Detections
Analytics
Safari < 6.2.1 / 7.1.1 / 8.0.1 Multiple Vulnerabilities
high Nessus Network Monitor Plugin ID 8642
Synopsis
The remote host is missing a critical Safari patch update.Description
According to its banner, the remote Safari browser is missing a security update to Webkit. Safari is bundled with Apple WebKit. Apple WebKit is affected by the following vulnerabilities :- There is a 'use-after-free' vulnerability which can allow remote attackers to execute arbitrary code through crafted page objects within HTML. (CVE-2014-4459)
- There is a policy bypass flaw which can allow remote attackers to bypass the 'Same Origin Policy' via Cascading Style Sheets. (CVE-2014-4465)
Solution
Upgrade to Safari 6.2.1 / 7.1.1 / 8.0.1 or later.See Also
Plugin Details
Severity: High
ID: 8642
Family: Web Clients
Published: 3/4/2015
Updated: 3/6/2019
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS v3
Risk Factor: High
Base Score: 7.3
Temporal Score: 7
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Temporal Vector: CVSS:3.0/E:X/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:apple:safari
Patch Publication Date: 3/5/2014
Vulnerability Publication Date: 3/5/2014
Reference Information
CVE: CVE-2014-4459, CVE-2014-4465