About the security content of Safari 6

This document describes the security content of Safari 6.

For the protection of our customers, Apple does not disclose, discuss, or confirm security issues until a full investigation has occurred and any necessary patches or releases are available. To learn more about Apple Product Security, see the Apple Product Security website.

For information about the Apple Product Security PGP Key, see "How to use the Apple Product Security PGP Key."

Where possible, CVE IDs are used to reference the vulnerabilities for further information.

To learn about other Security Updates, see "Apple Security Updates".

Safari 6.0

  • Safari

    Available for: OS X Lion v10.7.4, OS X Lion Server v10.7.4

    Impact: Visiting a maliciously crafted website may lead to a cross-site scripting attack

    Description: A cross-site scripting issue existed in the handling of feed:// URLs. This update removes handling of feed:// URLs.

    CVE-ID

    CVE-2012-0678 : Masato Kinugawa

  • Safari

    Available for: OS X Lion v10.7.4, OS X Lion Server v10.7.4

    Impact: Visiting a maliciously crafted website may cause files from the user's system to be sent to a remote server

    Description: An access control issue existed in the handling of feed:// URLs. This update removes handling of feed:// URLs.

    CVE-ID

    CVE-2012-0679 : Aaron Sigel of vtty.com

  • Safari

    Available for: OS X Lion v10.7.4, OS X Lion Server v10.7.4

    Impact: Passwords may autocomplete even when the site specifies that autocomplete should be disabled

    Description: Password input elements with the autocomplete attribute set to "off" were being autocompleted. This update addresses the issue by improved handling of the autocomplete attribute.

    CVE-ID

    CVE-2012-0680 : Dan Poltawski of Moodle

  • Safari Downloads

    Available for: OS X Lion v10.7.4, OS X Lion Server v10.7.4

    Impact: Opening maliciously crafted files on certain websites may lead to a cross-site scripting attack

    Description: An issue existed in Safari's support for the 'attachment' value for the HTTP Content-Disposition header. This header is used by many websites to serve files that were uploaded to the site by a third-party, such as attachments in web-based e-mail applications. Any script in files served with this header value would run as if the file had been served inline, with full access to other resources on the origin server. This issue is addressed by downloading resources served with this header, rather than displaying them inline.

    CVE-ID

    CVE-2011-3426 : Mickey Shkatov of laplinker.com, Kyle Osborn, Hidetake Jo at Microsoft and Microsoft Vulnerability Research (MSVR)

  • WebKit

    Available for: OS X Lion v10.7.4, OS X Lion Server v10.7.4

    Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution

    Description: Multiple memory corruption issues existed in WebKit. These issues are addressed through improved memory handling.

    CVE-ID

    CVE-2011-3016 : miaubiz

    CVE-2011-3021 : Arthur Gerkis

    CVE-2011-3027 : miaubiz

    CVE-2011-3032 : Arthur Gerkis

    CVE-2011-3034 : Arthur Gerkis

    CVE-2011-3035 : wushi of team509 working with iDefense VCP, Arthur Gerkis

    CVE-2011-3036 : miaubiz

    CVE-2011-3037 : miaubiz

    CVE-2011-3038 : miaubiz

    CVE-2011-3039 : miaubiz

    CVE-2011-3040 : miaubiz

    CVE-2011-3041 : miaubiz

    CVE-2011-3042 : miaubiz

    CVE-2011-3043 : miaubiz

    CVE-2011-3044 : Arthur Gerkis

    CVE-2011-3050 : miaubiz

    CVE-2011-3053 : miaubiz

    CVE-2011-3059 : Arthur Gerkis

    CVE-2011-3060 : miaubiz

    CVE-2011-3064 : Atte Kettunen of OUSPG

    CVE-2011-3068 : miaubiz

    CVE-2011-3069 : miaubiz

    CVE-2011-3071 : pa_kt working with HP's Zero Day Initiative

    CVE-2011-3073 : Arthur Gerkis

    CVE-2011-3074 : Slawomir Blazek

    CVE-2011-3075 : miaubiz

    CVE-2011-3076 : miaubiz

    CVE-2011-3078 : Martin Barbella of the Google Chrome Security Team

    CVE-2011-3081 : miaubiz

    CVE-2011-3086 : Arthur Gerkis

    CVE-2011-3089 : Skylined of the Google Chrome Security Team, miaubiz

    CVE-2011-3090 : Arthur Gerkis

    CVE-2011-3913 : Arthur Gerkis

    CVE-2011-3924 : Arthur Gerkis

    CVE-2011-3926 : Arthur Gerkis

    CVE-2011-3958 : miaubiz

    CVE-2011-3966 : Aki Helin of OUSPG

    CVE-2011-3968 : Arthur Gerkis

    CVE-2011-3969 : Arthur Gerkis

    CVE-2011-3971 : Arthur Gerkis

    CVE-2012-0682 : Apple Product Security

    CVE-2012-0683 : Dave Mandelin of Mozilla

    CVE-2012-1520 : Martin Barbella of the Google Chrome Security Team using AddressSanitizer, Jose A. Vazquez of spa-s3c.blogspot.com working with iDefense VCP

    CVE-2012-1521 : Skylined of the Google Chrome Security Team, Jose A. Vazquez of spa-s3c.blogspot.com working with iDefense VCP

    CVE-2012-3589 : Dave Mandelin of Mozilla

    CVE-2012-3590 : Apple Product Security

    CVE-2012-3591 : Apple Product Security

    CVE-2012-3592 : Apple Product Security

    CVE-2012-3593 : Apple Product Security

    CVE-2012-3594 : miaubiz

    CVE-2012-3595 : Martin Barbella of Google Chrome Security

    CVE-2012-3596 : Skylined of the Google Chrome Security Team

    CVE-2012-3597 : Abhishek Arya of Google Chrome Security Team using AddressSanitizer

    CVE-2012-3599 : Abhishek Arya of Google Chrome Security Team using AddressSanitizer

    CVE-2012-3600 : David Levin of the Chromium development community

    CVE-2012-3603 : Apple Product Security

    CVE-2012-3604 : Skylined of the Google Chrome Security Team

    CVE-2012-3605 : Cris Neckar of the Google Chrome Security team

    CVE-2012-3608 : Skylined of the Google Chrome Security Team

    CVE-2012-3609 : Skylined of the Google Chrome Security Team

    CVE-2012-3610 : Skylined of the Google Chrome Security Team

    CVE-2012-3611 : Apple Product Security

    CVE-2012-3615 : Stephen Chenney of the Chromium development community

    CVE-2012-3618 : Abhishek Arya of Google Chrome Security Team using AddressSanitizer

    CVE-2012-3620 : Abhishek Arya of Google Chrome Security Team

    CVE-2012-3625 : Skylined of Google Chrome Security Team

    CVE-2012-3626 : Apple Product Security

    CVE-2012-3627 : Skylined and Abhishek Arya of Google Chrome Security team

    CVE-2012-3628 : Apple Product Security

    CVE-2012-3629 : Abhishek Arya of Google Chrome Security Team using AddressSanitizer

    CVE-2012-3630 : Abhishek Arya of Google Chrome Security Team using AddressSanitizer

    CVE-2012-3631 : Abhishek Arya of Google Chrome Security Team using AddressSanitizer

    CVE-2012-3633 : Martin Barbella of Google Chrome Security Team using AddressSanitizer

    CVE-2012-3634 : Martin Barbella of Google Chrome Security Team using AddressSanitizer

    CVE-2012-3635 : Martin Barbella of Google Chrome Security Team using AddressSanitizer

    CVE-2012-3636 : Martin Barbella of Google Chrome Security Team using AddressSanitizer

    CVE-2012-3637 : Martin Barbella of Google Chrome Security Team using AddressSanitizer

    CVE-2012-3638 : Martin Barbella of Google Chrome Security Team using AddressSanitizer

    CVE-2012-3639 : Martin Barbella of Google Chrome Security Team using AddressSanitizer

    CVE-2012-3640 : miaubiz

    CVE-2012-3641 : Slawomir Blazek

    CVE-2012-3642 : miaubiz

    CVE-2012-3644 : miaubiz

    CVE-2012-3645 : Martin Barbella of Google Chrome Security Team using AddressSanitizer

    CVE-2012-3646 : Julien Chaffraix of the Chromium development community, Martin Barbella of Google Chrome Security Team using AddressSanitizer

    CVE-2012-3653 : Martin Barbella of Google Chrome Security Team using AddressSanitizer

    CVE-2012-3655 : Skylined of the Google Chrome Security Team

    CVE-2012-3656 : Abhishek Arya of Google Chrome Security Team using AddressSanitizer

    CVE-2012-3661 : Apple Product Security

    CVE-2012-3663 : Skylined of Google Chrome Security Team

    CVE-2012-3664 : Thomas Sepez of the Chromium development community

    CVE-2012-3665 : Martin Barbella of Google Chrome Security Team using AddressSanitizer

    CVE-2012-3666 : Apple

    CVE-2012-3667 : Trevor Squires of propaneapp.com

    CVE-2012-3668 : Apple Product Security

    CVE-2012-3669 : Apple Product Security

    CVE-2012-3670 : Abhishek Arya of Google Chrome Security Team using AddressSanitizer, Arthur Gerkis

    CVE-2012-3674 : Skylined of Google Chrome Security Team

    CVE-2012-3678 : Apple Product Security

    CVE-2012-3679 : Chris Leary of Mozilla

    CVE-2012-3680 : Skylined of Google Chrome Security Team

    CVE-2012-3681 : Apple

    CVE-2012-3682 : Adam Barth of the Google Chrome Security Team

    CVE-2012-3683 : wushi of team509 working with iDefense VCP

    CVE-2012-3686 : Robin Cao of Torch Mobile (Beijing)

  • WebKit

    Available for: OS X Lion v10.7.4, OS X Lion Server v10.7.4

    Impact: Dragging and dropping selected text on a web page may lead to a cross-site information disclosure

    Description: A cross-origin issue existed in the handling of drag and drop events. This issue is addressed through improved origin tracking.

    CVE-ID

    CVE-2012-3689 : David Bloom of Cue

  • WebKit

    Available for: OS X Lion v10.7.4, OS X Lion Server v10.7.4

    Impact: Dragging and dropping selected text on a web page may cause files from the user's system to be sent to a remote server

    Description: An access control issue existed in the handling of drag and drop events. This issue is addressed through improved origin tracking.

    CVE-ID

    CVE-2012-3690 : David Bloom of Cue

  • WebKit

    Available for: OS X Lion v10.7.4, OS X Lion Server v10.7.4

    Impact: Visiting a maliciously crafted website may lead to a cross-site disclosure of information

    Description: A cross-origin issue existed in the handling of CSS property values. This issue is addressed through improved origin tracking.

    CVE-ID

    CVE-2012-3691 : Apple

  • WebKit

    Available for: OS X Lion v10.7.4, OS X Lion Server v10.7.4

    Impact: A malicious website may be able to replace the contents of an iframe on another site

    Description: A cross-origin issue existed in the handling of iframes in popup windows. This issue is addressed through improved origin tracking.

    CVE-ID

    CVE-2011-3067 : Sergey Glazunov

  • WebKit

    Available for: OS X Lion v10.7.4, OS X Lion Server v10.7.4

    Impact: Visiting a maliciously crafted website may lead to a cross-site disclosure of information

    Description: A cross-origin issue existed in the handling of iframes and fragment identifiers. This issue is addressed through improved origin tracking.

    CVE-ID

    CVE-2012-2815 : Elie Bursztein, Baptiste Gourdin, Gustav Rydstedt, and Dan Boneh of the Stanford University Security Laboratory

  • WebKit

    Available for: OS X Lion v10.7.4, OS X Lion Server v10.7.4

    Impact: Look-alike characters in a URL could be used to masquerade a website

    Description: The International Domain Name (IDN) support and Unicode fonts embedded in Safari could have been used to create a URL which contains look-alike characters. These could have been used in a malicious website to direct the user to a spoofed site that visually appears to be a legitimate domain. This issue is addressed by supplementing WebKit's list of known look-alike characters. Look-alike characters are rendered in Punycode in the address bar.

    CVE-ID

    CVE-2012-3693 : Matt Cooley of Symantec

  • WebKit

    Available for: OS X Lion v10.7.4, OS X Lion Server v10.7.4

    Impact: Dragging and dropping a file to Safari may reveal the filesystem path of the file to the website

    Description: An information disclosure issue existed in the handling of dragged files. This issue is addressed through improved handling of dragged files.

    CVE-ID

    CVE-2012-3694 : Daniel Cheng of Google, Aaron Sigel of vtty.com

  • WebKit

    Available for: OS X Lion v10.7.4, OS X Lion Server v10.7.4

    Impact: Visiting a maliciously crafted website may lead to a cross-site scripting attack

    Description: A canonicalization issue existed in the handling of URLs. This may have lead to cross-site scripting on sites which use the location.href property. This issue is addressed through improved canonicalization of URLs.

    CVE-ID

    CVE-2012-3695 : Masato Kinugawa

  • WebKit

    Available for: OS X Lion v10.7.4, OS X Lion Server v10.7.4

    Impact: Visiting a maliciously crafted website may lead to HTTP request splitting

    Description: An HTTP header injection issue existed in the handling of WebSockets. This issue is addressed through improved WebSockets URI sanitization.

    CVE-ID

    CVE-2012-3696 : David Belcher of the BlackBerry Security Incident Response Team

  • WebKit

    Available for: OS X Lion v10.7.4, OS X Lion Server v10.7.4

    Impact: A maliciously crafted website may be able to spoof the value in the URL bar

    Description: A state management issue existed in the handling of session history. Navigations to a fragment on the current page may cause Safari to display incorrect information in the URL bar. This issue is addressed through improved session state tracking.

    CVE-ID

    CVE-2011-2845 : Jordi Chancel

  • WebKit

    Available for: OS X Lion v10.7.4, Lion Server v10.7.4

    Impact: An attacker may be able to escape the sandbox and access any file the current user has access to

    Description: An access control issue existed in the handling of file URLs. An attacker who gains arbitrary code execution in a Safari WebProcess may be able to bypass the sandbox and access any file that the user running Safari has access to. This issue is addressed through improved handling of file URLs.

    CVE-ID

    CVE-2012-3697 : Aaron Sigel of vtty.com

  • WebKit

    Available for: OS X Lion v10.7.4, Lion Server v10.7.4

    Impact: Visiting a maliciously crafted website may lead to the disclosure of the disclosure of memory contents

    Description: An uninitialized memory access issue existed in the handling of SVG images. This issue is addressed through improved memory initialization.

    CVE-ID

    CVE-2012-3650 : Apple

Information about products not manufactured by Apple, or independent websites not controlled or tested by Apple, is provided without recommendation or endorsement. Apple assumes no responsibility with regard to the selection, performance, or use of third-party websites or products. Apple makes no representations regarding third-party website accuracy or reliability. Contact the vendor for additional information.

Published Date: