The BMP and GIF image decoding engine in ImageIO in Apple Mac OS X before 10.5.3 allows remote attackers to obtain sensitive information (memory contents) via a crafted (1) BMP or (2) GIF image, which causes an out-of-bounds read.

The version of Safari installed on the remote host reportedly is affected by several issues :

  - An out-of-bounds memory read while handling BMP and GIF     images may lead to information disclosure     (CVE-2008-1573).

  - Safari will automatically launch executable files     downloaded from a site if that site is in an IE7 zone     with 'Launching applications and unsafe files' set to     'Enable' or an IE6 'Local intranet ' / ' Trusted sites'     zone (CVE-2008-2306).

  - There is a memory corruption issue in WebKit's     handling of JavaScript arrays that could be leveraged     to crash the application or execute arbitrary code     if visiting a malicious site (CVE-2008-2307).

  - When handling an object with an unrecognized content     type, Safari does not prompt the user before     downloading the object (aka, the 'carpet-bombing'     issue). If the download location is the Windows     Desktop (the default), this could lead to arbitrary     code execution (CVE-2008-2540).

The remote host is running a version of Mac OS X 10.4 that does not have the security update 2008-003 applied. 

This update contains security fixes for a number of programs.

The remote host is running a version of Mac OS X 10.5.x that is prior to 10.5.3. 

Mac OS X 10.5.3 contains security fixes for a number of programs.

The version of Safari installed on the remote host reportedly is affected by several issues :

  - An out-of-bounds memory read while handling BMP and GIF images may lead to information disclosure (CVE-2008-1573).
  - Safari will automatically launch executable files downloaded from a site if that site is in an IE7 zone with 'Launching applications and unsafe files' set to 'Enable' or an IE6 'Local intranet ' / ' Trusted sites' zone (CVE-2008-2306).
  - There is a memory corruption issue in WebKit's handling of JavaScript arrays that could be leveraged to crash the application or execute arbitrary code if visiting a malicious site (CVE-2008-2307).
  - When handling an object with an unrecognized content type, Safari does not prompt the user before downloading the object (aka, the 'carpet-bombing' issue). If the download location is the Windows Desktop (the default), this could lead to arbitrary code execution (CVE-2008-2540).

The remote host is running a version of Mac OS X 10.5 that is older than version 10.5.3.  Mac OS X 10.5.3 contains security fixes for a number of programs.

ID	Name	Product	Family	Severity
33226	Safari < 3.1.2 Multiple Vulnerabilities	Nessus	Windows	high
32478	Mac OS X Multiple Vulnerabilities (Security Update 2008-003)	Nessus	MacOS X Local Security Checks	critical
32477	Mac OS X 10.5.x < 10.5.3 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
4556	Safari < 3.1.2 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
4523	Mac OS X < 10.5.3	Nessus Network Monitor	Generic	critical

Detections

Analytics

CVE-2008-1573

medium

Tenable Plugins

high

critical

critical

medium

critical