Description
WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not properly handle constant (aka const) declarations in a type-conversion operation during JavaScript exception handling, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted HTML document.
References
- http://support.apple.com/kb/HT3639
- 43068 third-party-advisory
- ADV-2009-1621 vdb-entry
- ADV-2011-0212 vdb-entry
- APPLE-SA-2009-06-08-1 vendor-advisory
- 35260 vdb-entry
- 54984 vdb-entry
- ADV-2009-1522 vdb-entry
- 1022345 vdb-entry
- APPLE-SA-2009-06-17-1 vendor-advisory
- SUSE-SR:2011:002 vendor-advisory
- 35379 third-party-advisory
- 35311 vdb-entry
- http://support.apple.com/kb/HT3613