| Vulnerability Name: | CVE-2007-2399 (CCN-35019) | ||||||||
| Assigned: | 2007-06-22 | ||||||||
| Published: | 2007-06-22 | ||||||||
| Updated: | 2022-08-09 | ||||||||
| Summary: | WebKit in Apple Mac OS X 10.3.9, 10.4.9 and later, and iPhone before 1.0.1 performs an "invalid type conversion", which allows remote attackers to execute arbitrary code via unspecified frame sets that trigger memory corruption. | ||||||||
| CVSS v3 Severity: | 9.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)
| ||||||||
| CVSS v2 Severity: | 9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C) 6.9 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
5.6 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:H/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
| ||||||||
| Vulnerability Type: | CWE-Other | ||||||||
| Vulnerability Consequences: | Gain Access | ||||||||
| References: | Source: MITRE Type: CNA CVE-2007-2399 Source: CCN Type: Apple Security Update 2007-006 About Security Update 2007-006 Source: CONFIRM Type: UNKNOWN http://docs.info.apple.com/article.html?artnum=305759 Source: CCN Type: iPhone v1.0.1 Update About the security content of iPhone v1.0.1 Update Source: CONFIRM Type: UNKNOWN http://docs.info.apple.com/article.html?artnum=306173 Source: CCN Type: Apple Web site Apple security updates Source: APPLE Type: UNKNOWN APPLE-SA-2007-06-22 Source: CCN Type: APPLE-SA-2007-06-22 Safari 3 Beta Update 3.0.2 Source: OSVDB Type: UNKNOWN 36130 Source: OSVDB Type: UNKNOWN 36450 Source: SECUNIA Type: Patch, Vendor Advisory 25786 Source: CCN Type: SA26287 Apple iPhone Multiple Vulnerabilities Source: SECUNIA Type: Vendor Advisory 26287 Source: CCN Type: SECTRACK ID: 1018281 Mac OS X WebKit and WebCore Bugs Permit Cross-Domain Scripting Attacks and Remote Code Execution Source: CCN Type: US-CERT VU#389868 Apple WebKit frame rendering memory corruption vulnerability Source: CERT-VN Type: US Government Resource VU#389868 Source: CCN Type: OSVDB ID: 36130 Apple Mac OS X WebKit Invalid Type Conversion Remote Memory Corruption Code Execution Source: CCN Type: OSVDB ID: 36450 Apple Mac OS X / iPhone WebKit Frame Sets Unspecified Memory Corruption Source: BID Type: UNKNOWN 24597 Source: CCN Type: BID-24597 Apple WebKit Invalid Type Conversion Remote Code Execution Vulnerability Source: SECTRACK Type: Patch 1018281 Source: VUPEN Type: Vendor Advisory ADV-2007-2296 Source: VUPEN Type: Vendor Advisory ADV-2007-2316 Source: VUPEN Type: Vendor Advisory ADV-2007-2731 Source: XF Type: UNKNOWN macos-framesets-code-execution(35019) Source: XF Type: UNKNOWN macos-framesets-code-execution(35019) | ||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||
| BACK | |||||||||