CVE-2011-1344

Safari < 5.0.5 - Remote Code Execution via Use-After-Free in WBR Tag Handling

Title source: llm
STIX 2.1

Description

Use-after-free vulnerability in WebKit, as used in Apple Safari before 5.0.5; iOS before 4.3.2 for iPhone, iPod, and iPad; iOS before 4.2.7 for iPhone 4 (CDMA); and possibly other products allows remote attackers to execute arbitrary code by adding children to a WBR tag and then removing the tag, related to text nodes, as demonstrated by Chaouki Bekrar during a Pwn2Own competition at CanSecWest 2011.

References (18)

Core 18
Core References
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/44151
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/517517/100/0/threaded
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/46822
Vendor Advisory x_refsource_confirm
http://support.apple.com/kb/HT4596
Mailing List vendor-advisory x_refsource_apple
http://lists.apple.com/archives/security-announce/2011//Apr/msg00002.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1025363
Mailing List vendor-advisory x_refsource_apple
http://lists.apple.com/archives/security-announce/2011//Apr/msg00001.html
Third Party Advisory x_refsource_misc
http://www.zerodayinitiative.com/advisories/ZDI-11-135
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2011/0984
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/517505/100/0/threaded
Vendor Advisory x_refsource_confirm
http://support.apple.com/kb/HT4607
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/66061
Mailing List vendor-advisory x_refsource_apple
http://lists.apple.com/archives/security-announce/2011//Apr/msg00000.html
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/44154

Scores

EPSS 0.0592
EPSS Percentile 92.5%

Details

CWE
CWE-399
Status published
Products (46)
apple/iphone_os 1.0.0
apple/iphone_os 1.0.1
apple/iphone_os 1.0.2
apple/iphone_os 1.1.0
apple/iphone_os 1.1.1
apple/iphone_os 1.1.2
apple/iphone_os 1.1.3
apple/iphone_os 1.1.4
apple/iphone_os 1.1.5
apple/iphone_os 2.0
... and 36 more
Published Mar 10, 2011
Tracked Since Feb 18, 2026