Description
Use-after-free vulnerability in the JavaScript DOM implementation in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by destroying a document.body element that has an unspecified XML container with elements that support the dir attribute.
References
- http://support.apple.com/kb/HT3639
- 43068 third-party-advisory
- ADV-2009-1621 vdb-entry
- ADV-2011-0212 vdb-entry
- APPLE-SA-2009-06-08-1 vendor-advisory
- 35260 vdb-entry
- 55008 vdb-entry
- ADV-2009-1522 vdb-entry
- 1022345 vdb-entry
- 20090608 ZDI-09-033: Apple WebKit dir Attribute Freeing Dangling Object Pointer Vulnerability mailing-list
- APPLE-SA-2009-06-17-1 vendor-advisory
- SUSE-SR:2011:002 vendor-advisory
- 35379 third-party-advisory
- http://www.zerodayinitiative.com/advisories/ZDI-09-033/
- http://support.apple.com/kb/HT3613
- 35325 vdb-entry