Vulnerability in Apple Safari

CVE-2011-3845

Use-after-free vulnerability in Apple Safari 5.1.2, when a plug-in with a blocking function is installed, allows user-assisted remote attackers to execute arbitrary code via a crafted web page that is accessed during user interaction with the plug-in, leading to improper coordination between an API call and the plug-in unloading functionality, as demonstrated by the Adobe Flash and RealPlayer plug-ins.

EPSS: 0.028 (84.9th percentile) — read the EPSS interpretation.

Affected products

Apple Safari — versions 5.1.2
N/a — versions n/a

Weakness classification (CWE)

CWE-399

References

PSIRT-CNA@flexerasoftware.com (vdb-entry, x_refsource_XF)
PSIRT-CNA@flexerasoftware.com (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
PSIRT-CNA@flexerasoftware.com (x_refsource_OSVDB, vdb-entry)
PSIRT-CNA@flexerasoftware.com (vdb-entry, x_refsource_BID)