CVE-2011-1774

Cross Platform Webkit File Dropper

Title source: metasploit

Description

WebKit in Apple Safari before 5.0.6 has improper libxslt security settings, which allows remote attackers to create arbitrary files, and consequently execute arbitrary code, via a crafted web site. NOTE: this may overlap CVE-2011-1425.

Exploits (3)

exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotewindows
https://www.exploit-db.com/exploits/17993
metasploit WORKING POC
by Nicolas Gregoire · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/server/webkit_xslt_dropper.rb
metasploit WORKING POC EXCELLENT
by Nicolas Gregoire · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/safari_xslt_output.rb

Scores

EPSS 0.7624
EPSS Percentile 98.9%

Details

CWE
CWE-20
Status published
Products (40)
apple/safari 1.0 (3 CPE variants)
apple/safari 1.0.0
apple/safari 1.0.0b1
apple/safari 1.0.0b2
apple/safari 1.0.1
apple/safari 1.0.2
apple/safari 1.0.3 (3 CPE variants)
apple/safari 1.1
apple/safari 1.1.0
apple/safari 1.1.1
... and 30 more
Published Jul 21, 2011
Tracked Since Feb 18, 2026