webkit の多様なバグが修正されています。CVE ID は以下のとおりです。

CVE-2009-0945、CVE-2009-1681、CVE-2009-1684、CVE-2009-1685、CVE-2009-1686、CVE-2009-1687、CVE-2009-1688、CVE-2009-1689、CVE-2009-1691、CVE-2009-1690、CVE-2009-1692、CVE-2009-1693、CVE-2009-1694、CVE-2009-1695、CVE-2009-1696、CVE-2009-1697、CVE-2009-1698、CVE-2009-1699、CVE-2009-1700、CVE-2009-1701、CVE-2009-1702、CVE-2009-1703、CVE-2009-1709、CVE-2009-1710、CVE-2009-1711、CVE-2009-1712、CVE-2009-1713、CVE-2009-1714、CVE-2009-1715、CVE-2009-1718、CVE-2009-1724、CVE-2009-1725、CVE-2009-2195、CVE-2009-2199、CVE-2009-2200、CVE-2009-2419、CVE-2009-2797、CVE-2009-2816、CVE-2009-2841、CVE-2009-3272、CVE-2009-3384、CVE-2009-3933、CVE-2009-3934、CVE-2010-0046、CVE-2010-0047、CVE-2010-0048、CVE-2010-0049、CVE-2010-0050、CVE-2010-0052、CVE-2010-0053、CVE-2010-0054、CVE-2010-0315、CVE-2010-0647、CVE-2010-0051、CVE-2010-0650、CVE-2010-0651、CVE-2010-0656、CVE-2010-0659、CVE-2010-0661、CVE-2010-1029、CVE-2010-1126、CVE-2010-1233、CVE-2010-1236、CVE-2010-1386、CVE-2010-1387、CVE-2010-1388、CVE-2010-1389、CVE-2010-1390、CVE-2010-1391、CVE-2010-1392、CVE-2010-1393、CVE-2010-1394、CVE-2010-1395、CVE-2010-1396、CVE-2010-1397、CVE-2010-1398、CVE-2010-1399、CVE-2010-1400、CVE-2010-1401、CVE-2010-1402、CVE-2010-1403、CVE-2010-1404、CVE-2010-1405、CVE-2010-1406、CVE-2010-1407、CVE-2010-1408、CVE-2010-1409、CVE-2010-1410、CVE-2010-1412、CVE-2010-1413、CVE-2010-1414、CVE-2010-1415、CVE-2010-1416、CVE-2010-1417、CVE-2010-1418、CVE-2010-1419、CVE-2010-1421、CVE-2010-1422、CVE-2010-1729、CVE-2010-1749、CVE-2010-1757、CVE-2010-1758、CVE-2010-1759、CVE-2010-1760、CVE-2010-1761、CVE-2010-1762、CVE-2010-1763、CVE-2010-1764、CVE-2010-1766、CVE-2010-1767、CVE-2010-1769、CVE-2010-1770、CVE-2010-1771、CVE-2010-1772、CVE-2010-1773、CVE-2010-1774、CVE-2010-1780、CVE-2010-1781、CVE-2010-1782、CVE-2010-1783、CVE-2010-1784、CVE-2010-1785、CVE-2010-1786、CVE-2010-1787、CVE-2010-1788、CVE-2010-1789、CVE-2010-1790、CVE-2010-1791、CVE-2010-1792、CVE-2010-1793、CVE-2010-1807、CVE-2010-1812、CVE-2010-1813、CVE-2010-1814、CVE-2010-1815、CVE-2010-1822、CVE-2010-1823、CVE-2010-1824、CVE-2010-1825、CVE-2010-2264、CVE-2010-2295、CVE-2010-2297、CVE-2010-2300、CVE-2010-2301、CVE-2010-2302、CVE-2010-2441、CVE-2010-3116、CVE-2010-3257、CVE-2010-3259、CVE-2010-3312、CVE-2010-3803、CVE-2010-3804、CVE-2010-3805、CVE-2010-3808、CVE-2010-3809、CVE-2010-3810、CVE-2010-3811、CVE-2010-3812、CVE-2010-3813、CVE-2010-3816、CVE-2010-3817、CVE-2010-3818、CVE-2010-3819、CVE-2010-3820、CVE-2010-3821、CVE-2010-3822、CVE-2010-3823、CVE-2010-3824、CVE-2010-3826、CVE-2010-3829、CVE-2010-3900、CVE-2010-4040

webkit 中的數個錯誤已經修正。CVE id 包括：

CVE-2009-0945、CVE-2009-1681、CVE-2009-1684、CVE-2009-1685、 CVE-2009-1686、CVE-2009-1687、CVE-2009-1688、CVE-2009-1689、 CVE-2009-1691、CVE-2009-1690、CVE-2009-1692、CVE-2009-1693、 CVE-2009-1694、CVE-2009-1695、CVE-2009-1696、CVE-2009-1697、 CVE-2009-1698、CVE-2009-1699、CVE-2009-1700、CVE-2009-1701、 CVE-2009-1702、CVE-2009-1703、CVE-2009-1709、CVE-2009-1710、 CVE-2009-1711、CVE-2009-1712、CVE-2009-1713、CVE-2009-1714、 CVE-2009-1715、CVE-2009-1718、CVE-2009-1724、CVE-2009-1725、 CVE-2009-2195、CVE-2009-2199、CVE-2009-2200、CVE-2009-2419、 CVE-2009-2797、CVE-2009-2816、CVE-2009-2841、CVE-2009-3272、 CVE-2009-3384、CVE-2009-3933、CVE-2009-3934、CVE-2010-0046、 CVE-2010-0047、CVE-2010-0048、CVE-2010-0049、CVE-2010-0050、 CVE-2010-0052、CVE-2010-0053、CVE-2010-0054、CVE-2010-0315、 CVE-2010-0647、CVE-2010-0051、CVE-2010-0650、CVE-2010-0651、 CVE-2010-0656、CVE-2010-0659、CVE-2010-0661、CVE-2010-1029、 CVE-2010-1126、CVE-2010-1233、CVE-2010-1236、CVE-2010-1386、 CVE-2010-1387、CVE-2010-1388、CVE-2010-1389、CVE-2010-1390、 CVE-2010-1391、CVE-2010-1392、CVE-2010-1393、CVE-2010-1394、 CVE-2010-1395、CVE-2010-1396、CVE-2010-1397、CVE-2010-1398、 CVE-2010-1399、CVE-2010-1400、CVE-2010-1401、CVE-2010-1402、 CVE-2010-1403、CVE-2010-1404、CVE-2010-1405、CVE-2010-1406、 CVE-2010-1407、CVE-2010-1408、CVE-2010-1409、CVE-2010-1410、 CVE-2010-1412、CVE-2010-1413、CVE-2010-1414、CVE-2010-1415、 CVE-2010-1416、CVE-2010-1417、CVE-2010-1418、CVE-2010-1419、 CVE-2010-1421、CVE-2010-1422、CVE-2010-1729、CVE-2010-1749、 CVE-2010-1757、CVE-2010-1758、CVE-2010-1759、CVE-2010-1760、 CVE-2010-1761、CVE-2010-1762、CVE-2010-1763、CVE-2010-1764、 CVE-2010-1766、CVE-2010-1767、CVE-2010-1769、CVE-2010-1770、 CVE-2010-1771、CVE-2010-1772、CVE-2010-1773、CVE-2010-1774、 CVE-2010-1780、CVE-2010-1781、CVE-2010-1782、CVE-2010-1783、 CVE-2010-1784、CVE-2010-1785、CVE-2010-1786、CVE-2010-1787、 CVE-2010-1788、CVE-2010-1789、CVE-2010-1790、CVE-2010-1791、 CVE-2010-1792、CVE-2010-1793、CVE-2010-1807、CVE-2010-1812、 CVE-2010-1813、CVE-2010-1814、CVE-2010-1815、CVE-2010-1822、 CVE-2010-1823、CVE-2010-1824、CVE-2010-1825、CVE-2010-2264、 CVE-2010-2295、CVE-2010-2297、CVE-2010-2300、CVE-2010-2301、 CVE-2010-2302、CVE-2010-2441、CVE-2010-3116、CVE-2010-3257、 CVE-2010-3259、CVE-2010-3312、CVE-2010-3803、CVE-2010-3804、 CVE-2010-3805、CVE-2010-3808、CVE-2010-3809、CVE-2010-3810、 CVE-2010-3811、CVE-2010-3812、CVE-2010-3813、CVE-2010-3816、 CVE-2010-3817、CVE-2010-3818、CVE-2010-3819、CVE-2010-3820、 CVE-2010-3821、CVE-2010-3822、CVE-2010-3823、CVE-2010-3824、 CVE-2010-3826、CVE-2010-3829、CVE-2010-3900、CVE-2010-4040

webkit の多様なバグが修正されています。CVE ID は以下のとおりです。

CVE-2009-0945、CVE-2009-1681、CVE-2009-1684、CVE-2009-1685、 CVE-2009-1686、CVE-2009-1687、CVE-2009-1688、CVE-2009-1689、 CVE-2009-1691、CVE-2009-1690、CVE-2009-1692、CVE-2009-1693、 CVE-2009-1694、CVE-2009-1695、CVE-2009-1696、CVE-2009-1697、 CVE-2009-1698、CVE-2009-1699、CVE-2009-1700、CVE-2009-1701、 CVE-2009-1702、CVE-2009-1703、CVE-2009-1709、CVE-2009-1710、 CVE-2009-1711、CVE-2009-1712、CVE-2009-1713、CVE-2009-1714、 CVE-2009-1715、CVE-2009-1718、CVE-2009-1724、CVE-2009-1725、 CVE-2009-2195、CVE-2009-2199、CVE-2009-2200、CVE-2009-2419、 CVE-2009-2797、CVE-2009-2816、CVE-2009-2841、CVE-2009-3272、 CVE-2009-3384、CVE-2009-3933、CVE-2009-3934、CVE-2010-0046、 CVE-2010-0047、CVE-2010-0048、CVE-2010-0049、CVE-2010-0050、 CVE-2010-0052、CVE-2010-0053、CVE-2010-0054、CVE-2010-0315、 CVE-2010-0647、CVE-2010-0051、CVE-2010-0650、CVE-2010-0651、 CVE-2010-0656、CVE-2010-0659、CVE-2010-0661、CVE-2010-1029、 CVE-2010-1126、CVE-2010-1233、CVE-2010-1236、CVE-2010-1386、 CVE-2010-1387、CVE-2010-1388、CVE-2010-1389、CVE-2010-1390、 CVE-2010-1391、CVE-2010-1392、CVE-2010-1393、CVE-2010-1394、 CVE-2010-1395、CVE-2010-1396、CVE-2010-1397、CVE-2010-1398、 CVE-2010-1399、CVE-2010-1400、CVE-2010-1401、CVE-2010-1402、 CVE-2010-1403、CVE-2010-1404、CVE-2010-1405、CVE-2010-1406、 CVE-2010-1407、CVE-2010-1408、CVE-2010-1409、CVE-2010-1410、 CVE-2010-1412、CVE-2010-1413、CVE-2010-1414、CVE-2010-1415、 CVE-2010-1416、CVE-2010-1417、CVE-2010-1418、CVE-2010-1419、 CVE-2010-1421、CVE-2010-1422、CVE-2010-1729、CVE-2010-1749、 CVE-2010-1757、CVE-2010-1758、CVE-2010-1759、CVE-2010-1760、 CVE-2010-1761、CVE-2010-1762、CVE-2010-1763、CVE-2010-1764、 CVE-2010-1766、CVE-2010-1767、CVE-2010-1769、CVE-2010-1770、 CVE-2010-1771、CVE-2010-1772、CVE-2010-1773、CVE-2010-1774、 CVE-2010-1780、CVE-2010-1781、CVE-2010-1782、CVE-2010-1783、 CVE-2010-1784、CVE-2010-1785、CVE-2010-1786、CVE-2010-1787、 CVE-2010-1788、CVE-2010-1789、CVE-2010-1790、CVE-2010-1791、 CVE-2010-1792、CVE-2010-1793、CVE-2010-1807、CVE-2010-1812、 CVE-2010-1813、CVE-2010-1814、CVE-2010-1815、CVE-2010-1822、 CVE-2010-1823、CVE-2010-1824、CVE-2010-1825、CVE-2010-2264、 CVE-2010-2295、CVE-2010-2297、CVE-2010-2300、CVE-2010-2301、 CVE-2010-2302、CVE-2010-2441、CVE-2010-3116、CVE-2010-3257、 CVE-2010-3259、CVE-2010-3312、CVE-2010-3803、CVE-2010-3804、 CVE-2010-3805、CVE-2010-3808、CVE-2010-3809、CVE-2010-3810、 CVE-2010-3811、CVE-2010-3812、CVE-2010-3813、CVE-2010-3816、 CVE-2010-3817、CVE-2010-3818、CVE-2010-3819、CVE-2010-3820、 CVE-2010-3821、CVE-2010-3822、CVE-2010-3823、CVE-2010-3824、 CVE-2010-3826、CVE-2010-3829、CVE-2010-3900、CVE-2010-4040

The version of Safari installed on the remote Windows host is earlier than 4.0.4.  Such versions are potentially affected by several issues :

  - An integer overflow in the handling of images with an     embedded color profile could lead to a crash or     arbitrary code execution. (CVE-2009-2804)

  - Multiple use-after-free issues exist in libxml2, the     most serious of which could lead to a program crash.
    (CVE-2009-2414, CVE-2009-2416)

  - An issue in the handling of navigations initiated via     the 'Open Image in New Tab', 'Open Image in New Window'     or 'Open Link in New Tab' shortcut menu options could     be exploited to load a local HTML file, leading to     disclosure of sensitive information. (CVE-2009-2842)

  - An issue involving WebKit's inclusion of custom HTTP     headers specified by a requesting page in preflight     requests in support of Cross-Origin Resource Sharing     can facilitate cross-site request forgery attacks.     (CVE-2009-2816)

  - Multiple issues in WebKit's handling of FTP directory     listings may lead to information disclosure, unexpected     application termination, or execution of arbitrary     code. (CVE-2009-3384)

A security flaw was found in the WebKit's Cross-Origin Resource Sharing (CORS) implementation. Multiple security flaws (integer underflow, invalid pointer dereference, buffer underflow and a denial of service) were found in the way WebKit's FTP parser used to process remote FTP directory listings.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

已修复 webkit 中的各种缺陷。CVE id 如下：

CVE-2009-0945、CVE-2009-1681、CVE-2009-1684、CVE-2009-1685、CVE-2009-1686、CVE-2009-1687、CVE-2009-1688、CVE-2009-1689、CVE-2009-1691、CVE-2009-1690、CVE-2009-1692、CVE-2009-1693、CVE-2009-1694、CVE-2009-1695、CVE-2009-1696、CVE-2009-1697、CVE-2009-1698、CVE-2009-1699、CVE-2009-1700、CVE-2009-1701、CVE-2009-1702、CVE-2009-1703、CVE-2009-1709、CVE-2009-1710、CVE-2009-1711、CVE-2009-1712、CVE-2009-1713、CVE-2009-1714、CVE-2009-1715、CVE-2009-1718、CVE-2009-1724、CVE-2009-1725、CVE-2009-2195、CVE-2009-2199、CVE-2009-2200、CVE-2009-2419、CVE-2009-2797、CVE-2009-2816、CVE-2009-2841、CVE-2009-3272、CVE-2009-3384、CVE-2009-3933、CVE-2009-3934、CVE-2010-0046、CVE-2010-0047、CVE-2010-0048、CVE-2010-0049、CVE-2010-0050、CVE-2010-0052、CVE-2010-0053、CVE-2010-0054、CVE-2010-0315、CVE-2010-0647、CVE-2010-0051、CVE-2010-0650、CVE-2010-0651、CVE-2010-0656、CVE-2010-0659、CVE-2010-0661、CVE-2010-1029、CVE-2010-1126、CVE-2010-1233、CVE-2010-1236、CVE-2010-1386、CVE-2010-1387、CVE-2010-1388、CVE-2010-1389、CVE-2010-1390、CVE-2010-1391、CVE-2010-1392、CVE-2010-1393、CVE-2010-1394、CVE-2010-1395、CVE-2010-1396、CVE-2010-1397、CVE-2010-1398、CVE-2010-1399、CVE-2010-1400、CVE-2010-1401、CVE-2010-1402、CVE-2010-1403、CVE-2010-1404、CVE-2010-1405、CVE-2010-1406、CVE-2010-1407、CVE-2010-1408、CVE-2010-1409、CVE-2010-1410、CVE-2010-1412、CVE-2010-1413、CVE-2010-1414、CVE-2010-1415、CVE-2010-1416、CVE-2010-1417、CVE-2010-1418、CVE-2010-1419、CVE-2010-1421、CVE-2010-1422、CVE-2010-1729、CVE-2010-1749、CVE-2010-1757、CVE-2010-1758、CVE-2010-1759、CVE-2010-1760、CVE-2010-1761、CVE-2010-1762、CVE-2010-1763、CVE-2010-1764、CVE-2010-1766、CVE-2010-1767、CVE-2010-1769、CVE-2010-1770、CVE-2010-1771、CVE-2010-1772、CVE-2010-1773、CVE-2010-1774、CVE-2010-1780、CVE-2010-1781、CVE-2010-1782、CVE-2010-1783、CVE-2010-1784、CVE-2010-1785、CVE-2010-1786、CVE-2010-1787、CVE-2010-1788、CVE-2010-1789、CVE-2010-1790、CVE-2010-1791、CVE-2010-1792、CVE-2010-1793、CVE-2010-1807、CVE-2010-1812、CVE-2010-1813、CVE-2010-1814、CVE-2010-1815、CVE-2010-1822、CVE-2010-1823、CVE-2010-1824、CVE-2010-1825、CVE-2010-2264、CVE-2010-2295、CVE-2010-2297、CVE-2010-2300、CVE-2010-2301、CVE-2010-2302、CVE-2010-2441、CVE-2010-3116、CVE-2010-3257、CVE-2010-3259、CVE-2010-3312、CVE-2010-3803、CVE-2010-3804、CVE-2010-3805、CVE-2010-3808、CVE-2010-3809、CVE-2010-3810、CVE-2010-3811、CVE-2010-3812、CVE-2010-3813、CVE-2010-3816、CVE-2010-3817、CVE-2010-3818、CVE-2010-3819、CVE-2010-3820、CVE-2010-3821、CVE-2010-3822、CVE-2010-3823、CVE-2010-3824、CVE-2010-3826、CVE-2010-3829、CVE-2010-3900、CVE-2010-4040

The version of Apple Safari installed on the remote Mac OS X host is earlier than 4.0.4.  As such, it is potentially affected by several issues :

  - Multiple use-after-free issues exist in libxml2, the     most serious of which could lead to a program crash.
    (CVE-2009-2414, CVE-2009-2416)

  - An issue in the handling of navigations initiated via     the 'Open Image in New Tab', 'Open Image in New Window'     or 'Open Link in New Tab' shortcut menu options could     be exploited to load a local HTML file, leading to     disclosure of sensitive information. (CVE-2009-2842)

  - An issue involving WebKit's inclusion of custom HTTP     headers specified by a requesting page in preflight     requests in support of Cross-Origin Resource Sharing     can facilitate cross-site request forgery attacks.     (CVE-2009-2816)

  - WebKit fails to issue a resource load callback to     determine if a resource should be loaded when it     encounters an HTML 5 Media Element pointing to an     external resource, which could lead to undesired     requests to remote servers. (CVE-2009-2841)

Various bugs in webkit have been fixed. The CVE id's are :

CVE-2009-0945, CVE-2009-1681, CVE-2009-1684, CVE-2009-1685, CVE-2009-1686, CVE-2009-1687, CVE-2009-1688, CVE-2009-1689, CVE-2009-1691, CVE-2009-1690, CVE-2009-1692, CVE-2009-1693, CVE-2009-1694, CVE-2009-1695, CVE-2009-1696, CVE-2009-1697, CVE-2009-1698, CVE-2009-1699, CVE-2009-1700, CVE-2009-1701, CVE-2009-1702, CVE-2009-1703, CVE-2009-1709, CVE-2009-1710, CVE-2009-1711, CVE-2009-1712, CVE-2009-1713, CVE-2009-1714, CVE-2009-1715, CVE-2009-1718, CVE-2009-1724, CVE-2009-1725, CVE-2009-2195, CVE-2009-2199, CVE-2009-2200, CVE-2009-2419, CVE-2009-2797, CVE-2009-2816, CVE-2009-2841, CVE-2009-3272, CVE-2009-3384, CVE-2009-3933, CVE-2009-3934, CVE-2010-0046, CVE-2010-0047, CVE-2010-0048, CVE-2010-0049, CVE-2010-0050, CVE-2010-0052, CVE-2010-0053, CVE-2010-0054, CVE-2010-0315, CVE-2010-0647, CVE-2010-0051, CVE-2010-0650, CVE-2010-0651, CVE-2010-0656, CVE-2010-0659, CVE-2010-0661, CVE-2010-1029, CVE-2010-1126, CVE-2010-1233, CVE-2010-1236, CVE-2010-1386, CVE-2010-1387, CVE-2010-1388, CVE-2010-1389, CVE-2010-1390, CVE-2010-1391, CVE-2010-1392, CVE-2010-1393, CVE-2010-1394, CVE-2010-1395, CVE-2010-1396, CVE-2010-1397, CVE-2010-1398, CVE-2010-1399, CVE-2010-1400, CVE-2010-1401, CVE-2010-1402, CVE-2010-1403, CVE-2010-1404, CVE-2010-1405, CVE-2010-1406, CVE-2010-1407, CVE-2010-1408, CVE-2010-1409, CVE-2010-1410, CVE-2010-1412, CVE-2010-1413, CVE-2010-1414, CVE-2010-1415, CVE-2010-1416, CVE-2010-1417, CVE-2010-1418, CVE-2010-1419, CVE-2010-1421, CVE-2010-1422, CVE-2010-1729, CVE-2010-1749, CVE-2010-1757, CVE-2010-1758, CVE-2010-1759, CVE-2010-1760, CVE-2010-1761, CVE-2010-1762, CVE-2010-1763, CVE-2010-1764, CVE-2010-1766, CVE-2010-1767, CVE-2010-1769, CVE-2010-1770, CVE-2010-1771, CVE-2010-1772, CVE-2010-1773, CVE-2010-1774, CVE-2010-1780, CVE-2010-1781, CVE-2010-1782, CVE-2010-1783, CVE-2010-1784, CVE-2010-1785, CVE-2010-1786, CVE-2010-1787, CVE-2010-1788, CVE-2010-1789, CVE-2010-1790, CVE-2010-1791, CVE-2010-1792, CVE-2010-1793, CVE-2010-1807, CVE-2010-1812, CVE-2010-1813, CVE-2010-1814, CVE-2010-1815, CVE-2010-1822, CVE-2010-1823, CVE-2010-1824, CVE-2010-1825, CVE-2010-2264, CVE-2010-2295, CVE-2010-2297, CVE-2010-2300, CVE-2010-2301, CVE-2010-2302, CVE-2010-2441, CVE-2010-3116, CVE-2010-3257, CVE-2010-3259, CVE-2010-3312, CVE-2010-3803, CVE-2010-3804, CVE-2010-3805, CVE-2010-3808, CVE-2010-3809, CVE-2010-3810, CVE-2010-3811, CVE-2010-3812, CVE-2010-3813, CVE-2010-3816, CVE-2010-3817, CVE-2010-3818, CVE-2010-3819, CVE-2010-3820, CVE-2010-3821, CVE-2010-3822, CVE-2010-3823, CVE-2010-3824, CVE-2010-3826, CVE-2010-3829, CVE-2010-3900, CVE-2010-4040

The version of Google Chrome installed on the remote host is earlier than 3.0.195.33.  Such versions are reportedly affected by a security bypass vulnerability caused by cusom headers being incorrectly sent for 'CORS OPTIONS' requests.  A malicious website operator could set custom HTTP headers on cross-origin 'OPTIONS' requests.

The version of Google Chrome installed on the remote host is earlier than 3.0.195.33.  Such versions are potentially affected by a security bypass vulnerability caused by custom headers being incorrectly sent for 'CORS OPTIONS' requests.  A malicious web site operator could set custom HTTP headers on cross-origin 'OPTIONS' requests.

The version of Safari installed on the remote host is earlier than 4.0.4.  Such versions are potentially affected by multiple issues : 

  - An integer overflow exists in the handling of images with an embedded color profile, which may lead to a heap buffer overflow. (CVE-2009-2804)

  - Multiple use-after-free issues exist in libxml2, the most serious of which may lead to an unexpected application termination. (CVE-2009-2414, CVE-2009-2416)

  - An issue exists in Safari's handling of navigations initiated via the "Open Image in New Tab", "Open Image in New Window", or "Open Link in New Tab" shortcut menu options. Using these options within a maliciously crafted website could load a local HTML file, leading to the disclosure of sensitive information. (CVE-2009-2842)

  - An issue exists in WebKit's implementation of Cross-Origin Resource Sharing which could lead to cross-site request forger attacks. (CVE-2009-2816)

  - Multiple vulnerabilities exist in WebKit's handling of FTP directory listings. Accessing a maliciously crafted FTP server may lead to information disclosure, unexpected application termination, or execution of arbitrary code. (CVE-2009-3384)

  - When WebKit encounters an HTML 5 Media Element pointing to an external resource, it does not issue a resource load callback to determine if the resource should be loaded. This may result in undesired requests to remote servers. (CVE-2009-2841)

The remote mobile host is a using a version of Apple iOS earlier than 4.0. Such versions are potentially affected by multiple vulnerabilities. Apple iOS 4.0 contains security fixes for the following components :

  - Application Sandbox

  - CFNetwork

  - ImageIO

  - LibSystem

  - libxml

  - Passcode Lock

  - Safari

  - Settings

  - WebKit

The version of Safari installed on the remote host is earlier than 4.0.4.  Such versions are potentially affected by multiple issues : 

  - An integer overflow exists in the handling of images with an embedded color profile, which may lead to a heap buffer overflow. (CVE-2009-2804)

  - Multiple use-after-free issues exist in libxml2, the most serious of which may lead to an unexpected application termination. (CVE-2009-2414, CVE-2009-2416)

  - An issue exists in Safari's handling of navigations initiated via the "Open Image in New Tab", "Open Image in New Window", or "Open Link in New Tab" shortcut menu options. Using these options within a maliciously crafted website could load a local HTML file, leading to the disclosure of sensitive information. (CVE-2009-2842)

  - An issue exists in WebKit's implementation of Cross-Origin Resource Sharing which could lead to cross-site request forger attacks. (CVE-2009-2816)

  - Multiple vulnerabilities exist in WebKit's handling of FTP directory listings. Accessing a maliciously crafted FTP server may lead to information disclosure, unexpected application termination, or execution of arbitrary code. (CVE-2009-3384)

  - When WebKit encounters an HTML 5 Media Element pointing to an external resource, it does not issue a resource load callback to determine if the resource should be loaded. This may result in undesired requests to remote servers. (CVE-2009-2841)

IAVT Reference : 2009-T-0049
STIG Finding Severity : Category I

ID	名稱	產品	系列	已發布	已更新	嚴重性
53764	openSUSEセキュリティ更新プログラム：libwebkit（openSUSE-SU-2011:0024-1）	Nessus	SuSE Local Security Checks	2011/5/5	2021/1/14	critical
75629	openSUSE 安全性更新：libwebkit (openSUSE-SU-2011:0024-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/14	critical
75629	openSUSE セキュリティ更新：libwebkit （openSUSE-SU-2011:0024-1）	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/14	critical
42478	Safari < 4.0.4 Multiple Vulnerabilities	Nessus	Windows	2009/11/12	2018/7/27	high
42804	Fedora 10 : qt-4.5.3-9.fc10 (2009-11488)	Nessus	Fedora Local Security Checks	2009/11/16	2021/1/11	high
75629	openSUSE 安全更新：libwebkit (openSUSE-SU-2011:0024-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/14	critical
53764	openSUSE 安全性更新：libwebkit (openSUSE-SU-2011:0024-1)	Nessus	SuSE Local Security Checks	2011/5/5	2021/1/14	critical
42477	Mac OS X : Apple Safari < 4.0.4	Nessus	MacOS X Local Security Checks	2009/11/12	2018/7/14	high
42807	Fedora 11 : qt-4.5.3-9.fc11 (2009-11491)	Nessus	Fedora Local Security Checks	2009/11/16	2021/1/11	high
53764	openSUSE Security Update : libwebkit (openSUSE-SU-2011:0024-1)	Nessus	SuSE Local Security Checks	2011/5/5	2021/1/14	critical
53764	openSUSE 安全更新：libwebkit (openSUSE-SU-2011:0024-1)	Nessus	SuSE Local Security Checks	2011/5/5	2021/1/14	critical
42798	Google Chrome < 3.0.195.33 Multiple Vulnerabilities	Nessus	Windows	2009/11/13	2022/4/11	medium
75629	openSUSE Security Update : libwebkit (openSUSE-SU-2011:0024-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/14	critical
42803	Fedora 12 : qt-4.5.3-9.fc12 (2009-11487)	Nessus	Fedora Local Security Checks	2009/11/16	2021/1/11	high
5234	Google Chrome < 3.0.195.33 Security Bypass Vulnerability.	Nessus Network Monitor	Web Clients	2009/11/13	2019/3/6	medium
5232	Safari < 4.0.4 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2009/11/11	2019/3/6	medium
5578	Apple iOS < 4.0 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	2010/6/22	2019/3/6	critical
801003	Safari < 4.0.4 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	2009/11/11		high

偵測

搜尋 Plugin

critical

critical

critical

high

high

critical

critical

high

high

critical

critical

medium

critical

high

medium

medium

critical

high