Home / mailings APPLE-SA-2013-12-16-1 Safari 6.1.1 and Safari 7.0.1
Posted on 17 December 2013
Apple Security-announce--===============1740756159==
Content-type: multipart/signed;
boundary="Apple-Mail=_BD0C4F60-EEAF-489E-A78A-588D31C2E562";
protocol="application/pgp-signature"; micalg=pgp-sha1
--Apple-Mail=_BD0C4F60-EEAF-489E-A78A-588D31C2E562
Content-Transfer-Encoding: 7bit
Content-Type: text/plain;
charset=us-ascii
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
APPLE-SA-2013-12-16-1 Safari 6.1.1 and Safari 7.0.1
Safari 6.1.1 and Safari 7.0.1 are now available and address the
following:
Safari
Available for: OS X Lion v10.7.5, OS X Lion Server v10.7.5,
OS X Mountain Lion v10.8.5, OS X Mavericks v10.9
Impact: User credentials may be disclosed to an unexpected site via
autofill
Description: Safari may have autofilled user names and passwords
into a subframe from a different domain than the main frame. This
issue was addressed through improved origin tracking.
CVE-ID
CVE-2013-5227 : Niklas Malmgren of Klarna AB
WebKit
Available for: OS X Lion v10.7.5, OS X Lion Server v10.7.5,
OS X Mountain Lion v10.8.5, OS X Mavericks v10.9
Impact: Visiting a maliciously crafted website may lead to an
unexpected application termination or arbitrary code execution
Description: Multiple memory corruption issues existed in WebKit.
These issues were addressed through improved memory handling.
CVE-ID
CVE-2013-2909 : Atte Kettunen of OUSPG
CVE-2013-5195 : Apple
CVE-2013-5196 : Google Chrome Security Team
CVE-2013-5197 : Google Chrome Security Team
CVE-2013-5198 : Apple
CVE-2013-5199 : Apple
CVE-2013-5225 : Google Chrome Security Team
CVE-2013-5228 : Keen Team (@K33nTeam) working with HP's Zero Day
Initiative
For OS X Mavericks systems, Safari 7.0.1 will be included
in OS X Mavericks 10.9.1.
For OS X Mountain Lion systems Safari 6.1 may be obtained from
Mac App Store.
For OS X Lion systems Safari 6.1 is available via the Apple Software
Update application.
Information will also be posted to the Apple Security Updates
web site: http://support.apple.com/kb/HT1222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
