Safari

CVEs (1,740)

• CVE-2010-1807Sep 10, 2010
  Webkitgtk

  Webkitgtk
  risk 0.08cvss —epss 0.61

  WebKit in Apple Safari 4.x before 4.1.2 and 5.x before 5.0.2; Android before 2.2; and webkitgtk before 1.2.6; does not properly validate floating-point data, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted…

• CVE-2006-0848Feb 22, 2006
  Apple Inc.

  Mac OS X
  risk 0.08cvss —epss 0.58

  The "Open 'safe' files after downloading" option in Safari on Apple Mac OS X allows remote user-assisted attackers to execute arbitrary commands by tricking a user into downloading a __MACOSX folder that contains metadata (resource fork) that invokes the Terminal, which…

• CVE-2011-3230Oct 14, 2011
  Apple Inc.

  Safari
  risk 0.07cvss —epss 0.49

  Apple Safari before 5.1.1 on Mac OS X does not enforce an intended policy for file: URLs, which allows remote attackers to execute arbitrary code via a crafted web site.

• CVE-2014-1303Mar 26, 2014
  Apple Inc.

  Safari
  risk 0.06cvss —epss 0.35

  Heap-based buffer overflow in Apple Safari 7.0.2 allows remote attackers to execute arbitrary code and bypass a sandbox protection mechanism via unspecified vectors, as demonstrated by Liang Chen during a Pwn2Own competition at CanSecWest 2014.

• CVE-2011-1774Jul 21, 2011
  Apple Inc.

  Safari
  risk 0.06cvss —epss 0.43

  WebKit in Apple Safari before 5.0.6 has improper libxslt security settings, which allows remote attackers to create arbitrary files, and consequently execute arbitrary code, via a crafted web site. NOTE: this may overlap CVE-2011-1425.

• CVE-2007-6166Nov 29, 2007
  Apple Inc.

  Quicktime
  risk 0.06cvss —epss 0.42

  Stack-based buffer overflow in Apple QuickTime before 7.3.1, as used in QuickTime Player on Windows XP and Safari on Mac OS X, allows remote Real Time Streaming Protocol (RTSP) servers to execute arbitrary code via an RTSP response with a long Content-Type header.

• CVE-2011-0222Jul 21, 2011
  Apple Inc.

  Safari
  risk 0.05cvss —epss 0.22

  WebKit, as used in Apple Safari before 5.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2011-07-20-1.

• CVE-2010-1119Mar 25, 2010
  Apple Inc.

  Mac OS X
  risk 0.05cvss —epss 0.19

  Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, Safari before 4.1 on Mac OS X 10.4, and Safari on Apple iPhone OS allows remote attackers to execute arbitrary code or cause a denial of service (application crash), or…

• CVE-2008-3529Sep 12, 2008
  Xmlsoft

  Libxml2
  risk 0.05cvss —epss 0.23

  Heap-based buffer overflow in the xmlParseAttValueComplex function in parser.c in libxml2 before 2.7.0 allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via a long XML entity name.

• CVE-2015-1155May 8, 2015
  Apple Inc.

  Safari
  risk 0.04cvss —epss 0.11

  The history implementation in WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, allows remote attackers to bypass the Same Origin Policy and read arbitrary files via a crafted web site.

• CVE-2015-1126Apr 10, 2015
  Apple Inc.

  Safari
  risk 0.04cvss —epss 0.10

  WebKit, as used in Apple iOS before 8.3 and Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, does not properly handle the userinfo field in FTP URLs, which allows remote attackers to trigger incorrect resource access via unspecified vectors.

• CVE-2012-3748Nov 3, 2012
  Apple Inc.

  Safari
  risk 0.04cvss —epss 0.17

  Race condition in WebKit in Apple iOS before 6.0.1 and Safari before 6.0.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving JavaScript arrays.

• CVE-2010-3804Nov 22, 2010
  Apple Inc.

  Safari
  risk 0.04cvss —epss 0.09

  The JavaScript implementation in WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on Mac OS X 10.4, uses a weak algorithm for generating values of random numbers, which makes it easier for remote attackers to track a user by…

• CVE-2010-1759Jun 11, 2010
  Apple Inc.

  Safari
  risk 0.04cvss —epss 0.16

  Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to the…

• CVE-2010-1939May 13, 2010
  Apple Inc.

  Safari
  risk 0.04cvss —epss 0.15

  Use-after-free vulnerability in Apple Safari 4.0.5 on Windows allows remote attackers to execute arbitrary code by using window.open to create a popup window for a crafted HTML document, and then calling the parent window's close method, which triggers improper handling of a…

• CVE-2010-1180Mar 29, 2010
  Apple Inc.

  Safari
  risk 0.04cvss —epss 0.08

  Safari on Apple iPhone OS 3.1.3 for iPod touch allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long exception string in a throw statement, possibly a related issue to CVE-2009-1514.

• CVE-2010-1179Mar 29, 2010
  Apple Inc.

  Safari
  risk 0.04cvss —epss 0.09

  Safari on Apple iPhone OS 3.1.3 for iPod touch allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a large integer in the numcolors attribute of a recolorinfo element in a VML file, possibly a related issue to…

• CVE-2010-1177Mar 29, 2010
  Apple Inc.

  Safari
  risk 0.04cvss —epss 0.07

  Safari on Apple iPhone OS 3.1.3 for iPod touch allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors involving document.write calls with long crafted strings.

• CVE-2010-1176Mar 29, 2010
  Apple Inc.

  Safari
  risk 0.04cvss —epss 0.09

  Safari on Apple iPhone OS 3.1.3 for iPod touch allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors related to an array of long strings, an array of IMG elements with crafted strings in their SRC attributes, a…

• CVE-2010-1029Mar 19, 2010
  Google

  Chrome
  risk 0.04cvss —epss 0.10

  Stack consumption vulnerability in the WebCore::CSSSelector function in WebKit, as used in Apple Safari 4.0.4, Apple Safari on iPhone OS and iPhone OS for iPod touch, and Google Chrome 4.0.249, allows remote attackers to cause a denial of service (application crash) or possibly…