// For flags

CVE-2012-3748

(Mobile Pwn2Own) Apple Safari shiftCount/splice Remote Code Execution Vulnerability

Severity Score

5.1
*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Race condition in WebKit in Apple iOS before 6.0.1 and Safari before 6.0.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving JavaScript arrays.

Una condición de carrera en WebKit de Apple iOS antes de v6.0.1 y Safari antes de v6.0.2 permite a atacantes remotos ejecutar código de su elección o causar una denegación de servicio (caída de la aplicación) a través de vectores relacionados con las matrices en JavaScript.

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple Safari. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the handling of Array objects. When splicing a sparse array, the size of a sparse array is not properly validated. In addition, parameters checked at the beginning of a function are never again validated despite being modified later on. By abusing this behavior an attacker can ensure this memory is under control and leverage the situation to achieve remote code execution.

*Credits: Joost Pol and Daan Keuper of Certified Secure
CVSS Scores
Attack Vector
Network
Attack Complexity
High
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2012-06-19 CVE Reserved
  • 2012-11-02 CVE Published
  • 2013-09-04 First Exploit
  • 2024-08-06 CVE Updated
  • 2024-11-22 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
<= 6.0.1
Search vendor "Apple" for product "Safari" and version " <= 6.0.1"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
1.0
Search vendor "Apple" for product "Safari" and version "1.0"
beta
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
1.0
Search vendor "Apple" for product "Safari" and version "1.0"
beta2
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
1.0.0
Search vendor "Apple" for product "Safari" and version "1.0.0"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
1.0.0b1
Search vendor "Apple" for product "Safari" and version "1.0.0b1"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
1.0.0b2
Search vendor "Apple" for product "Safari" and version "1.0.0b2"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
1.0.1
Search vendor "Apple" for product "Safari" and version "1.0.1"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
1.0.2
Search vendor "Apple" for product "Safari" and version "1.0.2"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
1.0.3
Search vendor "Apple" for product "Safari" and version "1.0.3"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
1.1.0
Search vendor "Apple" for product "Safari" and version "1.1.0"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
1.1.1
Search vendor "Apple" for product "Safari" and version "1.1.1"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
1.2.0
Search vendor "Apple" for product "Safari" and version "1.2.0"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
1.2.1
Search vendor "Apple" for product "Safari" and version "1.2.1"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
1.2.2
Search vendor "Apple" for product "Safari" and version "1.2.2"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
1.2.3
Search vendor "Apple" for product "Safari" and version "1.2.3"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
1.2.4
Search vendor "Apple" for product "Safari" and version "1.2.4"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
1.2.5
Search vendor "Apple" for product "Safari" and version "1.2.5"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
1.3
Search vendor "Apple" for product "Safari" and version "1.3"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
1.3.0
Search vendor "Apple" for product "Safari" and version "1.3.0"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
1.3.1
Search vendor "Apple" for product "Safari" and version "1.3.1"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
1.3.2
Search vendor "Apple" for product "Safari" and version "1.3.2"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
2.0.0
Search vendor "Apple" for product "Safari" and version "2.0.0"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
2.0.1
Search vendor "Apple" for product "Safari" and version "2.0.1"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
2.0.2
Search vendor "Apple" for product "Safari" and version "2.0.2"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
2.0.3
Search vendor "Apple" for product "Safari" and version "2.0.3"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
2.0.4
Search vendor "Apple" for product "Safari" and version "2.0.4"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
3.0.0
Search vendor "Apple" for product "Safari" and version "3.0.0"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
3.0.0b
Search vendor "Apple" for product "Safari" and version "3.0.0b"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
3.0.1
Search vendor "Apple" for product "Safari" and version "3.0.1"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
3.0.1
Search vendor "Apple" for product "Safari" and version "3.0.1"
beta
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
3.0.1b
Search vendor "Apple" for product "Safari" and version "3.0.1b"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
3.0.2
Search vendor "Apple" for product "Safari" and version "3.0.2"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
3.0.2b
Search vendor "Apple" for product "Safari" and version "3.0.2b"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
3.0.3
Search vendor "Apple" for product "Safari" and version "3.0.3"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
3.0.3b
Search vendor "Apple" for product "Safari" and version "3.0.3b"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
3.0.4
Search vendor "Apple" for product "Safari" and version "3.0.4"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
3.0.4b
Search vendor "Apple" for product "Safari" and version "3.0.4b"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
3.1.0
Search vendor "Apple" for product "Safari" and version "3.1.0"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
3.1.0b
Search vendor "Apple" for product "Safari" and version "3.1.0b"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
3.1.1
Search vendor "Apple" for product "Safari" and version "3.1.1"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
3.1.2
Search vendor "Apple" for product "Safari" and version "3.1.2"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
3.2.0
Search vendor "Apple" for product "Safari" and version "3.2.0"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
3.2.1
Search vendor "Apple" for product "Safari" and version "3.2.1"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
3.2.2
Search vendor "Apple" for product "Safari" and version "3.2.2"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
4.0
Search vendor "Apple" for product "Safari" and version "4.0"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
4.0
Search vendor "Apple" for product "Safari" and version "4.0"
beta
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
4.0.0b
Search vendor "Apple" for product "Safari" and version "4.0.0b"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
4.0.1
Search vendor "Apple" for product "Safari" and version "4.0.1"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
4.0.2
Search vendor "Apple" for product "Safari" and version "4.0.2"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
4.0.3
Search vendor "Apple" for product "Safari" and version "4.0.3"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
4.0.4
Search vendor "Apple" for product "Safari" and version "4.0.4"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
4.0.5
Search vendor "Apple" for product "Safari" and version "4.0.5"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
4.1
Search vendor "Apple" for product "Safari" and version "4.1"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
4.1.1
Search vendor "Apple" for product "Safari" and version "4.1.1"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
4.1.2
Search vendor "Apple" for product "Safari" and version "4.1.2"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
5.0
Search vendor "Apple" for product "Safari" and version "5.0"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
5.0.1
Search vendor "Apple" for product "Safari" and version "5.0.1"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
5.0.2
Search vendor "Apple" for product "Safari" and version "5.0.2"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
5.0.4
Search vendor "Apple" for product "Safari" and version "5.0.4"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
5.0.5
Search vendor "Apple" for product "Safari" and version "5.0.5"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
5.0.6
Search vendor "Apple" for product "Safari" and version "5.0.6"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
5.1
Search vendor "Apple" for product "Safari" and version "5.1"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
5.1.1
Search vendor "Apple" for product "Safari" and version "5.1.1"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
5.1.2
Search vendor "Apple" for product "Safari" and version "5.1.2"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
5.1.3
Search vendor "Apple" for product "Safari" and version "5.1.3"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
5.1.4
Search vendor "Apple" for product "Safari" and version "5.1.4"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
5.1.5
Search vendor "Apple" for product "Safari" and version "5.1.5"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
5.1.6
Search vendor "Apple" for product "Safari" and version "5.1.6"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
5.1.7
Search vendor "Apple" for product "Safari" and version "5.1.7"
-
Affected
Apple
Search vendor "Apple"
Safari
Search vendor "Apple" for product "Safari"
6.0
Search vendor "Apple" for product "Safari" and version "6.0"
-
Affected
Apple
Search vendor "Apple"
Iphone Os
Search vendor "Apple" for product "Iphone Os"
<= 6.0
Search vendor "Apple" for product "Iphone Os" and version " <= 6.0"
-
Affected
Apple
Search vendor "Apple"
Iphone Os
Search vendor "Apple" for product "Iphone Os"
1.0.0
Search vendor "Apple" for product "Iphone Os" and version "1.0.0"
-
Affected
Apple
Search vendor "Apple"
Iphone Os
Search vendor "Apple" for product "Iphone Os"
1.0.1
Search vendor "Apple" for product "Iphone Os" and version "1.0.1"
-
Affected
Apple
Search vendor "Apple"
Iphone Os
Search vendor "Apple" for product "Iphone Os"
1.0.2
Search vendor "Apple" for product "Iphone Os" and version "1.0.2"
-
Affected
Apple
Search vendor "Apple"
Iphone Os
Search vendor "Apple" for product "Iphone Os"
1.1.0
Search vendor "Apple" for product "Iphone Os" and version "1.1.0"
-
Affected
Apple
Search vendor "Apple"
Iphone Os
Search vendor "Apple" for product "Iphone Os"
1.1.1
Search vendor "Apple" for product "Iphone Os" and version "1.1.1"
-
Affected
Apple
Search vendor "Apple"
Iphone Os
Search vendor "Apple" for product "Iphone Os"
1.1.2
Search vendor "Apple" for product "Iphone Os" and version "1.1.2"
-
Affected
Apple
Search vendor "Apple"
Iphone Os
Search vendor "Apple" for product "Iphone Os"
1.1.3
Search vendor "Apple" for product "Iphone Os" and version "1.1.3"
-
Affected
Apple
Search vendor "Apple"
Iphone Os
Search vendor "Apple" for product "Iphone Os"
1.1.4
Search vendor "Apple" for product "Iphone Os" and version "1.1.4"
-
Affected
Apple
Search vendor "Apple"
Iphone Os
Search vendor "Apple" for product "Iphone Os"
1.1.5
Search vendor "Apple" for product "Iphone Os" and version "1.1.5"
-
Affected
Apple
Search vendor "Apple"
Iphone Os
Search vendor "Apple" for product "Iphone Os"
2.0
Search vendor "Apple" for product "Iphone Os" and version "2.0"
-
Affected
Apple
Search vendor "Apple"
Iphone Os
Search vendor "Apple" for product "Iphone Os"
2.0.0
Search vendor "Apple" for product "Iphone Os" and version "2.0.0"
-
Affected
Apple
Search vendor "Apple"
Iphone Os
Search vendor "Apple" for product "Iphone Os"
2.0.1
Search vendor "Apple" for product "Iphone Os" and version "2.0.1"
-
Affected
Apple
Search vendor "Apple"
Iphone Os
Search vendor "Apple" for product "Iphone Os"
2.0.2
Search vendor "Apple" for product "Iphone Os" and version "2.0.2"
-
Affected
Apple
Search vendor "Apple"
Iphone Os
Search vendor "Apple" for product "Iphone Os"
2.1
Search vendor "Apple" for product "Iphone Os" and version "2.1"
-
Affected
Apple
Search vendor "Apple"
Iphone Os
Search vendor "Apple" for product "Iphone Os"
2.1.1
Search vendor "Apple" for product "Iphone Os" and version "2.1.1"
-
Affected
Apple
Search vendor "Apple"
Iphone Os
Search vendor "Apple" for product "Iphone Os"
2.2
Search vendor "Apple" for product "Iphone Os" and version "2.2"
-
Affected
Apple
Search vendor "Apple"
Iphone Os
Search vendor "Apple" for product "Iphone Os"
2.2.1
Search vendor "Apple" for product "Iphone Os" and version "2.2.1"
-
Affected
Apple
Search vendor "Apple"
Iphone Os
Search vendor "Apple" for product "Iphone Os"
3.0
Search vendor "Apple" for product "Iphone Os" and version "3.0"
-
Affected
Apple
Search vendor "Apple"
Iphone Os
Search vendor "Apple" for product "Iphone Os"
3.0.1
Search vendor "Apple" for product "Iphone Os" and version "3.0.1"
-
Affected
Apple
Search vendor "Apple"
Iphone Os
Search vendor "Apple" for product "Iphone Os"
3.1
Search vendor "Apple" for product "Iphone Os" and version "3.1"
-
Affected
Apple
Search vendor "Apple"
Iphone Os
Search vendor "Apple" for product "Iphone Os"
3.1.2
Search vendor "Apple" for product "Iphone Os" and version "3.1.2"
-
Affected
Apple
Search vendor "Apple"
Iphone Os
Search vendor "Apple" for product "Iphone Os"
3.1.3
Search vendor "Apple" for product "Iphone Os" and version "3.1.3"
-
Affected
Apple
Search vendor "Apple"
Iphone Os
Search vendor "Apple" for product "Iphone Os"
3.2
Search vendor "Apple" for product "Iphone Os" and version "3.2"
-
Affected
Apple
Search vendor "Apple"
Iphone Os
Search vendor "Apple" for product "Iphone Os"
3.2.1
Search vendor "Apple" for product "Iphone Os" and version "3.2.1"
-
Affected
Apple
Search vendor "Apple"
Iphone Os
Search vendor "Apple" for product "Iphone Os"
3.2.2
Search vendor "Apple" for product "Iphone Os" and version "3.2.2"
-
Affected
Apple
Search vendor "Apple"
Iphone Os
Search vendor "Apple" for product "Iphone Os"
4.0
Search vendor "Apple" for product "Iphone Os" and version "4.0"
-
Affected
Apple
Search vendor "Apple"
Iphone Os
Search vendor "Apple" for product "Iphone Os"
4.0.1
Search vendor "Apple" for product "Iphone Os" and version "4.0.1"
-
Affected
Apple
Search vendor "Apple"
Iphone Os
Search vendor "Apple" for product "Iphone Os"
4.0.2
Search vendor "Apple" for product "Iphone Os" and version "4.0.2"
-
Affected
Apple
Search vendor "Apple"
Iphone Os
Search vendor "Apple" for product "Iphone Os"
4.1
Search vendor "Apple" for product "Iphone Os" and version "4.1"
-
Affected
Apple
Search vendor "Apple"
Iphone Os
Search vendor "Apple" for product "Iphone Os"
4.2.1
Search vendor "Apple" for product "Iphone Os" and version "4.2.1"
-
Affected
Apple
Search vendor "Apple"
Iphone Os
Search vendor "Apple" for product "Iphone Os"
4.2.5
Search vendor "Apple" for product "Iphone Os" and version "4.2.5"
-
Affected
Apple
Search vendor "Apple"
Iphone Os
Search vendor "Apple" for product "Iphone Os"
4.2.8
Search vendor "Apple" for product "Iphone Os" and version "4.2.8"
-
Affected
Apple
Search vendor "Apple"
Iphone Os
Search vendor "Apple" for product "Iphone Os"
4.3.0
Search vendor "Apple" for product "Iphone Os" and version "4.3.0"
-
Affected
Apple
Search vendor "Apple"
Iphone Os
Search vendor "Apple" for product "Iphone Os"
4.3.1
Search vendor "Apple" for product "Iphone Os" and version "4.3.1"
-
Affected
Apple
Search vendor "Apple"
Iphone Os
Search vendor "Apple" for product "Iphone Os"
4.3.2
Search vendor "Apple" for product "Iphone Os" and version "4.3.2"
-
Affected
Apple
Search vendor "Apple"
Iphone Os
Search vendor "Apple" for product "Iphone Os"
4.3.3
Search vendor "Apple" for product "Iphone Os" and version "4.3.3"
-
Affected
Apple
Search vendor "Apple"
Iphone Os
Search vendor "Apple" for product "Iphone Os"
4.3.5
Search vendor "Apple" for product "Iphone Os" and version "4.3.5"
-
Affected
Apple
Search vendor "Apple"
Iphone Os
Search vendor "Apple" for product "Iphone Os"
5.0
Search vendor "Apple" for product "Iphone Os" and version "5.0"
-
Affected
Apple
Search vendor "Apple"
Iphone Os
Search vendor "Apple" for product "Iphone Os"
5.0.1
Search vendor "Apple" for product "Iphone Os" and version "5.0.1"
-
Affected
Apple
Search vendor "Apple"
Iphone Os
Search vendor "Apple" for product "Iphone Os"
5.1.1
Search vendor "Apple" for product "Iphone Os" and version "5.1.1"
-
Affected