The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The HTMLMediaElement::loadResource function in html/HTMLMediaElement.cpp in WebCore in WebKit before r49480, as used in Apple Safari before 4.0.4 on Mac OS X, does not perform the expected callbacks for HTML 5 media elements that have external URLs for media resources, which allows remote attackers to trigger sub-resource requests to arbitrary web sites via a crafted HTML document, as demonstrated by an HTML e-mail message that uses a media element for X-Confirm-Reading-To functionality, aka rdar problem 7271202.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Safari | — | Uninstall Apple Safari on WindowsUpgrade to Apple Safari version 4.0.4 | Jan 5, 2012 | Nov 13, 2009 |
| Suse | — | Upgrade libwebkit-1_0-2-32bitUpgrade webkit-jscUpgrade libwebkit-langUpgrade libwebkit-1_0-2Upgrade libwebkit-devel | Feb 17, 2015 | Nov 13, 2009 |
| Ubuntu | — | Upgrade webkit | Nov 19, 2024 | Nov 13, 2009 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub