JVNDB-2012-000088

Safari vulnerable to local file content disclosure

Safari contains a vulnerability where a local file may be accessed from remote, which may result in a local file content disclosure.

Masahiro YAMADA reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Apple Inc.

• Safari prior to 6.0.1

By opening a specially crafted HTML document as a local file, an arbitrary local file may be obtained from remote even though access from other users is restricted.

[Update the software]
Update to the latest version according to the information provided by the developer.

For Windows:
As of October 23, 2012, Safari for Windows which addresses to this issue is not available. Please stop use of Safari for Windows.

Apple Inc.

• Apple Mailing Lists : APPLE-SA-2012-09-19-3
• Apple Security Updates : About the security content of Safari 6.0.1 (HT5502)

1. Permissions(CWE-264) [IPA Evaluation]

1. CVE-2012-3713

1. JVN : JVN#42676559
2. National Vulnerability Database (NVD) : CVE-2012-3713

• [2012/10/23]
    Web page was published