Apple Safari Malformed SVGList Parsing Code Execution Vulnerability
20 May 2009
Summary
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple Safari. User interaction is required to exploit this vulnerability in that the target must visit a malicious page.
Vulnerable Systems:
* Mac OS X version 10.4.11
* Mac OS X Server version 10.4.11
The specific flaw exists during the parsing of malformed SVGLists via the SVGPathList data structure, the following lists are affected: SVGTransformList, SVGStringList, SVGNumberList, SVGPathSegList, SVGPointList, SVGLengthList. When a negative index argument is suppled to the insertItemBefore() method, a memory corruption occurs resulting in the ability to execute arbitrary code.
Patch Availability:
Update to Safari 3.2.3 - Apple has issued an update to correct this vulnerability. More details can be found at: http://support.apple.com/kb/HT3549
