CVE-2009-0321: Medium severity Apple Safari vulnerability
Apple Safari 3.2.1 (aka AppVer 3.525.27.1) on Windows allows remote attackers to cause a denial of service (infinite loop or access violation) via a link to an http URI in which the authority (aka hostname) portion is either a (1) . (dot) or (2) .. (dot dot) sequence.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems running Apple Safari 3.2.1 on Windows are affected. The issue is triggered when Safari processes an HTTP link whose hostname is a single dot or two dots.
What does an attacker need to exploit the vulnerability?
An attacker only needs to provide a malicious HTTP link; no authentication is required. Exploitation can cause Safari to enter an infinite loop or terminate with an access violation.
Does the available information confirm exposure beyond Safari 3.2.1 on Windows?
The available information identifies Safari 3.2.1 on Windows as affected, but does not state whether other Safari versions or default configurations are affected.