A vulnerability and a security issue have been discovered in Apple Safari, which may lead to exposure of sensitive information or can be exploited by malicious people to compromise a user's system.

1) A use-after-free error when handling pop-up boxes created from a child window can be exploited to execute arbitrary code when a user visits a specially crafted web page.

2) Safari includes HTTP basic authentication credentials in an HTTP request if a web page that requires HTTP basic authentication redirects to a different domain (e.g. via a "Location" header).

The vulnerability and the security issue are confirmed in version 4.0.5 for Windows. Other versions may also be affected.

Solution
Upgrade to version 5.0, which fixes vulnerability #1. Do not authenticate to sites that use HTTP basic authentication and use redirections to different domains.

Provided and/or discovered by
1) Krystian Kloskowski (h07)
2) Vin Lisciandro

Changelog
Further details available to Secunia VIM customers

Original Advisory
Krystian Kloskowski:
http://h07.w.interia.pl/Safari.rar

Apple:
http://support.apple.com/kb/HT4196

Other references
Further details available to Secunia VIM customers

Technical Analysis
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers