CVE-2011-1344
- State
- Published
- Severity
- Not scored
- Published
- Mar 10, 2011
- Updated
- Aug 6, 2024
- Reserved
- Mar 10, 2011
Description
Use-after-free vulnerability in WebKit, as used in Apple Safari before 5.0.5; iOS before 4.3.2 for iPhone, iPod, and iPad; iOS before 4.2.7 for iPhone 4 (CDMA); and possibly other products allows remote attackers to execute arbitrary code by adding children to a WBR tag and then removing the tag, related to text nodes, as demonstrated by Chaouki Bekrar during a Pwn2Own competition at CanSecWest 2011.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- 44151third-party-advisory
- 20110415 VUPEN Security Research - Apple Safari Text Nodes Remote Use-after-free Vulnerability (CVE-2011-1344)mailing-list
- http://twitter.com/aaronportnoy/statuses/45632544967901187
- 46822vdb-entry
- http://support.apple.com/kb/HT4596
- APPLE-SA-2011-04-14-3vendor-advisory
- 1025363vdb-entry
- APPLE-SA-2011-04-14-2vendor-advisory
- http://www.zerodayinitiative.com/advisories/ZDI-11-135
- ADV-2011-0984vdb-entry
- http://dvlabs.tippingpoint.com/blog/2011/02/02/pwn2own-2011
- 20110414 ZDI-11-135: (Pwn2Own) WebKit WBR Tag Removal Remote Code Execution Vulnerabilitymailing-list
- http://support.apple.com/kb/HT4607
- safari-webkit-unspec-code-exec(66061)vdb-entry
- http://www.zdnet.com/blog/security/safarimacbook-first-to-fall-at-pwn2own-2011/8358
- http://www.computerworld.com/s/article/9214002/Safari_IE_hacked_first_at_Pwn2Own
- APPLE-SA-2011-04-14-1vendor-advisory
- 44154third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.