CVE-2008-1036: XSS
Common Vulnerabilities and Exposures assigned an identifier CVE-2008-1036 to the following vulnerability:
International Components for Unicode (ICU) in Apple Mac OS X before 10.5.3 omits some invalid character sequences during conversion of some character encodings, which might allow remote attackers to conduct cross-site scripting (XSS) attacks.
References:
http://lists.apple.com/archives/security-announce/2008//May/msg00001.html
Proposed patch (icu part):
http://bugs.icu-project.org/trac/search?q=%22ticket:6175:%22&noquickjump=1&changeset=on
Proposed patch (icu4j part):
http://bugs.icu-project.org/trac/search?q=%22ticket:6198:%22&noquickjump=1&changeset=on
Other sources
The International Components for Unicode (ICU) library in Apple Mac OS X before 10.5.3, Red Hat Enterprise Linux 5, and other operating systems omits some invalid character sequences during conversion of some character encodings, which might allow remote attackers to conduct cross-site scripting (XSS) attacks.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2008-1036?
CVE-2008-1036 is considered a moderate severity vulnerability as it affects character encoding and can lead to potential security issues in affected systems.
How do I fix CVE-2008-1036?
To fix CVE-2008-1036, update your Apple Mac OS X or Red Hat Enterprise Linux system to the latest version that addresses this vulnerability.
Which versions are affected by CVE-2008-1036?
CVE-2008-1036 affects Apple Mac OS X versions 10.4.11, 10.5.1, and 10.5.2 as well as Red Hat Enterprise Linux version 5.
What are the potential impacts of CVE-2008-1036?
The potential impacts of CVE-2008-1036 include incorrect data handling which could lead to denial of service or security bypass.
Is CVE-2008-1036 exploitable remotely?
CVE-2008-1036 can potentially be exploited remotely if an application processes untrusted data using the affected ICU version.