CVE-2008-1025

Description

Cross-site scripting (XSS) vulnerability in Apple WebKit, as used in Safari before 3.1.1, allows remote attackers to inject arbitrary web script or HTML via a crafted URL with a colon in the hostname portion.

Affected products

• Apple / Safari0.8 – 0.8
• Apple / Safari0.9 – 0.9
• Apple / Safari1.0 – 1.0
• Apple / Safari1.0.3 – 1.0.3
• Apple / Safari1.1 – 1.1
• Apple / Safari1.2 – 1.2
• Apple / Safari1.3 – 1.3
• Apple / Safari1.3.1 – 1.3.1
• Apple / Safari1.3.2 – 1.3.2
• Apple / Safari2.0 – 2.0
• Apple / Safari2.0.2 – 2.0.2
• Apple / Safari2.0.4 – 2.0.4
• Apple / Safari3.0 – 3.0
• Apple / Safari3.0.2 – 3.0.2
• Apple / Safari3.0.3 – 3.0.3
• Apple / Safari3.0.4 – 3.0.4
• Apple / Safari3.1 – 3.1
• Apple / webkit

References

• VENDOR_ADVISORYhttp://support.apple.com/kb/HT1467
• VENDOR_ADVISORYhttp://secunia.com/advisories/29846
• MISChttp://www.kb.cert.org/vuls/id/705529
• MAILING_LISThttp://lists.apple.com/archives/security-announce/2008/Apr/msg00001.html
• MAILING_LISThttp://lists.apple.com/archives/security-announce/2008//Jul/msg00001.html
• VENDOR_ADVISORYhttp://www.vupen.com/english/advisories/2008/2094/references
• VENDOR_ADVISORYhttp://www.vupen.com/english/advisories/2008/1250/references
• MISChttp://www.securityfocus.com/bid/28814
• MISChttps://exchange.xforce.ibmcloud.com/vulnerabilities/41862
• MISChttp://www.securitytracker.com/id?1019869
• VENDOR_ADVISORYhttp://secunia.com/advisories/31074