LAS VEGAS — Apple has shipped a major Safari browser update to fix 15 documented security holes, including a known flaw in the browser’s AutoFill Web Forms feature that can be hacked to steal data from the computer’s address book.
The update comes ahead of a presentation at this year’s Black Hat security conference where Web application security researcher Jeremiah Grossman is scheduled to discuss the AutoFill hack.
According to Apple, Safari’s AutoFill feature may disclose information to websites without any user interaction.
An implementation issue exists that allows a maliciously crafted website to trigger AutoFill without user interaction. This can result in the disclosure of information contained within the user’s Address Book Card. To trigger the issue, the following two situations are required. First, in Safari : Preferences : AutoFill, the “Autofill web forms using info from my Address Book card” checkbox must be checked. Second, the user’s Address Book must have a Card designated as “My Card”. Only the information in that specific card is accessed via AutoFill.
[ SEE: Apple Safari 'AutoFill' allows data theft ]
The update, available for Mac OS X and Windows users, also patches a critical vulnerability that allows hacker attacks via maliciously rigged RSS feeds. Apple describes this as a cross-site scripting issue that may cause files from the user’s system to be sent to a remote server if the user accesses a maliciously crafted RSS feed.
The patch also covers a slew of potentially dangerous WebKit flaws, including some that could lead to drive-by download attacks.
- A use after free issue exists in WebKit’s handling of element focus. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. This issue is addressed through improved handling of element focus.
- A memory corruption issue exists in WebKit’s rendering of inline elements. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. This issue is addressed through improved bounds checking.
- A memory corruption issue exists in WebKit’s handling of dynamic modifications to text nodes. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. This issue is addressed through improved memory management.
- A memory corruption issue exists in WebKit’s handling of CSS counters. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. This issue is addressed through improved memory management.
- An uninitialized memory access issue exists in WebKit’s handling of the :first-letter and :first-line pseudo-elements in SVG text elements. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. This issue is addressed by not rendering :first-letter or :first-line pseudo-elements in SVG text elements.
- A use after free issue exists in WebKit’s handling of foreignObject elements in SVG documents. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. This issue is addressed through additional validation of SVG documents.
