Description
WebCore in Apple Safari does not properly perform garbage collection of JavaScript document elements, which allows remote attackers to execute arbitrary code or cause a denial of service (heap corruption and application crash) via a reference to the ownerNode property of a copied CSSStyleSheet object of a STYLE element, as originally demonstrated on Apple iPhone before 2.0 and iPod touch before 2.0, a different vulnerability than CVE-2008-1590.
References
- 20080725 ZDI-08-045: Apple Safari StyleSheet ownerNode Heap Corruption Vulnerability mailing-list
- APPLE-SA-2008-11-13 vendor-advisory
- http://www.zerodayinitiative.com/advisories/ZDI-08-045/
- 30186 vdb-entry
- 32706 third-party-advisory
- APPLE-SA-2008-07-11 vendor-advisory
- http://support.apple.com/kb/HT3298
- ADV-2008-2094 vdb-entry
- ipod-iphone-stylesheets-code-execution(43737) vdb-entry
- 31074 third-party-advisory