Safari < 6.2 / 7.1 Multiple Vulnerabilities

High Nessus Network Monitor Plugin ID 8395

Synopsis

The remote host contains a web browser that is affected by multiple security vulnerabilities.

Description

The remote host has Safari installed that is older than 6.2 or 7.1, and is thus unpatched for the following WebKit vulnerabilities :

- Saved passwords and incorrect automatic filling of HTML forms contain an error that could be leveraged to obtain sensitive information. (CVE-2014-4363)
- Multiple memory corruption errors exist in WebKit that could potentially be leveraged for arbitrary code execution. (CVE-2013-6663, CVE-2014-4410, CVE-2014-4411, CVE-2014-4412, CVE-2014-4413, CVE-2014-4414, CVE-2014-4415)
- HTML5 application cache data handling with WebKit that allows the disclosure of sensitive information from private browsing sessions. (CVE-2014-4409)

Solution

Upgrade to Safari 7.1 or later. If version 7.x is not available, version 6.2 is also patched for these issues.

See Also

http://support.apple.com/kb/HT6440

Plugin Details

Severity: High

ID: 8395

Family: Web Clients

Published: 2014/09/19

Modified: 2016/12/06

Dependencies: 3705

Nessus ID: 77747

Risk Information

Risk Factor: High

CVSSv2

Base Score: 9.3

Temporal Score: 8.1

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:ND/RL:OF/RC:C

CVSSv3

Base Score: 8.1

Temporal Score: 7.7

Vector: CVSS3#AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS3#E:X/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:apple:safari

Patch Publication Date: 2014/09/18

Vulnerability Publication Date: 2014/09/18

Reference Information

CVE: CVE-2013-6663, CVE-2014-4363, CVE-2014-4409, CVE-2014-4410, CVE-2014-4411, CVE-2014-4412, CVE-2014-4413, CVE-2014-4414, CVE-2014-4415

BID: 65930, 69881, 69882, 69909, 69937, 69966, 69970, 69973, 69974