----------------------------------------------------------------------

Do you have VARM strategy implemented?

(Vulnerability Assessment Remediation Management)  

If not, then implement it through the most reliable vulnerability
intelligence source on the market. 

Implement it through Secunia. 

For more information visit:
http://secunia.com/advisories/business_solutions/

Alternatively request a call from a Secunia representative today to
discuss how we can help you with our capabilities contact us at:
sales@secunia.com

----------------------------------------------------------------------

TITLE:
Apple Safari Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA37346

VERIFY ADVISORY:
http://secunia.com/advisories/37346/

DESCRIPTION:
Some vulnerabilities have been reported in Apple Safari, which can be
exploited by malicious people to bypass certain security restrictions,
disclose sensitive information, or compromise a user's system.

1) An integer overflow error when processing ColorSync profiles
embedded in images can be exploited to potentially execute arbitrary
code.

For more information see vulnerability #4 in:
SA36701

2) An error exists when handling an "Open Image in New Tab", "Open
Image in New Window", or "Open Link in New Tab" shortcut menu action
performed on a link to a local file. This can be exploited to load a
local HTML file and disclose sensitive information by tricking a user
into performing the affected actions within a specially crafted
webpage.

3) An error exists in WebKit when sending "preflight" requests
originating from a page in a different origin. This can be exploited
to facilitate cross-site request forgery attacks by injecting custom
HTTP headers.

4) Multiple errors in WebKit when handling FTP directory listings on
Windows can be exploited to disclose sensitive information, cause a
crash, or potentially execute arbitrary code.

5) An error in WebKit when handling an HTML 5 Media Element on Mac OS
X can be exploited to bypass remote image loading restrictions via
e.g. HTML-formatted emails.

NOTE: Some errors leading to crashes, caused by the included libxml2
library, have also been reported.

SOLUTION:
Update to version 4.0.4.

PROVIDED AND/OR DISCOVERED BY:
1-3, 5) Reported by the vendor.
4) The vendor credits Michal Zalewski of Google Inc.

ORIGINAL ADVISORY:
http://support.apple.com/kb/HT3949

OTHER REFERENCES:
SA36701:
http://secunia.com/advisories/36701/

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------