Vulnerability Note VU#848960
Apple Mac OS X WebKit deallocated object access vulnerability
Apple Safari WebKit fails to properly deallocate objects. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary code.
According to Apple:
WebKit is the open source core of Apple's Safari web browser. It is available as a framework in Mac OS X for use in your applications.
The Apple Safari WebKit component fails to properly dispose of deallocated objects. If a remote attacker persuades a user to access a specially crafted web page with Safari, that attacker may be able to cause that user to access a deallocated object leading to memory corruption.
Note that this vulnerability may affect any software that uses WebKit.
A remote, unauthenticated attacker may be able to execute arbitrary code.
Apply Apple Updates
Systems Affected (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|Apple Computer, Inc.||Affected||-||29 Nov 2006|
|OmniGroup, Inc.||Affected||30 Nov 2006||15 Jan 2007|
CVSS Metrics (Learn More)
This vulnerability was reported in Apple Security Update 2006-007. Apple credits Tom Ferris of Security-Protocols with providing information about this vulnerability.
This document was written by Jeff Gennari based on information from Apple and Security-Protocols.
- CVE IDs: CVE-2006-4412
- Date Public: 28 Nov 2006
- Date First Published: 29 Nov 2006
- Date Last Updated: 15 Jan 2007
- Severity Metric: 15.80
- Document Revision: 14
If you have feedback, comments, or additional information about this vulnerability, please send us email.