Cross-site scripting (XSS) vulnerability in Safari before 3.2.3, and 4 Public Beta, on Apple Mac OS X 10.5 before 10.5.7 and Windows allows remote attackers to inject arbitrary web script or HTML via a crafted feed: URL.

The version of Safari installed on the remote Windows host is earlier than 3.2.3.  Such versions are potentially affected by several issues :

  - A heap-based buffer overflow issue in the libxml library     when handling long entity names could lead to a crash or     arbitrary code execution. (CVE-2008-3529)

  - Multiple input validation issues exist in Safari's     handling of 'feed:' URLs, which could be abused to     execute arbitrary JavaScript code. (CVE-2009-0162)

  - A memory corruption issue in WebKit's handling of     SVGList objects could lead to arbitrary code execution.
    (CVE-2009-0945)

  - The browser uses the HTTP Host header to determine the     context of a 4xx/5xx CONNECT response from a proxy server.
    This could allow a man-in-the-middle attacker to execute     arbitrary script code in the context of a legitimate server,     circumventing the browser's same-origin policy. (CVE-2009-2058)

The remote host is running a version of Mac OS X 10.5.x that is prior to 10.5.7. 

Mac OS X 10.5.7 contains security fixes for the following products :

  - Apache
  - ATS
  - BIND
  - CFNetwork
  - CoreGraphics
  - Cscope
  - CUPS
  - Disk Images
  - enscript
  - Flash Player plug-in
  - Help Viewer
  - iChat
  - International Components for Unicode
  - IPSec
  - Kerberos
  - Kernel
  - Launch Services
  - libxml
  - Net-SNMP
  - Network Time
  - Networking
  - OpenSSL
  - PHP
  - QuickDraw Manager
  - ruby
  - Safari
  - Spotlight
  - system_cmds
  - telnet
  - Terminal
  - WebKit
  - X11

The version of Safari installed on the remote Windows host is earlier than 3.2.3.  Such versions are potentially affected by several issues :

 - A heap buffer overflow issue in the libxml library when handling long entity names could lead to a crash or arbitrary code execution. (CVE-2008-3529)

 - Multiple input validation issues exist in Safari's handling of 'feed:' URLs, which could be abused to execute arbitrary JavaScript code. (CVE-2009-0162)

 - A memory corruption issue in WebKit's handling of SVGList objects could lead to arbitrary code execution. (CVE-2009-0945) 

The remote host is running a version of Mac OS X 10.5 that is older than version 10.5.7.  Mac OS X 10.5.7 contains security fixes for the following products : 

- Apache
- ATS
- BIND
- CFNetwork
- CoreGraphics
-Cscope
- CUPS
- Disk Images
- enscript
- Flash player
- Help Viewer
- iChat
- Internation Components for Unicode
- IPSec
- Kerberos
- Kernel
- Launch Services
- libxml
- Net-SNMP
- Network Time
- Networking
- OpenSSL
- PHP
- QuickDraw Manager
- ruby
- Safari
- Spotlight
- system_cmds
- telnet
- WebKit
- X11
- Terminal

The version of Safari installed on the remote Windows host is earlier than 3.2.3.  Such versions are potentially affected by several issues :

 - A heap buffer overflow issue in the libxml library when handling long entity names could lead to a crash or arbitrary code execution. (CVE-2008-3529)

 - Multiple input validation issues exist in Safari's handling of 'feed:' URLs, which could be abused to execute arbitrary JavaScript code. (CVE-2009-0162)

 - A memory corruption issue in WebKit's handling of SVGList objects could lead to arbitrary code execution. (CVE-2009-0945)

ID	Name	Product	Family	Severity
38745	Safari < 3.2.3 Multiple Vulnerabilities	Nessus	Windows	high
38744	Mac OS X 10.5.x < 10.5.7 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
5024	Safari < 3.2.3 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
5023	Mac OS X 10.5 < 10.5.7 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical
800998	Safari < 3.2.3 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
800792	Mac OS X 10.5 < 10.5.7 Multiple Vulnerabilities	Log Correlation Engine	Operating System Detection	high

Detections

Analytics

CVE-2009-0162

medium

Tenable Plugins

high

critical

high

critical

high

high