Overview
A vulnerability in the way Apple Mac OS X handles specially crafted URLs may allow an attacker to execute script in the context of another site..
Description
According to Apple Safari 3.1.1: An issue exists in WebKit's handling of URLs containing a colon character in the host name. Opening a maliciously crafted URL may lead to a cross-site scripting attack. This update addresses the issue through improved handling of URLs. |
Impact
This vulnerability may allow an attacker to execute script in the context of another site. |
Solution
Apply Apple Updates |
Vendor Information
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | ||
| Temporal | ||
| Environmental |
References
Acknowledgements
This issue is adressed in Apple Safari 3.1.1. Apple credits Robert Swiecki of the Google Security Team, and David Bloom for reporting this issue.
This document was written by Chris Taschner.
Other Information
| CVE IDs: | CVE-2008-1025 |
| Severity Metric: | 9.90 |
| Date Public: | 2008-04-16 |
| Date First Published: | 2008-04-18 |
| Date Last Updated: | 2008-04-18 19:58 UTC |
| Document Revision: | 2 |