Description
Apple Safari before 4.0 does not prevent calls to the open-help-anchor URL handler by web sites, which allows remote attackers to open arbitrary local help files, and execute arbitrary code or obtain sensitive information, via a crafted call.
References
- APPLE-SA-2009-06-08-1 vendor-advisory
- 35260 vdb-entry
- ADV-2009-1522 vdb-entry
- 1022345 vdb-entry
- 35379 third-party-advisory
- 55011 vdb-entry
- 35351 vdb-entry
- http://support.apple.com/kb/HT3613