Safari < 6.2 / 7.1 Multiple Vulnerabilities

high Nessus Network Monitor Plugin ID 8395

Synopsis

The remote host contains a web browser that is affected by multiple security vulnerabilities.

Description

The remote host has Safari installed that is older than 6.2 or 7.1, and is thus unpatched for the following WebKit vulnerabilities :

- Saved passwords and incorrect automatic filling of HTML forms contain an error that could be leveraged to obtain sensitive information. (CVE-2014-4363)
- Multiple memory corruption errors exist in WebKit that could potentially be leveraged for arbitrary code execution. (CVE-2013-6663, CVE-2014-4410, CVE-2014-4411, CVE-2014-4412, CVE-2014-4413, CVE-2014-4414, CVE-2014-4415)
- HTML5 application cache data handling with WebKit that allows the disclosure of sensitive information from private browsing sessions. (CVE-2014-4409)

Solution

Upgrade to Safari 7.1 or later. If version 7.x is not available, version 6.2 is also patched for these issues.

See Also

http://support.apple.com/kb/HT6440

Plugin Details

Severity: High

ID: 8395

Family: Web Clients

Published: 9/19/2014

Updated: 3/6/2019

Dependencies: 3705

Nessus ID: 77747

Risk Information

Risk Factor: High

CVSS v2.0

Base Score: 9.3

Temporal Score: 8.1

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:ND/RL:OF/RC:C

CVSS v3.0

Base Score: 8.1

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:X/RL:O/RC:C

Vulnerability Information

CPE: cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*

Patch Publication Date: 9/18/2014

Vulnerability Publication Date: 9/18/2014

Reference Information

CVE: CVE-2013-6663, CVE-2014-4411, CVE-2014-4363, CVE-2014-4415, CVE-2014-4410, CVE-2014-4412, CVE-2014-4413, CVE-2014-4414, CVE-2014-4409

BID: 65930, 69909, 69966, 69881, 69970, 69973, 69974, 69937, 69882