What is CVE-2014-1303?

CVE-2014-1303 is a vulnerability in Apple Safari, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. Published 2014-03-26.

Is CVE-2014-1303 known to be exploited?

3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Buffer overflow in Apple Safari

CVE-2014-1303

Heap-based buffer overflow in Apple Safari 7.0.2 allows remote attackers to execute arbitrary code and bypass a sandbox protection mechanism via unspecified vectors, as demonstrated by Liang Chen during a Pwn2Own competition at CanSecWest 2014.

Vulnerability class: Buffer Overflow

EPSS: 0.348 (98.3th percentile) — read the EPSS interpretation.

Affected products

Apple Safari — versions 7.0.2
N/a — versions n/a

Weakness classification (CWE)

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer

Public proof-of-concept exploits

References

product-security@apple.com (x_refsource_MISC)
product-security@apple.com (vendor-advisory, x_refsource_APPLE)
product-security@apple.com (x_refsource_CONFIRM)
product-security@apple.com (vendor-advisory, x_refsource_APPLE)
product-security@apple.com (vendor-advisory, x_refsource_APPLE)
product-security@apple.com (x_refsource_MISC)

Frequently asked questions

What is CVE-2014-1303?: CVE-2014-1303 is a vulnerability in Apple Safari, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. Published 2014-03-26.
Is CVE-2014-1303 known to be exploited?: 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.