CVE-2014-4459

Safari 6.0-6.2.1 - Remote Code Execution via Crafted Page Objects

Title source: llm
STIX 2.1

Description

Use-after-free vulnerability in WebKit, as used in Apple OS X before 10.10.1, allows remote attackers to execute arbitrary code via crafted page objects in an HTML document.

References (15)

Core 15
Core References
Vendor Advisory x_refsource_confirm
http://support.apple.com/HT204245
Vendor Advisory x_refsource_confirm
http://support.apple.com/HT204246
Mailing List, Vendor Advisory vendor-advisory x_refsource_apple
http://lists.apple.com/archives/security-announce/2015/Jun/msg00006.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1031230
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/62503
Mailing List, Vendor Advisory vendor-advisory x_refsource_apple
http://lists.apple.com/archives/security-announce/2014/Nov/msg00001.html
Vendor Advisory x_refsource_confirm
https://support.apple.com/en-us/HT204419
Mailing List, Vendor Advisory vendor-advisory x_refsource_apple
http://lists.apple.com/archives/security-announce/2015/Jan/msg00001.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/71144
Vendor Advisory x_refsource_confirm
https://support.apple.com/kb/HT204949
Mailing List, Vendor Advisory vendor-advisory x_refsource_apple
http://lists.apple.com/archives/security-announce/2015/Jan/msg00000.html
Vendor Advisory x_refsource_confirm
http://support.apple.com/kb/HT6596
Mailing List, Vendor Advisory vendor-advisory x_refsource_apple
http://lists.apple.com/archives/security-announce/2014/Dec/msg00000.html
Vendor Advisory x_refsource_confirm
https://support.apple.com/en-us/HT6591
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/98784

Scores

EPSS 0.0458
EPSS Percentile 90.6%

Details

Status published
Products (5)
apple/iphone_os < 8.1.3
apple/itunes < 12.2
apple/mac_os_x < 10.10.1
apple/safari 6.0 - 6.2.1
apple/tvos < 7.0.3
Published Nov 18, 2014
Tracked Since Feb 18, 2026