{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2014-04-01T00:00:00", "descriptions": [{"lang": "en", "value": "WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, does not properly validate WebProcess IPC messages, which allows remote attackers to bypass a sandbox protection mechanism and read arbitrary files by leveraging WebProcess access."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2014-04-02T14:57:00", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple"}, "references": [{"name": "APPLE-SA-2014-04-01-1", "tags": ["vendor-advisory", "x_refsource_APPLE"], "url": "http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "product-security@apple.com", "ID": "CVE-2014-1297", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, does not properly validate WebProcess IPC messages, which allows remote attackers to bypass a sandbox protection mechanism and read arbitrary files by leveraging WebProcess access."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "APPLE-SA-2014-04-01-1", "refsource": "APPLE", "url": "http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T09:34:41.125Z"}, "title": "CVE Program Container", "references": [{"name": "APPLE-SA-2014-04-01-1", "tags": ["vendor-advisory", "x_refsource_APPLE", "x_transferred"], "url": "http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html"}]}]}, "cveMetadata": {"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2014-1297", "datePublished": "2014-04-02T15:00:00", "dateReserved": "2014-01-08T00:00:00", "dateUpdated": "2024-08-06T09:34:41.125Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*", "matchCriteriaId": "54197A85-706B-4EF1-A426-5A38C22CCBE2", "versionEndIncluding": "6.1.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:apple:safari:6.0:*:*:*:*:*:*:*", "matchCriteriaId": "9BA4B009-6BF2-4174-A05C-77B75C45377C", "vulnerable": true}, {"criteria": "cpe:2.3:a:apple:safari:6.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "136A760D-2873-4216-AB60-E3D93DE82BCF", "vulnerable": true}, {"criteria": "cpe:2.3:a:apple:safari:6.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "AFF3DFE0-2587-4E91-ACC2-45E9B51EF4C4", "vulnerable": true}, {"criteria": "cpe:2.3:a:apple:safari:6.0.3:*:*:*:*:*:*:*", "matchCriteriaId": "076B9C00-EFB0-4284-A617-FAEE341F80FB", "vulnerable": true}, {"criteria": "cpe:2.3:a:apple:safari:6.0.4:*:*:*:*:*:*:*", "matchCriteriaId": "8851ED07-715F-4F6A-AE29-FA95D069F972", "vulnerable": true}, {"criteria": "cpe:2.3:a:apple:safari:6.0.5:*:*:*:*:*:*:*", "matchCriteriaId": "65EBA204-5E12-429A-9414-400CBAA0BA89", "vulnerable": true}, {"criteria": "cpe:2.3:a:apple:safari:6.1:*:*:*:*:*:*:*", "matchCriteriaId": "4A600193-92E3-4A31-824D-94BC87E513B2", "vulnerable": true}, {"criteria": "cpe:2.3:a:apple:safari:6.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "74543772-8C0C-4055-BC1E-D7EAA8A55B51", "vulnerable": true}, {"criteria": "cpe:2.3:a:apple:safari:7.0:*:*:*:*:*:*:*", "matchCriteriaId": "88D46FE5-10D2-44A0-ACAE-CEED8BD0C30C", "vulnerable": true}, {"criteria": "cpe:2.3:a:apple:safari:7.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "391B4255-4434-4EB3-929B-3E593D9CD249", "vulnerable": true}, {"criteria": "cpe:2.3:a:apple:safari:7.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "40B87D10-55B3-42E7-8FF6-93EDF003337D", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, does not properly validate WebProcess IPC messages, which allows remote attackers to bypass a sandbox protection mechanism and read arbitrary files by leveraging WebProcess access."}, {"lang": "es", "value": "WebKit, utilizado en Apple Safari anterior a 6.1.3 y 7.x anterior a 7.0.3, no valida debidamente mensajes IPC de WebProcess, lo que permite a atacantes remotos evadir un mecanismo de protecci\u00f3n sandbox y leer archivos arbitrarios mediante el aprovechamiento de acceso a WebProcess."}], "id": "CVE-2014-1297", "lastModified": "2014-04-02T17:07:49.410", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2014-04-02T16:17:06.870", "references": [{"source": "product-security@apple.com", "url": "http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html"}], "sourceIdentifier": "product-security@apple.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "webkitgtk: improper WebProcess IPC messages validation (WSA-2015-0001)", "id": "1186236", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1186236"}, "csaw": false, "cvss": {"cvss_base_score": "5.1", "cvss_scoring_vector": "AV:N/AC:H/Au:N/C:P/I:P/A:P", "status": "draft"}, "details": ["WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, does not properly validate WebProcess IPC messages, which allows remote attackers to bypass a sandbox protection mechanism and read arbitrary files by leveraging WebProcess access."], "name": "CVE-2014-1297", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Will not fix", "package_name": "webkitgtk", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Will not fix", "package_name": "webkitgtk3", "product_name": "Red Hat Enterprise Linux 7"}], "public_date": "2015-01-26T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2014-1297\nhttps://nvd.nist.gov/vuln/detail/CVE-2014-1297\nhttp://webkitgtk.org/security/WSA-2015-0001.html"], "statement": "Red Hat Product Security has rated this issue as having Moderate security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.", "threat_severity": "Moderate", "upstream_fix": "2.4.2 and 2.4.8, WebKitGTK+ 2.4.1"}