CVE-2007-0478 - Secunia Advisories - Vulnerability Information

CVE Reference: CVE-2007-0478
NOTE: The text on this page is written by CVE MITRE and reflects neither the opinions of Secunia or the results of our research. All data on this page is written and maintained by CVE MITRE.

Original Page at CVE MITRE: CVE-2007-0478

Description: WebCore on Apple Mac OS X 10.3.9 and 10.4.10, as used in Safari, does not properly parse HTML comments in TITLE elements, which allows remote attackers to conduct cross-site scripting (XSS) attacks and bypass some XSS protection schemes by embedding certain HTML tags within an HTML comment.

CVE Status: Candidate

References: XF http://xforce.iss.net/xforce/xfdb/31846 ST 1018494 SAID Secunia Advisory: SA23893 Secunia Advisory: SA26235 OSVDB 32712 MISC http://www.beanfuzz.com/wordpress/?p=99 CONFIRM http://docs.info.apple.com/article.html?artnum=306172 BUGTRAQ http://www.securityfocus.com/archive/1/archive/1/457763/100/0/threaded BID 25159 APPLE http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html

Return to the previous page.