Description
The plug-in interface in WebKit in Apple Safari before 3.2 does not prevent plug-ins from accessing local URLs, which allows remote attackers to obtain sensitive information via vectors that "launch local files."
References
- APPLE-SA-2008-11-13 vendor-advisory
- 1021227 vdb-entry
- 32706 third-party-advisory
- 32291 vdb-entry
- http://support.apple.com/kb/HT3298