Heap-based buffer overflow in CoreGraphics in Apple Safari before 3.2 on Windows, in iPhone OS 1.0 through 2.2.1, and in iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted image, related to improper handling of color spaces.

The remote host is running a version of Mac OS X 10.5 that is older than version 10.5.6.  Mac OS X 10.5.6 contains security fixes for the following products : 

  - ATS
  - BOM
  - CoreGraphics
  - CoreServices
  - CoreTypes
  - Flash Player Plug-in
  - Kernel
  - Libsystem
  - Managed Client
  - network_cmds
  - Podcast Producer
  - UDF

The remote host is running a version of Mac OS X 10.5.x that is prior to 10.5.6. 

Mac OS X 10.5.6 contains security fixes for the following products :

  - ATS
  - BOM
  - CoreGraphics
  - CoreServices
  - CoreTypes
  - Flash Player Plug-in
  - Kernel
  - Libsystem
  - Managed Client
  - network_cmds
  - Podcast Producer
  - UDF

The remote host is running a version of Mac OS X 10.4 that does not have Security Update 2008-008 applied. 

This security update contains fixes for the following products :

  - BOM
  - CoreGraphics
  - CoreServices
  - Flash Player Plug-in
  - Libsystem
  - network_cmds
  - UDF

The version of Safari installed on the remote Windows host is earlier than 3.2.  Such versions are potentially affected by several issues : 


  - Safari includes a version of zlib that is affected by multiple vulnerabilities. (CVE-2005-2096)
  - A heap buffer overflow issue in the libxslt library could lead to a crash or arbitrary code execution. (CVE-2008-1767)
  - A signedness issue in Safari's handling of JavaScript array indices could lead to a crash or arbitrary code execution. (CVE-2008-2303)
  - A memory corruption issue in WebCore's handling of style sheet elements could lead to a crash or arbitrary code execution. (CVE-2008-2317)
  - Multiple uninitialized memory access issues in libTIFF's handling of LZW-encoded TIFF images could lead to a crash or arbitrary code execution. (CVE-2008-2327)
  - A memory corruption issue in ImageIO's handling of TIFF images could lead to a crash or arbitrary code execution. (CVE-2008-2332).
  - A memory corruption issue in ImageIO's handling of embedded ICC profiles in JPEG images could lead to a crash or arbitrary code execution. (CVE-2008-3608)
  - A heap buffer overflow in CoreGraphics' handling of color spaces could lead to a crash or arbitrary code execution. (CVE-2008-3623)
  - A buffer overflow in the handling of images with an embedded ICC profile could lead to a crash or arbitrary code execution. (CVE-2008-3642)
  - Disabling autocomplete on a form field may not prevent the data in the field from being stored in the browser page cache. (CVE-2008-3644)
  - WebKit's plug-in interface does not block plug-ins from launching local URLs, which could allow a remote attacker to launch local files in Safari and lead to the disclosure of sensitive information. (CVE-2008-4216)

The version of Safari installed on the remote Windows host is earlier than 3.2.  Such versions are potentially affected by several issues :

  - Safari includes a version of zlib that is affected by     multiple vulnerabilities. (CVE-2005-2096)

  - A heap-based buffer overflow issue in the libxslt library     could lead to a crash or arbitrary code execution.
    (CVE-2008-1767)

  - A signedness issue in Safari's handling of JavaScript     array indices could lead to a crash or arbitrary code     execution. (CVE-2008-2303)

  - A memory corruption issue in WebCore's handling of style     sheet elements could lead to a crash or arbitrary code     execution. (CVE-2008-2317)

  - Multiple uninitialized memory access issues in libTIFF's     handling of LZW-encoded TIFF images could lead to a     crash or arbitrary code execution. (CVE-2008-2327)

  - A memory corruption issue in ImageIO's handling of TIFF     images could lead to a crash or arbitrary code     execution. (CVE-2008-2332).

  - A memory corruption issue in ImageIO's handling of     embedded ICC profiles in JPEG images could lead to a     crash or arbitrary code execution. (CVE-2008-3608)

  - A heap-based buffer overflow in CoreGraphics' handling     of color spaces could lead to a crash or arbitrary code     execution. (CVE-2008-3623)

  - A buffer overflow in the handling of images with an     embedded ICC profile could lead to a crash or arbitrary     code execution. (CVE-2008-3642)

  - Disabling autocomplete on a form field may not prevent     the data in the field from being stored in the browser     page cache. (CVE-2008-3644)

  - WebKit's plug-in interface does not block plug-ins from     launching local URLs, which could allow a remote     attacker to launch local files in Safari and lead to the     disclosure of sensitive information. (CVE-2008-4216)

The version of Safari installed on the remote Windows host is earlier than 3.2.  Such versions are potentially affected by several issues : 


  - Safari includes a version of zlib that is affected by multiple vulnerabilities. (CVE-2005-2096)
  - A heap buffer overflow issue in the libxslt library could lead to a crash or arbitrary code execution. (CVE-2008-1767)
  - A signedness issue in Safari's handling of JavaScript array indices could lead to a crash or arbitrary code execution. (CVE-2008-2303)
  - A memory corruption issue in WebCore's handling of style sheet elements could lead to a crash or arbitrary code execution. (CVE-2008-2317)
  - Multiple uninitialized memory access issues in libTIFF's handling of LZW-encoded TIFF images could lead to a crash or arbitrary code execution. (CVE-2008-2327)
  - A memory corruption issue in ImageIO's handling of TIFF images could lead to a crash or arbitrary code execution. (CVE-2008-2332).
  - A memory corruption issue in ImageIO's handling of embedded ICC profiles in JPEG images could lead to a crash or arbitrary code execution. (CVE-2008-3608)
  - A heap buffer overflow in CoreGraphics' handling of color spaces could lead to a crash or arbitrary code execution. (CVE-2008-3623)
  - A buffer overflow in the handling of images with an embedded ICC profile could lead to a crash or arbitrary code execution. (CVE-2008-3642)
  - Disabling autocomplete on a form field may not prevent the data in the field from being stored in the browser page cache. (CVE-2008-3644)
  - WebKit's plug-in interface does not block plug-ins from launching local URLs, which could allow a remote attacker to launch local files in Safari and lead to the disclosure of sensitive information. (CVE-2008-4216)

 
IAVB Reference : 2008-B-0078
STIG Finding Severity : Category I

ID	Name	Product	Family	Severity
4790	Mac OS X < 10.5.6 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical
4789	Mac OS X < 10.5.6 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical
35111	Mac OS X 10.5.x < 10.5.6 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
35110	Mac OS X Multiple Vulnerabilities (Security Update 2008-008)	Nessus	MacOS X Local Security Checks	critical
4754	Safari < 3.2 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
34772	Safari < 3.2 Multiple Vulnerabilities	Nessus	Windows	high
801019	Safari < 3.2 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
800794	Mac OS X < 10.5.6 Multiple Vulnerabilities	Log Correlation Engine	Operating System Detection	high

Detections

Analytics

CVE-2008-3623

high

Tenable Plugins

critical

critical

critical

critical

high

high

high

high