CVE-2007-3186 Apple Safari Beta 3.0.1 for Windows allows remote attackers to execute arbitrary commands via shell metacharacters in a URI in the SRC of an IFRAME, as demonstrated using a gopher URI.
HighCVSS 9.3
EPSS 4.9%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Apple Safari Beta 3.0.1 for Windows allows remote attackers to execute arbitrary commands via shell metacharacters in a URI in the SRC of an IFRAME, as demonstrated using a gopher URI.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apple Safari | All versions | No fix listed |
| apple Safari | = 2.0 | No fix listed |
| apple Safari | = 2.0.1 | No fix listed |
| apple Safari | = 2.0.2 | No fix listed |
| apple Safari | = 2.0.3 | No fix listed |
| apple Safari | = 2.0.4 | No fix listed |
| apple Safari | = 3.0 | No fix listed |
| apple Safari | = 3.0.1 | No fix listed |
References
- larholm.com
- larholm.com
- APPLE-SA-2007-06-14 vendor-advisory
- 20070612 Safari for Windows, 0day URL protocol handler command injection mailing-list
- 38542 vdb-entry
- 20070612 Safari for Windows, 0day URL protocol handler command injection mailing-list
- 24434 vdb-entry
- 1018224 vdb-entry
- ADV-2007-2192 vdb-entry
- safari-urlprotocol-command-execution(34824) vdb-entry