CVE-2008-1006: XSS

Published Mar 19, 2008

Updated

Cross-site scripting (XSS) vulnerability in WebCore, as used in Apple Safari before 3.1, allows remote attackers to inject arbitrary web script or HTML by using the window.open function to change the security context of a web page.

Affected Software

16 affected components

Safari=1.3.2

Safari=3.0.4

Safari=2.0.2

Safari=3.0.1

Safari=3.0.2

Safari=1.0

Safari=1.3

Safari=3.0.3

Safari=2.0

Safari=0.8

Safari=2.0.4

Safari=1.1

Safari=1.3.1

Safari=1.2

Safari=3.0

Safari=0.9

Remediation

Patch Available

http://lists.apple.com/archives/security-announce/2008/Mar/msg00000.html

Event History

Mar 19, 2008

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2008-1006?

CVE-2008-1006 is considered a moderate severity vulnerability due to its potential to allow cross-site scripting attacks.

How do I fix CVE-2008-1006?

To fix CVE-2008-1006, users should update their Apple Safari browser to a version that is not affected by this vulnerability.

Which versions of Safari are affected by CVE-2008-1006?

CVE-2008-1006 affects various versions of Apple Safari, specifically those prior to version 3.1.

What type of attack does CVE-2008-1006 enable?

CVE-2008-1006 enables attackers to perform cross-site scripting (XSS) attacks by injecting arbitrary web scripts into web pages.

Who are the attackers that can exploit CVE-2008-1006?

Remote attackers can exploit CVE-2008-1006 by using it to modify the security context of a web page.