CVE-2008-2317 WebCore in Apple Safari does not properly perform garbage collection of JavaScript document elements, which allows remote attackers to execute arbitrary code or cause a denial of service (heap corrupt...
HighCVSS 9.3
EPSS 7.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
WebCore in Apple Safari does not properly perform garbage collection of JavaScript document elements, which allows remote attackers to execute arbitrary code or cause a denial of service (heap corruption and application crash) via a reference to the ownerNode property of a copied CSSStyleSheet object of a STYLE element, as originally demonstrated on Apple iPhone before 2.0 and iPod touch before 2.0, a different vulnerability than CVE-2008-1590.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apple Safari | All versions | No fix listed |
References
- APPLE-SA-2008-11-13 vendor-advisory
- APPLE-SA-2008-07-11 vendor-advisory
- 31074 third-party-advisory vendor-advisory
- 32706 third-party-advisory
- support.apple.com vendor-advisory
- 20080725 ZDI-08-045: Apple Safari StyleSheet ownerNode Heap Corruption Vulnerability mailing-list
- 30186 vdb-entry
- ADV-2008-2094 vdb-entry vendor-advisory
- www.zerodayinitiative.com
- ipod-iphone-stylesheets-code-execution(43737) vdb-entry