The Cascading Style Sheets (CSS) implementation in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, does not properly handle the :visited pseudo-class, which allows remote attackers to obtain sensitive information about visited web pages via a crafted HTML document.

Various bugs in webkit have been fixed. The CVE id's are :

CVE-2009-0945, CVE-2009-1681, CVE-2009-1684, CVE-2009-1685, CVE-2009-1686, CVE-2009-1687, CVE-2009-1688, CVE-2009-1689, CVE-2009-1691, CVE-2009-1690, CVE-2009-1692, CVE-2009-1693, CVE-2009-1694, CVE-2009-1695, CVE-2009-1696, CVE-2009-1697, CVE-2009-1698, CVE-2009-1699, CVE-2009-1700, CVE-2009-1701, CVE-2009-1702, CVE-2009-1703, CVE-2009-1709, CVE-2009-1710, CVE-2009-1711, CVE-2009-1712, CVE-2009-1713, CVE-2009-1714, CVE-2009-1715, CVE-2009-1718, CVE-2009-1724, CVE-2009-1725, CVE-2009-2195, CVE-2009-2199, CVE-2009-2200, CVE-2009-2419, CVE-2009-2797, CVE-2009-2816, CVE-2009-2841, CVE-2009-3272, CVE-2009-3384, CVE-2009-3933, CVE-2009-3934, CVE-2010-0046, CVE-2010-0047, CVE-2010-0048, CVE-2010-0049, CVE-2010-0050, CVE-2010-0052, CVE-2010-0053, CVE-2010-0054, CVE-2010-0315, CVE-2010-0647, CVE-2010-0051, CVE-2010-0650, CVE-2010-0651, CVE-2010-0656, CVE-2010-0659, CVE-2010-0661, CVE-2010-1029, CVE-2010-1126, CVE-2010-1233, CVE-2010-1236, CVE-2010-1386, CVE-2010-1387, CVE-2010-1388, CVE-2010-1389, CVE-2010-1390, CVE-2010-1391, CVE-2010-1392, CVE-2010-1393, CVE-2010-1394, CVE-2010-1395, CVE-2010-1396, CVE-2010-1397, CVE-2010-1398, CVE-2010-1399, CVE-2010-1400, CVE-2010-1401, CVE-2010-1402, CVE-2010-1403, CVE-2010-1404, CVE-2010-1405, CVE-2010-1406, CVE-2010-1407, CVE-2010-1408, CVE-2010-1409, CVE-2010-1410, CVE-2010-1412, CVE-2010-1413, CVE-2010-1414, CVE-2010-1415, CVE-2010-1416, CVE-2010-1417, CVE-2010-1418, CVE-2010-1419, CVE-2010-1421, CVE-2010-1422, CVE-2010-1729, CVE-2010-1749, CVE-2010-1757, CVE-2010-1758, CVE-2010-1759, CVE-2010-1760, CVE-2010-1761, CVE-2010-1762, CVE-2010-1763, CVE-2010-1764, CVE-2010-1766, CVE-2010-1767, CVE-2010-1769, CVE-2010-1770, CVE-2010-1771, CVE-2010-1772, CVE-2010-1773, CVE-2010-1774, CVE-2010-1780, CVE-2010-1781, CVE-2010-1782, CVE-2010-1783, CVE-2010-1784, CVE-2010-1785, CVE-2010-1786, CVE-2010-1787, CVE-2010-1788, CVE-2010-1789, CVE-2010-1790, CVE-2010-1791, CVE-2010-1792, CVE-2010-1793, CVE-2010-1807, CVE-2010-1812, CVE-2010-1813, CVE-2010-1814, CVE-2010-1815, CVE-2010-1822, CVE-2010-1823, CVE-2010-1824, CVE-2010-1825, CVE-2010-2264, CVE-2010-2295, CVE-2010-2297, CVE-2010-2300, CVE-2010-2301, CVE-2010-2302, CVE-2010-2441, CVE-2010-3116, CVE-2010-3257, CVE-2010-3259, CVE-2010-3312, CVE-2010-3803, CVE-2010-3804, CVE-2010-3805, CVE-2010-3808, CVE-2010-3809, CVE-2010-3810, CVE-2010-3811, CVE-2010-3812, CVE-2010-3813, CVE-2010-3816, CVE-2010-3817, CVE-2010-3818, CVE-2010-3819, CVE-2010-3820, CVE-2010-3821, CVE-2010-3822, CVE-2010-3823, CVE-2010-3824, CVE-2010-3826, CVE-2010-3829, CVE-2010-3900, CVE-2010-4040

Multiple cross-site scripting, denial of service and arbitrary code execution security flaws were discovered in webkit.

Please consult the CVE web links for further information.

The updated packages have been upgraded to the latest version (1.2.7) to correct these issues.

A large number of security issues were discovered in the WebKit browser and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary code execution.

Please consult the bug listed at the top of this advisory to get the exact list of CVE numbers fixed for each release.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Gustavo Noronha reports :

Debian's Michael Gilbert has done a great job going through all CVEs released about WebKit, and including patches in the Debian package.
1.2.3 includes all of the commits from trunk to fix those, too.

Versions of Safari earlier than 4.1 / 5.0 are potentially affected by multiple vulnerabilities :

  - A heap buffer overflow exists in the handling of images with an embedded ColorSync profile. (CVE-2009-1726)

  - Safari supports the inclusion of user information in URLs, which allows the URL to specify a username and password to authenticate the user to the named server. (CVE-2010-1384)

  - A use after free issue exists in Safari's management of windows. (CVE-2010-1750)

  - An implementation issue exists in WebKit's handling of URLs in the clipboard. (CVE-2010-1388)

  - Dragging or pasting a selection from one site to another may allow scripts contained in the selection to be executed in the context of the new site. (CVE-2010-1389)

  - A cononicalization issue exists in WebKit's handling of UTF-7 encoded text. (CVE-2010-1390)

  - A path traversal issue exists in WebKit's support for Local Storage and Web SQL database. (CVE-2010-1391)

  - A use after free issue exists in WebKit's rendering of HTML buttons. (CVE-2010-1392)

  - An information disclosure issue exists in WebKit's handling of Cascading Stylesheets. (CVE-2010-1393)

  - A use after free issue exists in WebKit's handling of attribute manipulation. (CVE-2010-1119)

  - A design issue exists in WebKit's handling of HTML document fragments. (CVE-2010-1394)

  - An implementation issue exists in WebKit's handling of keyboard focus. (CVE-2010-1422)

  - A scope management issue exists in WebKit's handling of DOM constructor objects. (CVE-2010-1395)

  - A use after free issue exists in WebKit's handling of the removal of container elements. (CVE-2010-1396)

  - A use after free issue exists in WebKit's rendering of a selection when the layout changes. (CVE-2010-1397)

  - A memory corruption issue exists in WebKit's handling of ordered list insertions. (CVE-2010-1398)

  - An uninitialized memory access issue exists in WebKit's handling of selection changes on form input elements. (CVE-2010-1399)

  - A use after free issue exists in WebKit's handling of caption elements. (CVE-2010-1400)

  - A use after free issue exists in WebKit's handling of the ':first-letter' pseudo-element in cascading stylesheets. (CVE-2010-1401)

  - a double free issue exists in WebKit's handling of event listeners in SVG documents. (CVE-2010-1402)

  - An uninitialized memory access issue exists in WebKit's handling of 'use' elements in SVG documents. (CVE-2010-1403)

  - A use after free issue exists in WebKit's handling of SVG documents with multiple 'use' elements. (CVE-2010-1404)

  - A memory corruption issue exists in WebKit's handling of nested 'use' elements in SVG documents. (CVE-2010-1410)

  - A use after free issue exists in WebKit's handling of CSS run-ins. (CVE-2010-1749)

  - A use after free issue exists in WebKit's handling of HTML elements with custom vertical positioning. (CVE-2010-1405)

  - When WebKit is redirected from an HTTPS site to an HTTP site, the Referer header is passed to the HTTP site. (CVE-2010-1406)

  - An integer truncation issue exists in WebKit's handling of requests to non-default TCP ports. (CVE-2010-1408)

  - Common IRC service ports are not included in WebKit's port blacklist. (CVE-2010-1409)

  - A use after free issue exists in WebKit's handling of hover events. (CVE-2010-1412)

  - In certain circumstances, WebKit may send NTLM credentials in plain text. (CVE-2010-1413)

  - A use after free issue exists in WebKit's handling of the removeChild DOM method. (CVE-2010-1414)

  - An API abuse issue exists in WebKit's handling of libxml contexts. (CVE-2010-1415)

  - A cross-site image capture issue exists in WebKit. (CVE-2010-1416)

  - A memory corruption issue exists in WebKit's rendering of CSS-styled HTML content with multiple :after pseudo-selectors. (CVE-2010-1417)

  - An input validation issue exists in WebKit's handling of the src attribute of the frame element (CVE-2010-1418)

  - A use after free issue exists in WebKit's handling of drag and drop when the window acting as a source of a drag operation is closed before the drag operation is completed. (CVE-2010-1419)

  - A design issue exists in the implementation of the JavaScript function execCommand. (CVE-2010-1421)

  - An issue in WebKit's handling of malformed URLs may result in a cross-site scripting attack when visiting a maliciously crafted website. (CVE-2010-0544)

  - A use after free issue exists in WebKit's handling of DOM Range objects. (CVE-2010-1758)

  - A use after free issue exists in WebKit's handling of the Node.normalize method. (CVE-2010-1759)

  - A use after free issue exist sin WebKit's rendering of HTML document subtrees. (CVE-2010-1761)

  - A design issue exists in the handling of HTML contained in textarea elements. (CVE-2010-1762)

  - A design issue exists in WebKit's handling of HTTP redirects. (CVE-2010-1764)

  - A type checking issue exists in WebKit's handling of text nodes. (CVE-2010-1770)

  - A use after free issue exists in WebKit's handling of fonts. (CVE-2010-1771)

  - An out of bounds memory access issue exists in WebKit's handling of HTML tables. (CVE-2010-1774)

  - A design issue exists in WebKit's handling of the CSS :visited pseudo-class.

The version of Safari installed on the remote Windows host is earlier than 5.0.  As such, it is potentially affected by numerous issues in the following components :

  - ColorSync

  - Safari

  - WebKit

The version of Apple Safari installed on the remote Mac OS X host is earlier than 5.0 / 4.1. As such, it is potentially affected by numerous issues in the following components :

  - Safari

  - WebKit

ID	Name	Product	Family	Severity
75629	openSUSE Security Update : libwebkit (openSUSE-SU-2011:0024-1)	Nessus	SuSE Local Security Checks	critical
53764	openSUSE Security Update : libwebkit (openSUSE-SU-2011:0024-1)	Nessus	SuSE Local Security Checks	critical
52523	Mandriva Linux Security Advisory : webkit (MDVSA-2011:039)	Nessus	Mandriva Local Security Checks	critical
50046	Ubuntu 9.10 / 10.04 LTS / 10.10 : webkit vulnerabilities (USN-1006-1)	Nessus	Ubuntu Local Security Checks	critical
47751	FreeBSD : webkit-gtk2 -- Multiple vulnerabilities (19419b3b-92bd-11df-b140-0015f2db7bde)	Nessus	FreeBSD Local Security Checks	critical
801012	Safari < 4.1 / 5.0 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
5566	Safari < 4.1 / 5.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	critical
46838	Safari < 5.0 Multiple Vulnerabilities	Nessus	Windows	high
46837	Mac OS X : Apple Safari < 5.0 / 4.1	Nessus	MacOS X Local Security Checks	high

Detections

Analytics

CVE-2010-2264

medium

Tenable Plugins

critical

critical

critical

critical

critical

high

critical

high

high