CVE-2006-1988
Safari 2.0.3 - Denial of Service via Large LI VALUE Attribute
Title source: llmDescription
The WebTextRenderer(WebInternal) _CG_drawRun:style:geometry: function in Apple Safari 2.0.3 allows remote attackers to cause a denial of service (application crash) via an HTML LI tag with a large VALUE attribute (list item number), which triggers a null dereference in QPainter::drawText, probably due to a failed memory allocation that uses the VALUE.
References (7)
Core 7
Core References
Exploit, Vendor Advisory x_refsource_misc
http://www.security-protocols.com/sp-x26-advisory.php
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/25946
Third Party Advisory vdb-entry
x_refsource_vupen
http://www.vupen.com/english/advisories/2006/1452
Various Sources x_refsource_misc
http://security-protocols.com/poc/sp-x26-2.html
Exploit vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/17634
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://www.osvdb.org/24823
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/19686
Scores
EPSS
0.0185
EPSS Percentile
76.9%
Details
Status
published
Products (4)
apple/safari
2.0
apple/safari
2.0.1
apple/safari
2.0.2
apple/safari
2.0.3
Published
Apr 21, 2006
Tracked Since
Feb 18, 2026