Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2008-3623

Heap-based buffer overflow in CoreGraphics in Apple Safari before 3.2 on Windows, in iPhone OS 1.0 through 2.2.1, and in iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted image, related to improper handling of color spaces.

Published

2008-11-17T18:18:47.767

Last Modified

2025-04-09T00:30:58.490

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 9.3 (HIGH)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: COMPLETE
  • Integrity Impact: COMPLETE
  • Availability Impact: COMPLETE
Exploitability Score

8.6

Impact Score

10.0

Weaknesses
  • Type: Primary
    CWE-119
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System microsoft windows xp No
Operating System microsoft windows_vista - No
Application apple safari * Yes
Application apple safari ≤ 3.1.2 Yes
Application apple safari 0.8 Yes
Application apple safari 0.9 Yes
Application apple safari 1.0 Yes
Application apple safari 1.0 Yes
Application apple safari 1.0 Yes
Application apple safari 1.0.3 Yes
Application apple safari 1.1 Yes
Application apple safari 1.1.1 Yes
Application apple safari 1.2 Yes
Application apple safari 1.2.1 Yes
Application apple safari 1.2.2 Yes
Application apple safari 1.2.3 Yes
Application apple safari 1.2.4 Yes
Application apple safari 1.2.5 Yes
Application apple safari 1.3 Yes
Application apple safari 1.3.1 Yes
Application apple safari 1.3.2 Yes
Application apple safari 2 Yes
Application apple safari 2.0 Yes
Application apple safari 2.0.1 Yes
Application apple safari 2.0.2 Yes
Application apple safari 2.0.3 Yes
Application apple safari 2.0.3_417.9.3 Yes
Application apple safari 2.0.4 Yes
Application apple safari 2.0.4_419.3 Yes
Application apple safari 2.0_pre Yes
Application apple safari 3 Yes
Application apple safari 3.0 Yes
Application apple safari 3.0 Yes
Application apple safari 3.0.1 Yes
Application apple safari 3.0.1 Yes
Application apple safari 3.0.2 Yes
Application apple safari 3.0.2 Yes
Application apple safari 3.0.3 Yes
Application apple safari 3.0.3 Yes
Application apple safari 3.0.3 Yes
Application apple safari 3.0.4 Yes
Application apple safari 3.0.4_beta Yes
Application apple safari 3.0.4_beta Yes
Application apple safari 3.1 Yes
Application apple safari 3.1.1 Yes
References