Details of VAR-201409-0508

ID

VAR-201409-0508

CVE

CVE-2014-4413

TITLE

Apple iOS and Apple TV Used in etc. WebKit Vulnerable to arbitrary code execution

Trust: 0.8

sources: JVNDB: JVNDB-2014-004324

DESCRIPTION

WebKit, as used in Apple iOS before 8 and Apple TV before 7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-09-17-1 and APPLE-SA-2014-09-17-2. Apple iOS and Apple TV Used in etc. WebKit is prone to multiple unspecified memory-corruption vulnerabilities. An attacker may exploit these issues by enticing victims into viewing a malicious webpage. Successful exploits may allow attackers to execute arbitrary code in the context of the affected browser or cause denial-of-service conditions; other attacks may also be possible. This BID is being retired. WebKit is a set of open source web browser engines jointly developed by companies such as KDE, Apple (Apple), and Google (Google), and is currently used by browsers such as Apple Safari and Google Chrome. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2014-09-17-4 Safari 6.2 and Safari 7.1 Safari 6.2 and Safari 7.1 are now available and address the following: Safari Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5 Impact: An attacker with a privileged network position may intercept user credentials Description: Saved passwords were autofilled on http sites, on https sites with broken trust, and in iframes. This issue was addressed by restricting password autofill to the main frame of https sites with valid certificate chains. CVE-ID CVE-2014-4363 : David Silver, Suman Jana, and Dan Boneh of Stanford University working with Eric Chen and Collin Jackson of Carnegie Mellon University WebKit Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5 Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues existed in WebKit. These issues were addressed through improved memory handling. This was addressed by disabling access to the application cache when in private browsing mode. CVE-ID CVE-2014-4409 : Yosuke Hasegawa (NetAgent Co., Led.) Safari 7.1 and Safari 6.2 may be obtained from the Mac App Store. Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.22 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBAgAGBQJUGkSxAAoJEBcWfLTuOo7tNVcP/j3m7E6n31A4jJ+KpQK8QSaC no9gPE/qLSAyHCPY1GvaLqNAiFrfbHvJu0C9GCRQe0K7CElCIovtxUZ91PREInPw yQHsyFefeICOXwmU7fz1MWJcUufV6vdThcOzLQciSC2SomiptGdfhbi1/oyXWa7b 6W8m2adZBv4XDUfObEVO8S28/XsBRN5zHXGbGmwTqobBAGZp8G/IDiB5RjjY0vC3 TCs4TvhlWqUSyCaubqRGtvTol8+eVqFkFsJb/e4j8IlHi83BF5Gb20F+L3kW9lBH rez4sz/chnjR5cFc6Be3ciXNdG10d5urMBFTXB8u6Wu7rl5oShD25OB/j4n+8Ik4 tvQZfGsRnTicFgywX28QuRVWwldK4VFvMcHAEPZ+8FuwjJCZSLbk0JPXJTC374N2 +G/fh6knx+yNEezedUAbR93OFIDn9lKniVlfVvALs8DnI4Qvfus1yQ9Pxb4rA6Y6 wguh4HaAeasMVZeL9nA8NHPH4aVhGryhaGq3N4ykag/TKtXAn2EsOsevQ5tWRYV2 LMJiFcDHcqjOftmbkNN/jbR35PX9InSBVeFqWG++01xKpcR/YrP1uEHY3fiQC/Z4 kX7nr26nrMXJkEb28ShAlyMYmGaQdos5S6jfe2liNg2C4y4E4aUbMwi8+L/wzXO+ mlqQ1qQbOepcgb+U0iLX =muK9 -----END PGP SIGNATURE----- . ------------------------------------------------------------------------ WebKitGTK+ Security Advisory WSA-2015-0002 ------------------------------------------------------------------------ Date reported : December 28, 2015 Advisory ID : WSA-2015-0002 Advisory URL : http://webkitgtk.org/security/WSA-2015-0002.html CVE identifiers : CVE-2013-6663, CVE-2014-1748, CVE-2014-3192, CVE-2014-4409, CVE-2014-4410, CVE-2014-4411, CVE-2014-4412, CVE-2014-4413, CVE-2014-4414, CVE-2014-4452, CVE-2014-4459, CVE-2014-4465, CVE-2014-4466, CVE-2014-4468, CVE-2014-4469, CVE-2014-4470, CVE-2014-4471, CVE-2014-4472, CVE-2014-4473, CVE-2014-4474, CVE-2014-4475, CVE-2014-4476, CVE-2014-4477, CVE-2014-4479, CVE-2015-1068, CVE-2015-1069, CVE-2015-1070, CVE-2015-1071, CVE-2015-1072, CVE-2015-1073, CVE-2015-1074, CVE-2015-1075, CVE-2015-1076, CVE-2015-1077, CVE-2015-1080, CVE-2015-1081, CVE-2015-1082, CVE-2015-1083, CVE-2015-1084, CVE-2015-1119, CVE-2015-1120, CVE-2015-1121, CVE-2015-1122, CVE-2015-1124, CVE-2015-1126, CVE-2015-1127, CVE-2015-1152, CVE-2015-1153, CVE-2015-1154, CVE-2015-1155, CVE-2015-1156, CVE-2015-2330, CVE-2015-3658, CVE-2015-3659, CVE-2015-3660, CVE-2015-3727, CVE-2015-3730, CVE-2015-3731, CVE-2015-3732, CVE-2015-3733, CVE-2015-3734, CVE-2015-3735, CVE-2015-3736, CVE-2015-3737, CVE-2015-3738, CVE-2015-3739, CVE-2015-3740, CVE-2015-3741, CVE-2015-3742, CVE-2015-3743, CVE-2015-3744, CVE-2015-3745, CVE-2015-3746, CVE-2015-3747, CVE-2015-3748, CVE-2015-3749, CVE-2015-3750, CVE-2015-3751, CVE-2015-3752, CVE-2015-3753, CVE-2015-3754, CVE-2015-3755, CVE-2015-5788, CVE-2015-5789, CVE-2015-5790, CVE-2015-5791, CVE-2015-5792, CVE-2015-5793, CVE-2015-5794, CVE-2015-5795, CVE-2015-5797, CVE-2015-5798, CVE-2015-5799, CVE-2015-5800, CVE-2015-5801, CVE-2015-5802, CVE-2015-5803, CVE-2015-5804, CVE-2015-5805, CVE-2015-5806, CVE-2015-5807, CVE-2015-5809, CVE-2015-5810, CVE-2015-5811, CVE-2015-5812, CVE-2015-5813, CVE-2015-5814, CVE-2015-5815, CVE-2015-5816, CVE-2015-5817, CVE-2015-5818, CVE-2015-5819, CVE-2015-5822, CVE-2015-5823, CVE-2015-5825, CVE-2015-5826, CVE-2015-5827, CVE-2015-5828, CVE-2015-5928, CVE-2015-5929, CVE-2015-5930, CVE-2015-5931, CVE-2015-7002, CVE-2015-7012, CVE-2015-7013, CVE-2015-7014, CVE-2015-7048, CVE-2015-7095, CVE-2015-7097, CVE-2015-7099, CVE-2015-7100, CVE-2015-7102, CVE-2015-7103, CVE-2015-7104. Several vulnerabilities were discovered on WebKitGTK+. CVE-2013-6663 Versions affected: WebKitGTK+ before 2.4.0. Credit to Atte Kettunen of OUSPG. Use-after-free vulnerability in the SVGImage::setContainerSize function in core/svg/graphics/SVGImage.cpp in the SVG implementation in Blink, as used in Google Chrome before 33.0.1750.146, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the resizing of a view. CVE-2014-1748 Versions affected: WebKitGTK+ before 2.6.0. Credit to Jordan Milne. The ScrollView::paint function in platform/scroll/ScrollView.cpp in Blink, as used in Google Chrome before 35.0.1916.114, allows remote attackers to spoof the UI by extending scrollbar painting into the parent frame. CVE-2014-3192 Versions affected: WebKitGTK+ before 2.6.3. Credit to cloudfuzzer. CVE-2014-4409 Versions affected: WebKitGTK+ before 2.6.0. Credit to Yosuke Hasegawa (NetAgent Co., Led.). CVE-2014-4410 Versions affected: WebKitGTK+ before 2.6.0. Credit to Eric Seidel of Google. CVE-2014-4411 Versions affected: WebKitGTK+ before 2.6.0. Credit to Google Chrome Security Team. CVE-2014-4412 Versions affected: WebKitGTK+ before 2.4.0. CVE-2014-4413 Versions affected: WebKitGTK+ before 2.4.0. CVE-2014-4414 Versions affected: WebKitGTK+ before 2.4.0. CVE-2014-4452 Versions affected: WebKitGTK+ before 2.6.0. Credit to unknown. CVE-2014-4459 Versions affected: WebKitGTK+ before 2.6.2. Credit to unknown. CVE-2014-4465 Versions affected: WebKitGTK+ before 2.6.2. Credit to Rennie deGraaf of iSEC Partners. WebKit in Apple Safari before 6.2.1, 7.x before 7.1.1, and 8.x before 8.0.1 allows remote attackers to bypass the Same Origin Policy via crafted Cascading Style Sheets (CSS) token sequences within an SVG file in the SRC attribute of an IMG element. CVE-2014-4466 Versions affected: WebKitGTK+ before 2.6.2. CVE-2014-4468 Versions affected: WebKitGTK+ before 2.6.0. CVE-2014-4469 Versions affected: WebKitGTK+ before 2.6.4. CVE-2014-4470 Versions affected: WebKitGTK+ before 2.6.0. CVE-2014-4471 Versions affected: WebKitGTK+ before 2.6.0. CVE-2014-4472 Versions affected: WebKitGTK+ before 2.6.0. CVE-2014-4473 Versions affected: WebKitGTK+ before 2.6.0. CVE-2014-4474 Versions affected: WebKitGTK+ before 2.6.2. CVE-2014-4475 Versions affected: WebKitGTK+ before 2.6.0. CVE-2014-4476 Versions affected: WebKitGTK+ before 2.6.2. CVE-2014-4477 Versions affected: WebKitGTK+ before 2.6.4. Credit to lokihardt@ASRT working with HP’s Zero Day Initiative. CVE-2014-4479 Versions affected: WebKitGTK+ before 2.6.4. CVE-2015-1068 Versions affected: WebKitGTK+ before 2.8.0. CVE-2015-1069 Versions affected: WebKitGTK+ before 2.8.0. CVE-2015-1070 Versions affected: WebKitGTK+ before 2.8.0. CVE-2015-1071 Versions affected: WebKitGTK+ before 2.8.0. CVE-2015-1072 Versions affected: WebKitGTK+ before 2.8.0. Credit to unknown. CVE-2015-1073 Versions affected: WebKitGTK+ before 2.8.0. CVE-2015-1074 Versions affected: WebKitGTK+ before 2.6.4. CVE-2015-1075 Versions affected: WebKitGTK+ before 2.8.0. Credit to Google Chrome Security Team. CVE-2015-1076 Versions affected: WebKitGTK+ before 2.8.0. Credit to unknown. CVE-2015-1077 Versions affected: WebKitGTK+ before 2.8.0. CVE-2015-1080 Versions affected: WebKitGTK+ before 2.6.0. CVE-2015-1081 Versions affected: WebKitGTK+ before 2.8.0. CVE-2015-1082 Versions affected: WebKitGTK+ before 2.8.0. CVE-2015-1083 Versions affected: WebKitGTK+ before 2.6.4. CVE-2015-1084 Versions affected: WebKitGTK+ before 2.6.1. The user interface in WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, does not display URLs consistently, which makes it easier for remote attackers to conduct phishing attacks via a crafted URL. CVE-2015-1119 Versions affected: WebKitGTK+ before 2.8.0. Credit to Renata Hodovan of University of Szeged / Samsung Electronics. CVE-2015-1120 Versions affected: WebKitGTK+ before 2.8.0. CVE-2015-1121 Versions affected: WebKitGTK+ before 2.8.0. CVE-2015-1122 Versions affected: WebKitGTK+ before 2.10.0. CVE-2015-1124 Versions affected: WebKitGTK+ before 2.8.0. CVE-2015-1126 Versions affected: WebKitGTK+ before 2.8.0. Credit to Jouko Pynnonen of Klikki Oy. WebKit, as used in Apple iOS before 8.3 and Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, does not properly handle the userinfo field in FTP URLs, which allows remote attackers to trigger incorrect resource access via unspecified vectors. CVE-2015-1127 Versions affected: WebKitGTK+ before 2.8.0. Credit to Tyler C (2.6.5). The private-browsing implementation in WebKit in Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5 places browsing history into an index, which might allow local users to obtain sensitive information by reading index entries. CVE-2015-1152 Versions affected: WebKitGTK+ before 2.10.0. CVE-2015-1153 Versions affected: WebKitGTK+ before 2.8.0. CVE-2015-1154 Versions affected: WebKitGTK+ before 2.8.0. CVE-2015-1155 Versions affected: WebKitGTK+ before 2.10.0. Credit to Joe Vennix of Rapid7 Inc. working with HP's Zero Day Initiative. CVE-2015-1156 Versions affected: WebKitGTK+ before 2.8.0. Credit to Zachary Durber of Moodle. CVE-2015-2330 Versions affected: WebKitGTK+ before 2.6.6. Credit to Ross Lagerwall. Late TLS certificate verification in WebKitGTK+ prior to 2.6.6 allows remote attackers to view a secure HTTP request, including, for example, secure cookies. CVE-2015-3658 Versions affected: WebKitGTK+ before 2.8.1. Credit to Brad Hill of Facebook. CVE-2015-3659 Versions affected: WebKitGTK+ before 2.8.3. Credit to Peter Rutenbar working with HP's Zero Day Initiative. CVE-2015-3660 Versions affected: WebKitGTK+ before 2.10.0. CVE-2015-3727 Versions affected: WebKitGTK+ before 2.8.1. Credit to Peter Rutenbar working with HP's Zero Day Initiative. CVE-2015-3730 Versions affected: WebKitGTK+ before 2.10.0. CVE-2015-3731 Versions affected: WebKitGTK+ before 2.8.3. CVE-2015-3732 Versions affected: WebKitGTK+ before 2.8.3. CVE-2015-3733 Versions affected: WebKitGTK+ before 2.8.3. CVE-2015-3734 Versions affected: WebKitGTK+ before 2.8.3. CVE-2015-3735 Versions affected: WebKitGTK+ before 2.8.3. CVE-2015-3736 Versions affected: WebKitGTK+ before 2.8.3. CVE-2015-3737 Versions affected: WebKitGTK+ before 2.8.3. CVE-2015-3738 Versions affected: WebKitGTK+ before 2.10.0. CVE-2015-3739 Versions affected: WebKitGTK+ before 2.8.1. CVE-2015-3740 Versions affected: WebKitGTK+ before 2.10.0. CVE-2015-3741 Versions affected: WebKitGTK+ before 2.8.1. CVE-2015-3742 Versions affected: WebKitGTK+ before 2.10.0. CVE-2015-3743 Versions affected: WebKitGTK+ before 2.8.3. CVE-2015-3744 Versions affected: WebKitGTK+ before 2.10.0. CVE-2015-3745 Versions affected: WebKitGTK+ before 2.8.1. CVE-2015-3746 Versions affected: WebKitGTK+ before 2.10.0. CVE-2015-3747 Versions affected: WebKitGTK+ before 2.8.0. CVE-2015-3748 Versions affected: WebKitGTK+ before 2.8.3. CVE-2015-3749 Versions affected: WebKitGTK+ before 2.8.3. CVE-2015-3750 Versions affected: WebKitGTK+ before 2.10.0. Credit to Muneaki Nishimura (nishimunea). WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not enforce the HTTP Strict Transport Security (HSTS) protection mechanism for Content Security Policy (CSP) report requests, which allows man-in-the-middle attackers to obtain sensitive information by sniffing the network or spoof a report by modifying the client- server data stream. CVE-2015-3751 Versions affected: WebKitGTK+ before 2.10.0. Credit to Muneaki Nishimura (nishimunea). WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, allows remote attackers to bypass a Content Security Policy protection mechanism by using a video control in conjunction with an IMG element within an OBJECT element. CVE-2015-3752 Versions affected: WebKitGTK+ before 2.8.4. Credit to Muneaki Nishimura (nishimunea). The Content Security Policy implementation in WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not properly restrict cookie transmission for report requests, which allows remote attackers to obtain sensitive information via vectors involving (1) a cross- origin request or (2) a private-browsing request. CVE-2015-3753 Versions affected: WebKitGTK+ before 2.8.3. Credit to Antonio Sanso and Damien Antipa of Adobe. WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not properly perform taint checking for CANVAS elements, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive image data by leveraging a redirect to a data:image resource. CVE-2015-3754 Versions affected: WebKitGTK+ before 2.10.0. Credit to Dongsung Kim (@kid1ng). CVE-2015-3755 Versions affected: WebKitGTK+ before 2.10.0. Credit to xisigr of Tencent's Xuanwu Lab. WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, allows remote attackers to spoof the user interface via a malformed URL. CVE-2015-5788 Versions affected: WebKitGTK+ before 2.8.0. The WebKit Canvas implementation in Apple iOS before 9 allows remote attackers to bypass the Same Origin Policy and obtain sensitive image information via vectors involving a CANVAS element. CVE-2015-5789 Versions affected: WebKitGTK+ before 2.6.1. CVE-2015-5790 Versions affected: WebKitGTK+ before 2.6.2. CVE-2015-5791 Versions affected: WebKitGTK+ before 2.6.0. CVE-2015-5792 Versions affected: WebKitGTK+ before 2.4.0. CVE-2015-5793 Versions affected: WebKitGTK+ before 2.8.0. CVE-2015-5794 Versions affected: WebKitGTK+ before 2.8.0. CVE-2015-5795 Versions affected: WebKitGTK+ before 2.8.3. CVE-2015-5797 Versions affected: WebKitGTK+ before 2.8.0. CVE-2015-5798 Versions affected: WebKitGTK+ before 2.6.0. CVE-2015-5799 Versions affected: WebKitGTK+ before 2.8.0. CVE-2015-5800 Versions affected: WebKitGTK+ before 2.8.0. CVE-2015-5801 Versions affected: WebKitGTK+ before 2.8.0. CVE-2015-5802 Versions affected: WebKitGTK+ before 2.6.0. CVE-2015-5803 Versions affected: WebKitGTK+ before 2.8.0. CVE-2015-5804 Versions affected: WebKitGTK+ before 2.10.0. CVE-2015-5805 Versions affected: WebKitGTK+ before 2.10.0. Credit to unknown. CVE-2015-5806 Versions affected: WebKitGTK+ before 2.8.3. CVE-2015-5807 Versions affected: WebKitGTK+ before 2.10.0. CVE-2015-5809 Versions affected: WebKitGTK+ before 2.8.4. CVE-2015-5810 Versions affected: WebKitGTK+ before 2.10.0. CVE-2015-5811 Versions affected: WebKitGTK+ before 2.8.0. CVE-2015-5812 Versions affected: WebKitGTK+ before 2.8.0. CVE-2015-5813 Versions affected: WebKitGTK+ before 2.10.0. CVE-2015-5814 Versions affected: WebKitGTK+ before 2.10.0. CVE-2015-5815 Versions affected: WebKitGTK+ before 2.10.0. CVE-2015-5816 Versions affected: WebKitGTK+ before 2.8.0. CVE-2015-5817 Versions affected: WebKitGTK+ before 2.10.0. CVE-2015-5818 Versions affected: WebKitGTK+ before 2.10.0. CVE-2015-5819 Versions affected: WebKitGTK+ before 2.8.0. CVE-2015-5822 Versions affected: WebKitGTK+ before 2.8.1. Credit to Mark S. Miller of Google. CVE-2015-5823 Versions affected: WebKitGTK+ before 2.8.0. CVE-2015-5825 Versions affected: WebKitGTK+ before 2.10.0. Credit to Yossi Oren et al. of Columbia University's Network Security Lab. CVE-2015-5826 Versions affected: WebKitGTK+ before 2.6.5. Credit to filedescriptior, Chris Evans. CVE-2015-5827 Versions affected: WebKitGTK+ before 2.10.0. Credit to Gildas. WebKit in Apple iOS before 9 allows remote attackers to bypass the Same Origin Policy and obtain an object reference via vectors involving a (1) custom event, (2) message event, or (3) pop state event. CVE-2015-5828 Versions affected: WebKitGTK+ before 2.10.0. Credit to Lorenzo Fontana. CVE-2015-5928 Versions affected: WebKitGTK+ before 2.8.4. CVE-2015-5929 Versions affected: WebKitGTK+ before 2.10.0. CVE-2015-5930 Versions affected: WebKitGTK+ before 2.10.0. CVE-2015-5931 Versions affected: WebKitGTK+ before 2.10.0. Credit to unknown. CVE-2015-7002 Versions affected: WebKitGTK+ before 2.10.0. CVE-2015-7012 Versions affected: WebKitGTK+ before 2.8.4. CVE-2015-7013 Versions affected: WebKitGTK+ before 2.10.0. CVE-2015-7014 Versions affected: WebKitGTK+ before 2.10.0. Credit to unknown. CVE-2015-7048 Versions affected: WebKitGTK+ before 2.10.0. CVE-2015-7095 Versions affected: WebKitGTK+ before 2.10.2. CVE-2015-7097 Versions affected: WebKitGTK+ before 2.10.3. CVE-2015-7099 Versions affected: WebKitGTK+ before 2.10.0. CVE-2015-7100 Versions affected: WebKitGTK+ before 2.10.0. CVE-2015-7102 Versions affected: WebKitGTK+ before 2.10.0. CVE-2015-7103 Versions affected: WebKitGTK+ before 2.10.0. CVE-2015-7104 Versions affected: WebKitGTK+ before 2.10.0. We recommend updating to the last stable version of WebKitGTK+. It is the best way of ensuring that you are running a safe version of WebKitGTK+. Please check our website for information about the last stable releases. Further information about WebKitGTK+ Security Advisories can be found at: http://webkitgtk.org/security.html The WebKitGTK+ team, December 28, 2015 . - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory [ERRATA UPDATE] GLSA 201612-41 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: WebKitGTK+: Multiple vulnerabilities Date: December 13, 2016 Bugs: #570034 ID: 201612-41 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Errata ====== The original GLSA contained additional bugs and CVEs which did not pertain to the affected package versions listed. The corrected sections appear below and in the "Bugs" listed above. Synopsis ======== Multiple vulnerabilities have been found in WebKitGTK+, the worst of which may allow execution of arbitrary code. Background ========== WebKitGTK+ is a full-featured port of the WebKit rendering engine, suitable for projects requiring any kind of web integration, from hybrid HTML/CSS applications to full-fledged web browsers. It offers WebKit=E2=80=99s full functionality and is useful in a wide range of syst= ems from desktop computers to embedded systems like phones, tablets, and televisions. WebKitGTK+ is made by a lively community of developers and designers, who hope to bring the web platform to everyone. It=E2=80=99s t= he official web engine of the GNOME platform and is used in browsers such as Epiphany and Midori. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-libs/webkit-gtk < 2.4.10-r200 >= 2.4.10-r200 Description =========== Multiple vulnerabilities have been discovered in WebKitGTK+. Please review the CVE identifiers referenced below for details. Workaround ========== There is no known workaround at this time. Resolution ========== All WebKitGTK+ users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=net-libs/webkit-gtk-2.4.10-r200" References ========== [ 1 ] CVE-2014-4412 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-4412 [ 2 ] CVE-2014-4413 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-4413 [ 3 ] CVE-2014-4414 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-4414 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201612-41 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2016 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5

Trust: 2.52

sources: NVD: CVE-2014-4413 // JVNDB: JVNDB-2014-004324 // BID: 69881 // BID: 69974 // VULHUB: VHN-72353 // PACKETSTORM: 128316 // PACKETSTORM: 135081 // PACKETSTORM: 140131

AFFECTED PRODUCTS

vendor:	apple	model:	iphone os	scope:	eq	version:	7.0.4	Trust: 1.6
vendor:	apple	model:	iphone os	scope:	eq	version:	7.0.6	Trust: 1.6
vendor:	apple	model:	iphone os	scope:	eq	version:	7.0.5	Trust: 1.6
vendor:	apple	model:	iphone os	scope:	eq	version:	7.0.3	Trust: 1.6
vendor:	apple	model:	iphone os	scope:	eq	version:	7.0.2	Trust: 1.6
vendor:	apple	model:	iphone os	scope:	eq	version:	7.0	Trust: 1.0
vendor:	apple	model:	tvos	scope:	eq	version:	6.1.2	Trust: 1.0
vendor:	apple	model:	iphone os	scope:	eq	version:	7.1	Trust: 1.0
vendor:	apple	model:	tvos	scope:	eq	version:	6.0.1	Trust: 1.0
vendor:	apple	model:	tvos	scope:	eq	version:	6.1.1	Trust: 1.0
vendor:	apple	model:	tvos	scope:	eq	version:	6.1	Trust: 1.0
vendor:	apple	model:	mac os x	scope:	lte	version:	10.9.4	Trust: 1.0
vendor:	apple	model:	iphone os	scope:	eq	version:	7.0.1	Trust: 1.0
vendor:	apple	model:	iphone os	scope:	eq	version:	7.1.1	Trust: 1.0
vendor:	apple	model:	iphone os	scope:	lte	version:	7.1.2	Trust: 1.0
vendor:	apple	model:	tvos	scope:	eq	version:	6.0.2	Trust: 1.0
vendor:	apple	model:	tvos	scope:	eq	version:	6.0	Trust: 1.0
vendor:	apple	model:	tvos	scope:	lte	version:	6.2	Trust: 1.0
vendor:	apple	model:	tv	scope:	lt	version:	7 (apple tv first 3 after generation )	Trust: 0.8
vendor:	apple	model:	ios	scope:	lt	version:	8 (ipad 2 or later )	Trust: 0.8
vendor:	apple	model:	ios	scope:	lt	version:	8 (iphone 4s or later )	Trust: 0.8
vendor:	apple	model:	ios	scope:	lt	version:	8 (ipod touch first 5 after generation )	Trust: 0.8
vendor:	apple	model:	itunes	scope:	lt	version:	12.0.1 (windows)	Trust: 0.8
vendor:	apple	model:	safari	scope:	lt	version:	6.2 (os x mavericks 10.9.5)	Trust: 0.8
vendor:	apple	model:	safari	scope:	lt	version:	6.2 (os x mountain lion 10.8.5)	Trust: 0.8
vendor:	apple	model:	safari	scope:	lt	version:	7.1 (os x mavericks 10.9.5)	Trust: 0.8
vendor:	apple	model:	safari	scope:	lt	version:	7.1 (os x mountain lion 10.8.5)	Trust: 0.8
vendor:	webkit	model:	open source project webkit	scope:	eq	version:	0	Trust: 0.6
vendor:	apple	model:	ipod touch	scope:	eq	version:	0	Trust: 0.6
vendor:	apple	model:	iphone	scope:	eq	version:	0	Trust: 0.6
vendor:	apple	model:	ipad	scope:	eq	version:	0	Trust: 0.6
vendor:	apple	model:	ios	scope:	eq	version:	4.2.1	Trust: 0.6
vendor:	apple	model:	ios	scope:	eq	version:	4.0.2	Trust: 0.6
vendor:	apple	model:	ios	scope:	eq	version:	4.0.1	Trust: 0.6
vendor:	apple	model:	ios	scope:	eq	version:	3.2.2	Trust: 0.6
vendor:	apple	model:	ios	scope:	eq	version:	3.2.1	Trust: 0.6
vendor:	apple	model:	ios	scope:	eq	version:	5.1.1	Trust: 0.6
vendor:	apple	model:	ios	scope:	eq	version:	5.1	Trust: 0.6
vendor:	apple	model:	ios	scope:	eq	version:	5.0.1	Trust: 0.6
vendor:	apple	model:	ios	scope:	eq	version:	5	Trust: 0.6
vendor:	apple	model:	ios	scope:	eq	version:	4.3.5	Trust: 0.6
vendor:	apple	model:	ios	scope:	eq	version:	4.3.4	Trust: 0.6
vendor:	apple	model:	ios	scope:	eq	version:	4.3.3	Trust: 0.6
vendor:	apple	model:	ios	scope:	eq	version:	4.3.2	Trust: 0.6
vendor:	apple	model:	ios	scope:	eq	version:	4.3.1	Trust: 0.6
vendor:	apple	model:	ios	scope:	eq	version:	4.3	Trust: 0.6
vendor:	apple	model:	ios	scope:	eq	version:	4.2.9	Trust: 0.6
vendor:	apple	model:	ios	scope:	eq	version:	4.2.8	Trust: 0.6
vendor:	apple	model:	ios	scope:	eq	version:	4.2.7	Trust: 0.6
vendor:	apple	model:	ios	scope:	eq	version:	4.2.6	Trust: 0.6
vendor:	apple	model:	ios	scope:	eq	version:	4.2.5	Trust: 0.6
vendor:	apple	model:	ios	scope:	eq	version:	4.2.10	Trust: 0.6
vendor:	apple	model:	ios beta	scope:	eq	version:	4.2	Trust: 0.6
vendor:	apple	model:	ios	scope:	eq	version:	4.2	Trust: 0.6
vendor:	apple	model:	ios	scope:	eq	version:	4.1	Trust: 0.6
vendor:	apple	model:	ios	scope:	eq	version:	4	Trust: 0.6
vendor:	apple	model:	ios	scope:	eq	version:	3.2	Trust: 0.6
vendor:	apple	model:	ios	scope:	eq	version:	3.1	Trust: 0.6
vendor:	apple	model:	ios	scope:	eq	version:	3.0	Trust: 0.6
vendor:	apple	model:	ios	scope:	eq	version:	2.1	Trust: 0.6
vendor:	apple	model:	ios	scope:	eq	version:	2.0	Trust: 0.6
vendor:	apple	model:	tv	scope:	eq	version:	2.1	Trust: 0.6
vendor:	apple	model:	tv	scope:	eq	version:	1.0	Trust: 0.6
vendor:	apple	model:	tv	scope:	eq	version:	6.0.1	Trust: 0.6
vendor:	apple	model:	tv	scope:	eq	version:	6.0	Trust: 0.6
vendor:	apple	model:	tv	scope:	eq	version:	6.2	Trust: 0.6
vendor:	apple	model:	tv	scope:	eq	version:	6.1.1	Trust: 0.6
vendor:	apple	model:	tv	scope:	eq	version:	6.1.2	Trust: 0.6
vendor:	esignal	model:	esignal	scope:	eq	version:	6.0.2	Trust: 0.3
vendor:	apple	model:	safari	scope:	eq	version:	5.0.6	Trust: 0.3
vendor:	apple	model:	safari	scope:	eq	version:	4.0.5	Trust: 0.3
vendor:	apple	model:	safari	scope:	eq	version:	4.0.4	Trust: 0.3
vendor:	apple	model:	safari	scope:	eq	version:	4.0.3	Trust: 0.3
vendor:	apple	model:	safari	scope:	eq	version:	4.0.2	Trust: 0.3
vendor:	apple	model:	safari	scope:	eq	version:	4.0.1	Trust: 0.3
vendor:	apple	model:	safari	scope:	eq	version:	3.2.3	Trust: 0.3
vendor:	apple	model:	safari	scope:	eq	version:	3.1.2	Trust: 0.3
vendor:	apple	model:	safari	scope:	eq	version:	3.1.1	Trust: 0.3
vendor:	apple	model:	safari beta	scope:	eq	version:	3.0.3	Trust: 0.3
vendor:	apple	model:	safari beta	scope:	eq	version:	3.0.2	Trust: 0.3
vendor:	apple	model:	safari beta	scope:	eq	version:	3.0.1	Trust: 0.3
vendor:	apple	model:	safari	scope:	eq	version:	2.0.4	Trust: 0.3
vendor:	apple	model:	safari	scope:	eq	version:	2.0.3	Trust: 0.3
vendor:	apple	model:	safari	scope:	eq	version:	2.0.2	Trust: 0.3
vendor:	apple	model:	safari	scope:	eq	version:	2.0.1	Trust: 0.3
vendor:	apple	model:	safari	scope:	eq	version:	1.3.2	Trust: 0.3
vendor:	apple	model:	safari	scope:	eq	version:	1.3.1	Trust: 0.3
vendor:	apple	model:	safari	scope:	eq	version:	1.3	Trust: 0.3
vendor:	apple	model:	safari	scope:	eq	version:	1.2.3	Trust: 0.3
vendor:	apple	model:	safari	scope:	eq	version:	1.2.2	Trust: 0.3
vendor:	apple	model:	safari	scope:	eq	version:	1.2.1	Trust: 0.3
vendor:	apple	model:	safari	scope:	eq	version:	1.2	Trust: 0.3
vendor:	apple	model:	safari	scope:	eq	version:	1.0	Trust: 0.3
vendor:	apple	model:	safari	scope:	eq	version:	5.1.7	Trust: 0.3
vendor:	apple	model:	safari	scope:	eq	version:	5.1.4	Trust: 0.3
vendor:	apple	model:	safari	scope:	eq	version:	5.1.1	Trust: 0.3
vendor:	apple	model:	safari	scope:	eq	version:	5.1	Trust: 0.3
vendor:	apple	model:	safari	scope:	eq	version:	5.0.5	Trust: 0.3
vendor:	apple	model:	safari	scope:	eq	version:	5.0.4	Trust: 0.3
vendor:	apple	model:	safari	scope:	eq	version:	5.0.3	Trust: 0.3
vendor:	apple	model:	safari	scope:	eq	version:	5.0.2	Trust: 0.3
vendor:	apple	model:	safari	scope:	eq	version:	5.0.1	Trust: 0.3
vendor:	apple	model:	safari	scope:	eq	version:	5.0	Trust: 0.3
vendor:	apple	model:	safari	scope:	eq	version:	4.1.3	Trust: 0.3
vendor:	apple	model:	safari	scope:	eq	version:	4.1.2	Trust: 0.3
vendor:	apple	model:	safari	scope:	eq	version:	4.1.1	Trust: 0.3
vendor:	apple	model:	safari	scope:	eq	version:	4.1	Trust: 0.3
vendor:	apple	model:	safari	scope:	eq	version:	4.0	Trust: 0.3
vendor:	apple	model:	safari	scope:	eq	version:	4	Trust: 0.3
vendor:	apple	model:	safari	scope:	eq	version:	3.2	Trust: 0.3
vendor:	apple	model:	safari	scope:	eq	version:	3.1	Trust: 0.3
vendor:	apple	model:	safari	scope:	eq	version:	3	Trust: 0.3
vendor:	apple	model:	itunes	scope:	eq	version:	10.5.1	Trust: 0.3
vendor:	apple	model:	itunes	scope:	eq	version:	9.2.1	Trust: 0.3
vendor:	apple	model:	itunes	scope:	eq	version:	9.0.2	Trust: 0.3
vendor:	apple	model:	itunes	scope:	eq	version:	9.0.1.8	Trust: 0.3
vendor:	apple	model:	itunes	scope:	eq	version:	9.0.1	Trust: 0.3
vendor:	apple	model:	itunes	scope:	eq	version:	9.0	Trust: 0.3
vendor:	apple	model:	itunes	scope:	eq	version:	7.3.2	Trust: 0.3
vendor:	apple	model:	itunes	scope:	eq	version:	7.3.1	Trust: 0.3
vendor:	apple	model:	itunes	scope:	eq	version:	7.3	Trust: 0.3
vendor:	apple	model:	itunes	scope:	eq	version:	6.0	Trust: 0.3
vendor:	apple	model:	itunes	scope:	eq	version:	5.0	Trust: 0.3
vendor:	apple	model:	itunes	scope:	eq	version:	4.7	Trust: 0.3
vendor:	apple	model:	itunes	scope:	eq	version:	4.5	Trust: 0.3
vendor:	apple	model:	itunes	scope:	eq	version:	4.2.72	Trust: 0.3
vendor:	apple	model:	itunes	scope:	eq	version:	9.2	Trust: 0.3
vendor:	apple	model:	itunes	scope:	eq	version:	9.1	Trust: 0.3
vendor:	apple	model:	itunes	scope:	eq	version:	8.2	Trust: 0.3
vendor:	apple	model:	itunes	scope:	eq	version:	8.1	Trust: 0.3
vendor:	apple	model:	itunes	scope:	eq	version:	8.0.2.20	Trust: 0.3
vendor:	apple	model:	itunes	scope:	eq	version:	7.4	Trust: 0.3
vendor:	apple	model:	itunes	scope:	eq	version:	10.6	Trust: 0.3
vendor:	apple	model:	itunes	scope:	eq	version:	10.5	Trust: 0.3
vendor:	apple	model:	itunes	scope:	eq	version:	10.2.2	Trust: 0.3
vendor:	apple	model:	itunes	scope:	eq	version:	10.2	Trust: 0.3
vendor:	apple	model:	itunes	scope:	eq	version:	10	Trust: 0.3
vendor:	apple	model:	tv	scope:	eq	version:	5.0	Trust: 0.3
vendor:	apple	model:	tv	scope:	eq	version:	4.4	Trust: 0.3
vendor:	apple	model:	tv	scope:	eq	version:	4.3	Trust: 0.3
vendor:	apple	model:	tv	scope:	eq	version:	4.2	Trust: 0.3
vendor:	apple	model:	tv	scope:	eq	version:	4.1	Trust: 0.3
vendor:	apple	model:	tv	scope:	eq	version:	4.0	Trust: 0.3

sources: BID: 69881 // BID: 69974 // JVNDB: JVNDB-2014-004324 // CNNVD: CNNVD-201409-642 // NVD: CVE-2014-4413

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2014-4413
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2014-4413
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201409-642
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-72353
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2014-4413
severity:	MEDIUM
baseScore:	6.8
vectorString:	AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.6
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-72353
severity:	MEDIUM
baseScore:	6.8
vectorString:	AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.6
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: VULHUB: VHN-72353 // JVNDB: JVNDB-2014-004324 // CNNVD: CNNVD-201409-642 // NVD: CVE-2014-4413

PROBLEMTYPE DATA

problemtype:

CWE-119

Trust: 1.9

sources: VULHUB: VHN-72353 // JVNDB: JVNDB-2014-004324 // NVD: CVE-2014-4413

THREAT TYPE

network

Trust: 0.6

sources: BID: 69881 // BID: 69974

TYPE

Unknown

Trust: 0.6

sources: BID: 69881 // BID: 69974

CONFIGURATIONS

sources: JVNDB: JVNDB-2014-004324

PATCH

title:	HT6441	url:	http://support.apple.com/kb/HT6441	Trust: 0.8
title:	HT6442	url:	http://support.apple.com/kb/HT6442	Trust: 0.8
title:	HT6537	url:	http://support.apple.com/en-eu/HT6537	Trust: 0.8
title:	HT6440	url:	http://support.apple.com/kb/HT6440	Trust: 0.8
title:	HT6440	url:	http://support.apple.com/kb/HT6440?viewlocale=ja_JP	Trust: 0.8
title:	HT6441	url:	http://support.apple.com/kb/HT6441?viewlocale=ja_JP	Trust: 0.8
title:	HT6442	url:	http://support.apple.com/kb/HT6442?viewlocale=ja_JP	Trust: 0.8
title:	HT6537	url:	http://support.apple.com/ja-jp/HT6537	Trust: 0.8
title:	AppleTV3,2_7.0_12A365b_Restore	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=51554	Trust: 0.6
title:	iPhone7,2_8.0_12A365_Restore	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=51553	Trust: 0.6

sources: JVNDB: JVNDB-2014-004324 // CNNVD: CNNVD-201409-642

EXTERNAL IDS

db:	NVD	id:	CVE-2014-4413	Trust: 3.1
db:	BID	id:	69881	Trust: 2.0
db:	SECUNIA	id:	61306	Trust: 1.7
db:	SECUNIA	id:	61318	Trust: 1.7
db:	SECTRACK	id:	1030866	Trust: 1.7
db:	JVN	id:	JVNVU93868849	Trust: 0.8
db:	JVN	id:	JVNVU97537282	Trust: 0.8
db:	JVNDB	id:	JVNDB-2014-004324	Trust: 0.8
db:	CNNVD	id:	CNNVD-201409-642	Trust: 0.7
db:	BID	id:	69974	Trust: 0.4
db:	VULHUB	id:	VHN-72353	Trust: 0.1
db:	PACKETSTORM	id:	128316	Trust: 0.1
db:	PACKETSTORM	id:	135081	Trust: 0.1
db:	PACKETSTORM	id:	140131	Trust: 0.1

sources: VULHUB: VHN-72353 // BID: 69881 // BID: 69974 // JVNDB: JVNDB-2014-004324 // PACKETSTORM: 128316 // PACKETSTORM: 135081 // PACKETSTORM: 140131 // CNNVD: CNNVD-201409-642 // NVD: CVE-2014-4413

REFERENCES

url:	http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.html	Trust: 2.5
url:	http://archives.neohapsis.com/archives/bugtraq/2014-09/0107.html	Trust: 2.5
url:	https://security.gentoo.org/glsa/201612-41	Trust: 1.8
url:	http://www.securityfocus.com/bid/69881	Trust: 1.7
url:	http://support.apple.com/kb/ht6440	Trust: 1.7
url:	http://support.apple.com/kb/ht6441	Trust: 1.7
url:	http://support.apple.com/kb/ht6442	Trust: 1.7
url:	https://support.apple.com/kb/ht6537	Trust: 1.7
url:	http://www.securitytracker.com/id/1030866	Trust: 1.7
url:	http://secunia.com/advisories/61306	Trust: 1.7
url:	http://secunia.com/advisories/61318	Trust: 1.7
url:	https://exchange.xforce.ibmcloud.com/vulnerabilities/96033	Trust: 1.7
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-4413	Trust: 0.8
url:	http://jvn.jp/vu/jvnvu93868849/index.html	Trust: 0.8
url:	http://jvn.jp/vu/jvnvu97537282/index.html	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-4413	Trust: 0.8
url:	http://www.webkit.org/	Trust: 0.6
url:	http://www.apple.com/ios/	Trust: 0.3
url:	http://www.apple.com/safari/	Trust: 0.3
url:	https://nvd.nist.gov/vuln/detail/cve-2014-4413	Trust: 0.3
url:	https://nvd.nist.gov/vuln/detail/cve-2014-4412	Trust: 0.3
url:	https://nvd.nist.gov/vuln/detail/cve-2014-4414	Trust: 0.3
url:	https://nvd.nist.gov/vuln/detail/cve-2014-4411	Trust: 0.2
url:	https://nvd.nist.gov/vuln/detail/cve-2014-4410	Trust: 0.2
url:	https://nvd.nist.gov/vuln/detail/cve-2013-6663	Trust: 0.2
url:	https://nvd.nist.gov/vuln/detail/cve-2014-4409	Trust: 0.2
url:	https://nvd.nist.gov/vuln/detail/cve-2014-4415	Trust: 0.1
url:	https://www.apple.com/support/security/pgp/	Trust: 0.1
url:	http://support.apple.com/kb/ht1222	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2014-4363	Trust: 0.1
url:	http://gpgtools.org	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2014-4479	Trust: 0.1
url:	http://webkitgtk.org/security.html	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2015-1069	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2014-4452	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2014-4471	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2014-4473	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2014-4468	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2014-4475	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2015-1070	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2015-1071	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2014-4476	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2014-1748	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2014-4474	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2014-3192	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2014-4459	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2014-4465	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2014-4469	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2014-4472	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2014-4477	Trust: 0.1
url:	http://webkitgtk.org/security/wsa-2015-0002.html	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2014-4470	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2015-1068	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2014-4466	Trust: 0.1
url:	http://creativecommons.org/licenses/by-sa/2.5	Trust: 0.1
url:	http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-4412	Trust: 0.1
url:	https://security.gentoo.org/	Trust: 0.1
url:	https://bugs.gentoo.org.	Trust: 0.1
url:	http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-4413	Trust: 0.1
url:	http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-4414	Trust: 0.1

CREDITS

Apple

Trust: 0.4

sources: BID: 69974 // PACKETSTORM: 128316

SOURCES

db:	VULHUB	id:	VHN-72353
db:	BID	id:	69881
db:	BID	id:	69974
db:	JVNDB	id:	JVNDB-2014-004324
db:	PACKETSTORM	id:	128316
db:	PACKETSTORM	id:	135081
db:	PACKETSTORM	id:	140131
db:	CNNVD	id:	CNNVD-201409-642
db:	NVD	id:	CVE-2014-4413

LAST UPDATE DATE

2025-04-13T20:24:10.903000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-72353	date:	2019-03-08T00:00:00
db:	BID	id:	69881	date:	2016-01-12T02:15:00
db:	BID	id:	69974	date:	2015-03-19T09:26:00
db:	JVNDB	id:	JVNDB-2014-004324	date:	2014-11-20T00:00:00
db:	CNNVD	id:	CNNVD-201409-642	date:	2019-03-13T00:00:00
db:	NVD	id:	CVE-2014-4413	date:	2025-04-12T10:46:40.837

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-72353	date:	2014-09-18T00:00:00
db:	BID	id:	69881	date:	2014-09-17T00:00:00
db:	BID	id:	69974	date:	2014-09-17T00:00:00
db:	JVNDB	id:	JVNDB-2014-004324	date:	2014-09-22T00:00:00
db:	PACKETSTORM	id:	128316	date:	2014-09-19T15:29:45
db:	PACKETSTORM	id:	135081	date:	2015-12-28T22:22:22
db:	PACKETSTORM	id:	140131	date:	2016-12-13T16:41:51
db:	CNNVD	id:	CNNVD-201409-642	date:	2014-09-19T00:00:00
db:	NVD	id:	CVE-2014-4413	date:	2014-09-18T10:55:10.203