CVE

Id
40451  
CVE No.
CVE-2009-3016  
Status
Candidate  
Description
Apple Safari 4.0.3 does not properly block javascript: and data: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header that contains a javascript: URI, (2) entering a javascript: URI when specifying the content of a Refresh header, (3) injecting a Refresh header that contains JavaScript sequences in a data:text/html URI, or (4) entering a data:text/html URI with JavaScript sequences when specifying the content of a Refresh header.  
Phase
Assigned (20090831)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
444417 40451 CVE-2009-3016 MISC:http://websecurity.com.ua/3386/  View
444418 40451 CVE-2009-3016 OVAL:oval:org.mitre.oval:def:6475  View
444419 40451 CVE-2009-3016 URL:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:6475  View
444420 40451 CVE-2009-3016 XF:safari-javascript-xss(52992)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
43900 JVNDB-2009-004907 Microsoft Windows Server 2003 SP2 の win32k.sys におけるサービス運用妨害 (DoS) の脆弱性 Microsoft Windows Server 2003 SP2 の win32k.sys は、Embedded OpenType (EOT) Font Engine に関する処理に不備があるため、サービス運用妨害 (システムクラッシュ) 状態となる脆弱性が存在します。 CVE-2009-3020 40451 7.1 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-004907.html  View