medium5.0Public exploit code
CVE-2008-3950
Off-by-one error in the _web_drawInRect:withFont:ellipsis:alignment:measureOnly function in WebKit in Safari in Apple iPhone 1.1.4 and 2.0 and iPod touch 1.1.4…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Apple iOS 1.1.4/2.0 / iPod 1.1.4/2.0 touch Safari WebKit - 'alert()' Remote Denial of Service2008-09-12 · dos · hardware · Verified
Impact
Off-by-one error in the _web_drawInRect:withFont:ellipsis:alignment:measureOnly function in WebKit in Safari in Apple iPhone 1.1.4 and 2.0 and iPod touch 1.1.4 and 2.0 allows remote attackers to cause a denial of service (browser crash) via a JavaScript alert call with an argument that lacks breakable characters and has a length that is a multiple of the memory page size, leading to an out-of-bounds read.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apple | Iphone | Versions 1.1.4, 2.0 |
| Apple | Ipod Touch | Versions 1.1.4, 2.0 |
| Apple | Safari | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- http://securityreason.com/securityalert/4264
- http://www.coresecurity.com/content/iphone-safari-javascript-alert-denial-of-service
- http://www.securityfocus.com/archive/1/496321/100/0/threaded
- http://www.securityfocus.com/bid/31061
- http://securityreason.com/securityalert/4264
- http://www.coresecurity.com/content/iphone-safari-javascript-alert-denial-of-service
- http://www.securityfocus.com/archive/1/496321/100/0/threaded
- http://www.securityfocus.com/bid/31061