CVE-2011-0161: Input Validation
First published: Fri Mar 11 2011(Updated: )
WebKit, as used in Apple Safari before 5.0.4 and iOS before 4.3, does not properly handle the Attr.style accessor, which allows remote attackers to bypass the Same Origin Policy and inject Cascading Style Sheets (CSS) token sequences via a crafted web site.
Credit: product-security@apple.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apple Mobile Safari | =3.0.4b | |
| Apple Mobile Safari | =1.3.0 | |
| Apple Mobile Safari | =1.0.3-85.8 | |
| Apple Mobile Safari | =2.0.3-417.9.3 | |
| Apple Mobile Safari | =1.3.2 | |
| Apple Mobile Safari | =2 | |
| Apple Mobile Safari | =1.1.1 | |
| Apple Mobile Safari | =3.0.4 | |
| Apple Mobile Safari | =1.2.2 | |
| Apple Mobile Safari | =2.0.1 | |
| Apple Mobile Safari | =5.0.1 | |
| Apple Mobile Safari | =2.0.3 | |
| Apple Mobile Safari | =1.0.3 | |
| Apple Mobile Safari | <=5.0.3 | |
| Apple Mobile Safari | =2.0.2 | |
| Apple Mobile Safari | =1.0.2 | |
| Apple Mobile Safari | =3.0.0 | |
| Apple Mobile Safari | =3.0.1 | |
| Apple Mobile Safari | =3.0.2 | |
| Apple Mobile Safari | =1.0 | |
| Apple Mobile Safari | =5.0.2 | |
| Apple Mobile Safari | =3.0.3b | |
| Apple Mobile Safari | =3.1.1 | |
| Apple Mobile Safari | =1.3 | |
| Apple Mobile Safari | =2.0.3-417.9 | |
| Apple Mobile Safari | =1.2.5 | |
| Apple Mobile Safari | =2.0.3-417.9.2 | |
| Apple Mobile Safari | =3.0.3 | |
| Apple Mobile Safari | =2.0 | |
| Apple Mobile Safari | =1.2.4 | |
| Apple Mobile Safari | =1.0.1 | |
| Apple Mobile Safari | =2.0.3-417.8 | |
| Apple Mobile Safari | =3.1.2 | |
| Apple Mobile Safari | =1.2.1 | |
| Apple Mobile Safari | =3.1.0b | |
| Apple Mobile Safari | =1.0.3-85.8.1 | |
| Apple Mobile Safari | =3.1.0 | |
| Apple Mobile Safari | =1.0-beta | |
| Apple Mobile Safari | =4.1.1 | |
| Apple Mobile Safari | =2.0.4 | |
| Apple Mobile Safari | =1.0-beta2 | |
| Apple Mobile Safari | =1.1 | |
| Apple Mobile Safari | =1.3.2-312.5 | |
| Apple Mobile Safari | =3.2.2 | |
| Apple Mobile Safari | =3.0.0b | |
| Apple Mobile Safari | =1.3.1 | |
| Apple Mobile Safari | =4.1 | |
| Apple Mobile Safari | =2.0.0 | |
| Apple Mobile Safari | =3.2.0 | |
| Apple Mobile Safari | =1.1.0 | |
| Apple Mobile Safari | =3.0.2b | |
| Apple Mobile Safari | =1.2 | |
| Apple Mobile Safari | =5.0 | |
| Apple Mobile Safari | =1.2.0 | |
| Apple Mobile Safari | =3.0.1b | |
| Apple Mobile Safari | =1.0.0b1 | |
| Apple Mobile Safari | =3.2.1 | |
| Apple WebKit | ||
| Apple Mobile Safari | =3.0 | |
| Apple Mobile Safari | =1.0.0 | |
| Apple Mobile Safari | =4.1.2 | |
| Apple Mobile Safari | =1.2.3 | |
| Apple Mobile Safari | =1.3.2-312.6 | |
| Apple Mobile Safari | =3 | |
| Apple Mobile Safari | =1.0.0b2 | |
| iStyle @cosme iPhone OS | =3.0 | |
| iStyle @cosme iPhone OS | =3.2 | |
| iStyle @cosme iPhone OS | =3.1.3 | |
| iStyle @cosme iPhone OS | =1.0.2 | |
| iStyle @cosme iPhone OS | =4.0.2 | |
| iStyle @cosme iPhone OS | =2.2 | |
| iStyle @cosme iPhone OS | =1.1.1 | |
| iStyle @cosme iPhone OS | =4.1 | |
| iStyle @cosme iPhone OS | =2.0.0 | |
| iStyle @cosme iPhone OS | =3.1.2 | |
| iStyle @cosme iPhone OS | =3.0.1 | |
| iStyle @cosme iPhone OS | =1.1.2 | |
| iStyle @cosme iPhone OS | =3.1 | |
| iStyle @cosme iPhone OS | =1.1.3 | |
| iStyle @cosme iPhone OS | =1.1.0 | |
| iStyle @cosme iPhone OS | =1.0.1 | |
| iStyle @cosme iPhone OS | =2.1 | |
| iStyle @cosme iPhone OS | =1.1.5 | |
| iStyle @cosme iPhone OS | =4.0.1 | |
| iStyle @cosme iPhone OS | =2.1.1 | |
| iStyle @cosme iPhone OS | =1.1.4 | |
| iStyle @cosme iPhone OS | =1.0.0 | |
| iStyle @cosme iPhone OS | =2.0.2 | |
| iStyle @cosme iPhone OS | =2.0 | |
| iStyle @cosme iPhone OS | =2.0.1 | |
| iStyle @cosme iPhone OS | =4.0 | |
| iStyle @cosme iPhone OS | <=4.2 | |
| iStyle @cosme iPhone OS | =2.2.1 | |
| iStyle @cosme iPhone OS | =3.2.1 | |
| iStyle @cosme iPhone OS | =3.2.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://support.apple.com/kb/HT4564
- http://lists.apple.com/archives/security-announce/2011//Mar/msg00004.html
- http://support.apple.com/kb/HT4566
- http://lists.apple.com/archives/security-announce/2011//Mar/msg00003.html
- http://www.securityfocus.com/bid/46814
- http://www.securitytracker.com/id?1025182
- https://exchange.xforce.ibmcloud.com/vulnerabilities/66000
Frequently Asked Questions
What is the severity of CVE-2011-0161?
CVE-2011-0161 is considered moderate in severity due to its ability to bypass the Same Origin Policy.
How do I fix CVE-2011-0161?
You can fix CVE-2011-0161 by updating Safari to version 5.0.4 or later, or updating iOS to 4.3 or later.
Which versions of Safari are affected by CVE-2011-0161?
CVE-2011-0161 affects Apple Safari versions prior to 5.0.4.
Can CVE-2011-0161 affect mobile devices?
Yes, CVE-2011-0161 can affect mobile devices running iOS versions before 4.3.
What type of attack is possible with CVE-2011-0161?
CVE-2011-0161 allows remote attackers to inject CSS token sequences via a crafted website.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/author
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/apple
- canonical/apple mobile safari
- version/apple mobile safari/3.0.4b
- version/apple mobile safari/1.3.0
- version/apple mobile safari/1.0.3-85.8
- version/apple mobile safari/2.0.3-417.9.3
- version/apple mobile safari/1.3.2
- version/apple mobile safari/2
- version/apple mobile safari/1.1.1
- version/apple mobile safari/3.0.4
- version/apple mobile safari/1.2.2
- version/apple mobile safari/2.0.1
- version/apple mobile safari/5.0.1
- version/apple mobile safari/2.0.3
- version/apple mobile safari/1.0.3
- version/apple mobile safari/5.0.3
- version/apple mobile safari/2.0.2
- version/apple mobile safari/1.0.2
- version/apple mobile safari/3.0.0
- version/apple mobile safari/3.0.1
- version/apple mobile safari/3.0.2
- version/apple mobile safari/1.0
- version/apple mobile safari/5.0.2
- version/apple mobile safari/3.0.3b
- version/apple mobile safari/3.1.1
- version/apple mobile safari/1.3
- version/apple mobile safari/2.0.3-417.9
- version/apple mobile safari/1.2.5
- version/apple mobile safari/2.0.3-417.9.2
- version/apple mobile safari/3.0.3
- version/apple mobile safari/2.0
- version/apple mobile safari/1.2.4
- version/apple mobile safari/1.0.1
- version/apple mobile safari/2.0.3-417.8
- version/apple mobile safari/3.1.2
- version/apple mobile safari/1.2.1
- version/apple mobile safari/3.1.0b
- version/apple mobile safari/1.0.3-85.8.1
- version/apple mobile safari/3.1.0
- version/apple mobile safari/1.0-beta
- version/apple mobile safari/4.1.1
- version/apple mobile safari/2.0.4
- version/apple mobile safari/1.0-beta2
- version/apple mobile safari/1.1
- version/apple mobile safari/1.3.2-312.5
- version/apple mobile safari/3.2.2
- version/apple mobile safari/3.0.0b
- version/apple mobile safari/1.3.1
- version/apple mobile safari/4.1
- version/apple mobile safari/2.0.0
- version/apple mobile safari/3.2.0
- version/apple mobile safari/1.1.0
- version/apple mobile safari/3.0.2b
- version/apple mobile safari/1.2
- version/apple mobile safari/5.0
- version/apple mobile safari/1.2.0
- version/apple mobile safari/3.0.1b
- version/apple mobile safari/1.0.0b1
- version/apple mobile safari/3.2.1
- canonical/apple webkit
- version/apple mobile safari/3.0
- version/apple mobile safari/1.0.0
- version/apple mobile safari/4.1.2
- version/apple mobile safari/1.2.3
- version/apple mobile safari/1.3.2-312.6
- version/apple mobile safari/3
- version/apple mobile safari/1.0.0b2
- canonical/istyle @cosme iphone os
- version/istyle @cosme iphone os/3.0
- version/istyle @cosme iphone os/3.2
- version/istyle @cosme iphone os/3.1.3
- version/istyle @cosme iphone os/1.0.2
- version/istyle @cosme iphone os/4.0.2
- version/istyle @cosme iphone os/2.2
- version/istyle @cosme iphone os/1.1.1
- version/istyle @cosme iphone os/4.1
- version/istyle @cosme iphone os/2.0.0
- version/istyle @cosme iphone os/3.1.2
- version/istyle @cosme iphone os/3.0.1
- version/istyle @cosme iphone os/1.1.2
- version/istyle @cosme iphone os/3.1
- version/istyle @cosme iphone os/1.1.3
- version/istyle @cosme iphone os/1.1.0
- version/istyle @cosme iphone os/1.0.1
- version/istyle @cosme iphone os/2.1
- version/istyle @cosme iphone os/1.1.5
- version/istyle @cosme iphone os/4.0.1
- version/istyle @cosme iphone os/2.1.1
- version/istyle @cosme iphone os/1.1.4
- version/istyle @cosme iphone os/1.0.0
- version/istyle @cosme iphone os/2.0.2
- version/istyle @cosme iphone os/2.0
- version/istyle @cosme iphone os/2.0.1
- version/istyle @cosme iphone os/4.0
- version/istyle @cosme iphone os/4.2
- version/istyle @cosme iphone os/2.2.1
- version/istyle @cosme iphone os/3.2.1
- version/istyle @cosme iphone os/3.2.2