----------------------------------------------------------------------


Use WSUS to deploy 3rd party patches

Public BETA
http://secunia.com/vulnerability_scanning/corporate/wsus_3rd_third_party_patching/


----------------------------------------------------------------------

TITLE:
Apple Safari Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA38932

VERIFY ADVISORY:
http://secunia.com/advisories/38932/

DESCRIPTION:
Some vulnerabilities have been reported in Apple Safari, which can be
exploited by malicious people to disclose sensitive information,
bypass certain security restrictions, or compromise a user's system.

1) A boundary error in ImageIO can be exploited to cause a buffer
underflow and potentially execute arbitrary code via a specially
crafted TIFF image.

For more information:
SA35515

2) An uninitialised memory access error in ImageIO when handling BMP
images can be exploited to disclose certain data from the browser's
memory.

3) An uninitialised memory access error in ImageIO when handling TIFF
images can be exploited to disclose certain data from the browser's
memory.

4) An error in ImageIO when processing TIFF images can be exploited
to corrupt memory and potentially execute arbitrary code.

5) An error when viewing or updating RSS or Atom feeds can be
exploited to bypass the "Accept Cookies" preference and set a
cookie.

6) An error when handling external URL schemes can be exploited to
open an arbitrary local file.

7) An error in WebKit when handling CSS "format()" arguments can be
exploited to corrupt memory and potentially execute arbitrary code. 

8) A use-after-free error in WebKit when handling HTML object element
fallback content can be exploited to potentially execute arbitrary
code.

9) An integer overflow error in ColorSync can be exploited to
potentially execute arbitrary code via a specially crafted embedded
color profile.

10) A use-after-free error in WebKit when parsing XML documents can
be exploited to potentially execute arbitrary code.

11) A use-after-free error in WebKit when handling HTML elements
containing right-to-left text can be exploited to potentially execute
arbitrary code.

12) A use-after-free error in WebKit when handling nested HTML tags
can be exploited to potentially execute arbitrary code.

13) An error when handling cross-origin stylesheet requests can be
exploited to disclose data from another domain.

14) A use-after-free error in WebKit when handling callbacks for HTML
elements can be exploited to potentially execute arbitrary code.

15) A use-after-free error in WebKit when rendering content with a
CSS display property set to "run-in" can be exploited to potentially
execute arbitrary code.

16) A use-after-free error in WebKit when handling HTML image
elements can be exploited to potentially execute arbitrary code.

The vulnerabilities are reported in versions prior to 4.0.5.

SOLUTION:
Update to version 4.0.5.

PROVIDED AND/OR DISCOVERED BY:
The vendor credits:
2, 3) Matthew 'j00ru' Jurczyk of Hispasec 
4) Gus Mueller of Flying Meat
6) Billy Rios and Microsoft Vulnerability Research (MSVR)
7) Robert Swiecki of Google Inc.
8, 15) wushi of team509, working with ZDI
9) Sebastien Renaud, Vupen
11) wushi&Z of team509
12) wushi&Z of team509, working with ZDI

ORIGINAL ADVISORY:
Apple:
http://support.apple.com/kb/HT4070

iDefense:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=863

OTHER REFERENCES:
SA35515:
http://secunia.com/advisories/35515/

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------