicode

  Available for: Windows 7, Vista, XP SP2 or later

  Impact: Applications that use ICU may be vulnerable to an unexpected application termination or arbitrary code execution

  Description: A buffer overflow issue existed in ICU's handling of uppercase strings. Applications that use ICU may be vulnerable to an unexpected application termination or arbitrary code execution. For Mac OS X v10.6 systems, this issue is addressed in Mac OS X v10.6.8.

  CVE-ID

  CVE-2011-0206: David Bienvenu of Mozilla

• ImageIO

  Available for: Windows 7, Vista, XP SP2 or later

  Impact: Viewing a maliciously crafted TIFF image may lead to an unexpected application termination or arbitrary code execution

  Description: A heap buffer overflow existed in ImageIO's handling of TIFF images. Viewing a maliciously crafted TIFF image may lead to an unexpected application termination or arbitrary code execution. For Mac OS X v10.6 systems, this issue is addressed in Mac OS X v10.6.8. For Mac OS X v10.5 systems, this issue is addressed in Security Update 2011-004.

  CVE-ID

  CVE-2011-0204: Dominic Chell of NGS Secure

• ImageIO

  Available for: Windows 7, Vista, XP SP2 or later

  Impact: Viewing a maliciously crafted TIFF image may lead to an unexpected application termination or arbitrary code execution

  Description: A heap buffer overflow existed in ImageIO's handling of CCITT Group 4 encoded TIFF images. Viewing a maliciously crafted TIFF image may lead to an unexpected application termination or arbitrary code execution.

  CVE-ID

  CVE-2011-0241: Cyril CATTIAUX of Tessi Technologies

• ImageIO

  Available for: Windows 7, Vista, XP SP2 or later

  Impact: Viewing a maliciously crafted TIFF image may lead to an unexpected application termination or arbitrary code execution

  Description: A re-entrancy issue existed in ImageIO's handling of TIFF images. Viewing a maliciously crafted TIFF image may lead to an unexpected application termination or arbitrary code execution. This issue does not affect Mac OS X systems.

  CVE-ID

  CVE-2011-0215: Juan Pablo Lopez Yacubian working with iDefense VCP

• ImageIO

  Available for: Windows 7, Vista, XP SP2 or later

  Impact: Viewing a maliciously crafted TIFF image may lead to an unexpected application termination or arbitrary code execution

  Description: A heap buffer overflow existed in ImageIO's handling of TIFF images. Viewing a maliciously crafted TIFF image may lead to an unexpected application termination or arbitrary code execution. For Mac OS X v10.6 systems, this issue is addressed in Mac OS X v10.6.8. For Mac OS X v10.5 systems, this issue is addressed in Security Update 2011-004.

  CVE-ID

  CVE-2011-0204: Dominic Chell of NGS Secure

• libxslt

  Available for: Windows 7, Vista, XP SP2 or later

  Impact: Visiting a maliciously crafted website may lead to the disclosure of addresses on the heap

  Description: libxslt's implementation of the generate-id() XPath function disclosed the address of a heap buffer. Visiting a maliciously crafted website may lead to the disclosure of addresses on the heap. This issue is addressed by generating an ID based on the difference between the addresses of two heap buffers. For Mac OS X v10.6 systems, this issue is addressed in Mac OS X v10.6.8. For Mac OS X v10.5 systems, this issue is addressed in Security Update 2011-004.

  CVE-ID

  CVE-2011-0195: Chris Evans of the Google Chrome Security Team

• libxml

  Available for: Windows 7, Vista, XP SP2 or later

  Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution

  Description: A one-byte heap buffer overflow existed in libxml's handling of XML data. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution.

  CVE-ID

  CVE-2011-0216: Billy Rios of the Google Security Team

• Safari

  Available for: Mac OS X v10.6.8 or later, Mac OS X Server v10.6.8 or later, Windows 7, Vista, XP SP2 or later

  Impact: If the "AutoFill web forms" feature is enabled, visiting a maliciously crafted website and typing may lead to the disclosure of information from the user's Address Book

  Description: Safari's "AutoFill web forms" feature filled in non-visible form fields, and the information was accessible by scripts on the site before the user submitted the form. This issue is addressed by displaying all fields that will be filled, and requiring the user's consent before AutoFill information is available to the form.

  CVE-ID

  CVE-2011-0217: Florian Rienhardt of BSI, Alex Lambert, Jeremiah Grossman

• Safari

  Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8, Mac OS X v10.6.8 or later, Mac OS X Server v10.6.8 or later, Windows 7, Vista, XP SP2 or later

  Impact: With a certain Java configuration, visiting a malicious website may lead to unexpected text being displayed on other sites

  Description: A cross-origin issue existed in the handling of Java Applets. This applies when Java is enabled in Safari, and Java is configured to run within the browser process. Fonts loaded by a Java applet could affect the display of text content from other sites. This issue is addressed by running Java applets in a separate process.

  CVE-ID

  CVE-2011-0219: Joshua Smith of Kaon Interactive

• WebKit

  Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8, Mac OS X v10.6.8 or later, Mac OS X Server v10.6.8 or later, Windows 7, Vista, XP SP2 or later

  Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution

  Description: Multiple memory corruption issues existed in WebKit. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution.

  CVE-ID

  CVE-2010-1823: David Weston of Microsoft and Microsoft Vulnerability Research (MSVR), wushi of team509 and Yong Li of Research In Motion Ltd

  CVE-2011-0164: Apple

  CVE-2011-0218: SkyLined of Google Chrome Security Team

  CVE-2011-0221: Abhishek Arya (Inferno) of Google Chrome Security Team

  CVE-2011-0222: Nikita Tarakanov and Alex Bazhanyuk of the CISS Research Team and Abhishek Arya (Inferno) of Google Chrome Security Team

  CVE-2011-0223: Jose A. Vazquez of spa-s3c.blogspot.com working with iDefense VCP

  CVE-2011-0225: Abhishek Arya (Inferno) of Google Chrome Security Team

  CVE-2011-0232: J23 working with TippingPoint's Zero Day Initiative

  CVE-2011-0233: wushi of team509 working with TippingPoint's Zero Day Initiative

  CVE-2011-0234: Rob King working with TippingPoint's Zero Day Initiative, wushi of team509 working with TippingPoint's Zero Day Initiative, wushi of team509 working with iDefense VCP

  CVE-2011-0235: Abhishek Arya (Inferno) of Google Chrome Security Team

  CVE-2011-0237: wushi of team509 working with iDefense VCP

  CVE-2011-0238: Adam Barth of Google Chrome Security Team

  CVE-2011-0240: wushi of team509 working with iDefense VCP

  CVE-2011-0253: Richard Keen

  CVE-2011-0254: An anonymous researcher working with TippingPoint's Zero Day Initiative

  CVE-2011-0255: An anonymous researcher working with TippingPoint's Zero Day Initiative

  CVE-2011-0981: Rik Cabanier of Adobe Systems, Inc

  CVE-2011-0983: Martin Barbella

  CVE-2011-1109: Sergey Glazunov

  CVE-2011-1114: Martin Barbella

  CVE-2011-1115: Martin Barbella

  CVE-2011-1117: wushi of team509

  CVE-2011-1121: miaubiz

  CVE-2011-1188: Martin Barbella

  CVE-2011-1203: Sergey Glazunov

  CVE-2011-1204: Sergey Glazunov

  CVE-2011-1288: Andreas Kling of Nokia

  CVE-2011-1293: Sergey Glazunov

  CVE-2011-1296: Sergey Glazunov

  CVE-2011-1449: Marek Majkowski, wushi of team 509 working with iDefense VCP

  CVE-2011-1451: Sergey Glazunov

  CVE-2011-1453: wushi of team509 working with TippingPoint's Zero Day Initiative

  CVE-2011-1457: John Knottenbelt of Google

  CVE-2011-1462 : wushi of team509

  CVE-2011-1797 : wushi of team509

  CVE-2011-3438: wushi of team509 working with iDefense VCP

  CVE-2011-3443: An anonymous researcher working with iDefense VCP

• WebKit

  Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8, Mac OS X v10.6.8 or later, Mac OS X Server v10.6.8 or later, Windows 7, Vista, XP SP2 or later

  Impact: Visiting a maliciously crafted website may lead to arbitrary code execution

  Description: A configuration issue existed in WebKit's use of libxslt. Visiting a maliciously crafted website may lead to arbitrary files being created with the privileges of the user, which may lead to arbitrary code execution. This issue is addressed through improved libxslt security settings.

  CVE-ID

  CVE-2011-1774: Nicolas Gregoire of Agarri

• WebKit

  Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8, Mac OS X v10.6.8 or later, Mac OS X Server v10.6.8 or later, Windows 7, Vista, XP SP2 or later

  Impact: Visiting a maliciously crafted website may lead to an information disclosure

  Description: A cross-origin issue existed in the handling of Web Workers. Visiting a maliciously crafted website may lead to an information disclosure.

  CVE-ID

  CVE-2011-1190: Daniel Divricean of divricean.ro

• WebKit

  Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8, Mac OS X v10.6.8 or later, Mac OS X Server v10.6.8 or later, Windows 7, Vista, XP SP2 or later

  Impact: Visiting a maliciously crafted website may lead to a cross-site scripting attack

  Description: A cross-origin issue existed in the handling of URLs with an embedded username. Visiting a maliciously crafted website may lead to a cross-site scripting attack. This issue is addressed through improved handling of URLs with an embedded username.

  CVE-ID

  CVE-2011-0242: Jobert Abma of Online24

• WebKit

  Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8, Mac OS X v10.6.8 or later, Mac OS X Server v10.6.8 or later, Windows 7, Vista, XP SP2 or later

  Impact: Visiting a maliciously crafted website may lead to a cross-site scripting attack

  Description: A cross-origin issue existed in the handling of DOM nodes. Visiting a maliciously crafted website may lead to a cross-site scripting attack.

  CVE-ID

  CVE-2011-1295 : Sergey Glazunov

• WebKit

  Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8, Mac OS X v10.6.8 or later, Mac OS X Server v10.6.8 or later, Windows 7, Vista, XP SP2 or later

  Impact: A maliciously crafted website may be able to cause a different URL to be shown in the address bar

  Description: A URL spoofing issue existed in the handling of the DOM history object. A maliciously crafted website may have been able to cause a different URL to be shown in the address bar.

  CVE-ID

  CVE-2011-1107: Jordi Chancel

• WebKit

  Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8, Mac OS X v10.6.8 or later, Mac OS X Server v10.6.8 or later, Windows 7, Vista, XP SP2 or later

  Impact: Subscribing to a maliciously crafted RSS feed and clicking on a link within it may lead to an information disclosure

  Description: A canonicalisation issue existed in the handling of URLs. Subscribing to a maliciously crafted RSS feed and clicking on a link within it may lead to arbitrary files being sent from the user's system to a remote server. This update addresses the issue through improved handling of URLs.

  CVE-ID

  CVE-2011-0244: Jason Hullinger

• WebKit

  Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8, Mac OS X v10.6.8 or later, Mac OS X Server v10.6.8 or later, Windows 7, Vista, XP SP2 or later

  Impact: Applications that use WebKit, such as mail clients, may connect to an arbitrary DNS server upon processing HTML content

  Description: DNS prefetching was enabled by default in WebKit. Applications that use WebKit, such as mail clients, may connect to an arbitrary DNS server upon processing HTML content. This update addresses the issue by requiring applications to opt in to DNS prefetching.

  CVE-ID

  CVE-2010-3829: Mike Cardwell of Cardwell IT Ltd.