Description
Use-after-free vulnerability in WebKit, as used in Apple Safari before 5.0.5; iOS before 4.3.2 for iPhone, iPod, and iPad; iOS before 4.2.7 for iPhone 4 (CDMA); and possibly other products allows remote attackers to execute arbitrary code by adding children to a WBR tag and then removing the tag, related to text nodes, as demonstrated by Chaouki Bekrar during a Pwn2Own competition at CanSecWest 2011.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | qtwebkit-source | No fix yet | — |
References
- 44151 third-party-advisory
- 20110415 VUPEN Security Research - Apple Safari Text Nodes Remote Use-after-free Vulnerability (CVE-2011-1344) mailing-list
- http://twitter.com/aaronportnoy/statuses/45632544967901187
- 46822 vdb-entry
- http://support.apple.com/kb/HT4596
- APPLE-SA-2011-04-14-3 vendor-advisory
- 1025363 vdb-entry
- APPLE-SA-2011-04-14-2 vendor-advisory
- http://www.zerodayinitiative.com/advisories/ZDI-11-135
- ADV-2011-0984 vdb-entry
- http://dvlabs.tippingpoint.com/blog/2011/02/02/pwn2own-2011
- 20110414 ZDI-11-135: (Pwn2Own) WebKit WBR Tag Removal Remote Code Execution Vulnerability mailing-list
- http://support.apple.com/kb/HT4607
- safari-webkit-unspec-code-exec(66061) vdb-entry
- http://www.zdnet.com/blog/security/safarimacbook-first-to-fall-at-pwn2own-2011/8358
- http://www.computerworld.com/s/article/9214002/Safari_IE_hacked_first_at_Pwn2Own
- APPLE-SA-2011-04-14-1 vendor-advisory
- 44154 third-party-advisory