CVE-2008-1003: XSS
First published: Wed Mar 19 2008(Updated: )
Cross-site scripting (XSS) vulnerability in WebCore, as used in Apple Safari before 3.1, allows remote attackers to inject arbitrary web script or HTML via unknown vectors related to sites that set the document.domain property or have the same document.domain.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apple Mobile Safari | =1.3.2 | |
| Apple Mobile Safari | =3.0.4 | |
| Apple Mobile Safari | =2.0.2 | |
| Apple Mobile Safari | =3.0.1 | |
| Apple Mobile Safari | =3.0.2 | |
| Apple Mobile Safari | =1.0 | |
| Apple Mobile Safari | =1.3 | |
| Apple Mobile Safari | =3.0.3 | |
| Apple Mobile Safari | =2.0 | |
| Apple Mobile Safari | =0.8 | |
| Apple Mobile Safari | =2.0.4 | |
| Apple Mobile Safari | =1.1 | |
| Apple Mobile Safari | =1.3.1 | |
| Apple Mobile Safari | =1.2 | |
| Apple Mobile Safari | =3.0 | |
| Apple Mobile Safari | =0.9 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.apple.com/archives/security-announce/2008/Mar/msg00000.html
- http://www.securitytracker.com/id?1019653
- http://www.securityfocus.com/bid/28330
- http://www.us-cert.gov/cas/techalerts/TA08-079A.html
- http://www.securityfocus.com/bid/28290
- http://secunia.com/advisories/29393
- http://www.vupen.com/english/advisories/2008/0920/references
- http://docs.info.apple.com/article.html?artnum=307563
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41334
Frequently Asked Questions
What is the severity of CVE-2008-1003?
CVE-2008-1003 is classified as a medium severity vulnerability due to its potential for cross-site scripting attacks.
How do I fix CVE-2008-1003?
To fix CVE-2008-1003, upgrade to a newer version of Apple Safari that has addressed this vulnerability.
What versions of Apple Safari are affected by CVE-2008-1003?
CVE-2008-1003 impacts multiple versions of Apple Safari, specifically versions prior to 3.1.
What type of vulnerability is CVE-2008-1003?
CVE-2008-1003 is a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web scripts or HTML.
Can CVE-2008-1003 be exploited without user interaction?
Exploitation of CVE-2008-1003 may not require user interaction, as it involves arbitrary scripts running in the context of the user’s browser.
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/references
- agent/remedy
- agent/author
- agent/last-modified-date
- agent/weakness
- agent/description
- agent/event
- agent/first-publish-date
- agent/source
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/apple
- canonical/apple mobile safari
- version/apple mobile safari/1.3.2
- version/apple mobile safari/3.0.4
- version/apple mobile safari/2.0.2
- version/apple mobile safari/3.0.1
- version/apple mobile safari/3.0.2
- version/apple mobile safari/1.0
- version/apple mobile safari/1.3
- version/apple mobile safari/3.0.3
- version/apple mobile safari/2.0
- version/apple mobile safari/0.8
- version/apple mobile safari/2.0.4
- version/apple mobile safari/1.1
- version/apple mobile safari/1.3.1
- version/apple mobile safari/1.2
- version/apple mobile safari/3.0
- version/apple mobile safari/0.9