=====================================================================

                           CERT-Renater

               Note d'Information No. 2013/VULN555
_____________________________________________________________________

DATE                : 17/12/2013

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Safari version prior to 6.1.1,
                                           7.0.1.

======================================================================
http://support.apple.com/kb/HT6082
______________________________________________________________________

APPLE-SA-2013-12-16-1 Safari 6.1.1 and Safari 7.0.1

Safari 6.1.1 and Safari 7.0.1 are now available and address the
following:

Safari
Available for:  OS X Lion v10.7.5, OS X Lion Server v10.7.5,
OS X Mountain Lion v10.8.5, OS X Mavericks v10.9
Impact:  User credentials may be disclosed to an unexpected site via
autofill
Description:  Safari may have autofilled user names and passwords
into a subframe from a different domain than the main frame. This
issue was addressed through improved origin tracking.
CVE-ID
CVE-2013-5227 : Niklas Malmgren of Klarna AB

WebKit
Available for:  OS X Lion v10.7.5, OS X Lion Server v10.7.5,
OS X Mountain Lion v10.8.5, OS X Mavericks v10.9
Impact:  Visiting a maliciously crafted website may lead to an
unexpected application termination or arbitrary code execution
Description:  Multiple memory corruption issues existed in WebKit.
These issues were addressed through improved memory handling.
CVE-ID
CVE-2013-2909 : Atte Kettunen of OUSPG
CVE-2013-5195 : Apple
CVE-2013-5196 : Google Chrome Security Team
CVE-2013-5197 : Google Chrome Security Team
CVE-2013-5198 : Apple
CVE-2013-5199 : Apple
CVE-2013-5225 : Google Chrome Security Team
CVE-2013-5228 : Keen Team (@K33nTeam) working with HP's Zero Day
Initiative

For OS X Mavericks systems, Safari 7.0.1 will be included
in OS X Mavericks 10.9.1.

For OS X Mountain Lion systems Safari 6.1 may be obtained from
Mac App Store.

For OS X Lion systems Safari 6.1 is available via the Apple Software
Update application.

Information will also be posted to the Apple Security Updates
web site: http://support.apple.com/kb/HT1222

This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/

=========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================