Vulnerability in Apple Iphone OS
CVE-2010-1119
Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, Safari before 4.1 on Mac OS X 10.4, and Safari on Apple iPhone OS allows remote attackers to execute arbitrary code or cause a denial of service (application crash), or read the SMS database or other data, via vectors related to "attribute manipulation," as demonstrated by Vincenzo Iozzo and Ralf Philipp Weinmann during a Pwn2Own competition at CanSecWest 2010.
EPSS: 0.190 (97.0th percentile) — read the EPSS interpretation.
Affected products
- Apple Iphone_os — versions 2.0, 3.1.2, 3.0.1
- Apple Mac_os_x — versions 10.5, 10.6.0, 10.5.1
- Apple Mac_os_x_server — versions 10.6.0, 10.5.1, 10.5.7
- Apple Safari — versions 4.0.2, 3.1.2, 3.0.2b
- Microsoft Windows
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (x_refsource_MISC)
- cve@mitre.org (vendor-advisory, x_refsource_APPLE, Vendor Advisory)
- cve@mitre.org (vendor-advisory, x_refsource_APPLE, Patch, Vendor Advisory)
- cve@mitre.org (vendor-advisory, x_refsource_APPLE, Vendor Advisory)
- cve@mitre.org (x_refsource_MISC)
- cve@mitre.org (x_refsource_SECUNIA, third-party-advisory, Vendor Advisory)
- cve@mitre.org (x_refsource_SECUNIA, third-party-advisory, Vendor Advisory)
- cve@mitre.org (x_refsource_SREASON, third-party-advisory)
- cve@mitre.org (vdb-entry, x_refsource_SECTRACK)
- cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)