Security News

Apple has released Safari 6.1 with patches for 21 vulnerabilities to improve its web browser security. The Safari update addresses a number of Webkit flaws that may lead to information disclosure and cross-site scripting attacks, as well as a Safari vulnerability related to arbitrary code execution.

Safari 6.1 is available for OS X Lion 10.7.5, OS X Lion Server 10.7.5, OS X Mountain Lion 10.8.5. OS X Mavericks includes these fixes with Safari 7.0.

The following vulnerabilities were fixed in this update:

• CVE-2013-1036 : Safari in Apple iOS before 7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document.
• CVE-2013-1037, CVE-2013-1038, CVE-2013-1039, CVE-2013-1040, CVE-2013-1041, CVE-2013-1042, CVE-2013-1043, CVE-2013-1044, CVE-2013-1045, CVE-2013-1046, CVE-2013-1047, CVE-2013-5125, CVE-2013-5126, CVE-2013-5127, CVE-2013-5128 : Multiple memory corruption issues existed in WebKit that allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. These issues were addressed through improved memory handling.
• CVE-2013-2842 : Use-after-free vulnerability allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the handling of widgets.
• CVE-2013-2848 : XSS Auditor vulnerability might allow remote attackers to obtain sensitive information via unspecified vectors; visiting a maliciously crafted website may lead to an information disclosure. This issue was addressed through improved handling of URLs.
• CVE-2013-5129 : Multiple cross-site scripting (XSS) vulnerabilities in WebKit allow user-assisted remote attackers to inject arbitrary web script or HTML via vectors involving a (1) drag-and-drop or (2) copy-and-paste operation. Dragging or pasting a selection from one site to another may allow scripts contained in the selection to be executed in the context of the new site. This issue is addressed through additional validation of content before a paste or a drag and drop operation.
• CVE-2013-5130 : Using the Web Inspector disabled Private Browsing. Using the Web Inspector disabled Private Browsing without warning. This issue was addressed by improved state management.
• CVE-2013-5131 : Cross-site scripting (XSS) vulnerability in WebKit allows remote attackers to inject arbitrary web script or HTML via a crafted URL. A cross-site scripting issue existed in the handling of URLs. This issue was addressed through improved origin tracking.