CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 1CVE-2007-3742
https://notcve.org/view.php?id=CVE-2007-3742
WebKit in Apple Safari 3 Beta before Update 3.0.3, and iPhone before 1.0.1, does not properly handle the interaction between International Domain Name (IDN) support and Unicode fonts, which allows remote attackers to create a URL containing "look-alike characters" (homographs) and possibly perform phishing attacks. WEbKit en Apple Safari 3 Beta anterior al Update 3.0.3, y iPhone anterior a 1.0.1, no maneja adecuadamente la interacción entre el soporte para Nombres de Dominio Internacionales (International Domain Name o IDN) y las fuentes Unicode, lo cual permite a atacantes remotos crear un URL conteniendo "caracteres con apariencia similar" (homógrafos), y posiblemente realizar ataques de fraude (phishing). • http://docs.info.apple.com/article.html?artnum=306173 http://docs.info.apple.com/article.html?artnum=306174 http://isc.sans.org/diary.html?storyid=3214 http://secunia.com/advisories/26287 http://www.securityfocus.com/bid/24636 http://www.securitytracker.com/id?1018488 http://www.vupen.com/english/advisories/2007/2730 http://www.vupen.com/english/advisories/2007/2731 https://exchange.xforce.ibmcloud.com/vulnerabilities/35716 • CWE-16: Configuration CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 6.8EPSS: 2%CPEs: 1EXPL: 0CVE-2007-3743
https://notcve.org/view.php?id=CVE-2007-3743
Stack-based buffer overflow in bookmark handling in Apple Safari 3 Beta before Update 3.0.3 on Windows allows user-assisted remote attackers to cause a denial of service (application crash) or execute arbitrary code via a bookmark with a long title. Desbordamiento de búfer basado en pila en la gestión de marcadores de Apple Safari 3 Beta anterior a la actualización 3.0.3 en Windows permite a atacantes remotos con la complicidad del usuario provocar una denegación de servicio (caída de la aplicación) o ejecutar código de su elección mediante un marcador con un título largo. • http://docs.info.apple.com/article.html?artnum=306174 http://isc.sans.org/diary.html?storyid=3214 http://osvdb.org/40882 http://www.securitytracker.com/id?1018495 https://exchange.xforce.ibmcloud.com/vulnerabilities/35712 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.3EPSS: 58%CPEs: 3EXPL: 0CVE-2007-3944
https://notcve.org/view.php?id=CVE-2007-3944
Multiple heap-based buffer overflows in the Perl Compatible Regular Expressions (PCRE) library in the JavaScript engine in WebKit in Apple Safari 3 Beta before Update 3.0.3, and iPhone before 1.0.1, allow remote attackers to execute arbitrary code via certain JavaScript regular expressions. NOTE: this issue was originally reported only for MobileSafari on the iPhone. NOTE: it is not clear whether this stems from an issue in the original distribution of PCRE, which might already have a separate CVE identifier. Múltiples desbordamientos de búfer en la región heap de la memoria en la biblioteca de Perl Compatible Regular Expressions (PCRE) en el motor de JavaScript en WebKit en Apple Safari versión 3 Beta anterior al Update 3.0.3 y iPhone versiones anteriores a 1.0.1, permiten a atacantes remotos ejecutar código arbitrario por medio de cierto expresiones regulares de JavaScript. NOTA: este problema se reportó originalmente solo para MobileSafari en el iPhone. • http://docs.info.apple.com/article.html?artnum=306173 http://docs.info.apple.com/article.html?artnum=306174 http://secunia.com/advisories/26287 http://www.nytimes.com/2007/07/23/technology/23iphone.html?_r=1&adxnnl=1&adxnnlx=1185163364-1OTsRJvbylLamj17FY2wnw&oref=slogin http://www.securityevaluators.com/iphone http://www.securityevaluators.com/iphone/exploitingiphone.pdf http://www.securityfocus.com/bid/25002 http://www.securitytracker.com/id?1018439 http://www.vupen.com/english/advisories/2007& • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2007-3718
https://notcve.org/view.php?id=CVE-2007-3718
Multiple unspecified vulnerabilities in the SVG parsing engine in Apple Safari 3 Beta for Windows have unspecified remote attack vectors and impact. NOTE: this issue contains no actionable information, but it was released by a reliable researcher. Múltiples vulnerabilidades no especificadas en el motor de análisis SVG de Apple Safari 3 Beta para Windows tienen vectores de ataque remotos e impacto no especificados. NOTA: esta notificación no contiene información concreta, pero ha sido divulgado por un investigador fiable. • http://osvdb.org/38858 http://security-protocols.com/2007/06/12/safari-3-beta-released-on-windows http://www.securityfocus.com/bid/24446 •
CVSS: 8.5EPSS: 0%CPEs: 1EXPL: 0CVE-2007-3514
https://notcve.org/view.php?id=CVE-2007-3514
Cross-domain vulnerability in Apple Safari for Windows 3.0.2 allows remote attackers to bypass the Same Origin Policy and access restricted information from other domains via JavaScript that overwrites the document variable and statically sets the document.domain attribute to a file:// location, a different vector than CVE-2007-3482. Vulnerabilidad de dominio cruzado en Apple Safari para Windows 3.0.2 permite a atacantes remotos evitar la Política de Mismo Origen y acceder a información restringida de otros dominios mediante JavaScript que sobrescribe la variable document y establece el atributo document.domain estadísticamente a unalocalización file://, un vector diferente de CVE-2007-3482. • http://osvdb.org/38861 http://www.0x000000.com/?i=371 •