=====================================================================

                           CERT-Renater

               Note d'Information No. 2014/VULN083
_____________________________________________________________________

DATE                : 02/04/2014

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Mac OS X running Safari versions prior to 6.1.3,
                                                7.0.3.

======================================================================
http://support.apple.com/kb/HT1222
______________________________________________________________________

APPLE-SA-2014-04-01-1 Safari 6.1.3 and Safari 7.0.3

Safari 6.1.3 and Safari 7.0.3 are now available and address the
following:


WebKit
Available for:  OS X Lion v10.7.5, OS X Lion Server v10.7.5,
OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.2

Impact:  Visiting a maliciously crafted website may lead to an
unexpected application termination or arbitrary code execution

Description:  Multiple memory corruption issues existed in WebKit.
These issues were addressed through improved memory handling.

CVE-ID
CVE-2013-2871 : miaubiz
CVE-2013-2926 : cloudfuzzer
CVE-2013-2928 : Google Chrome Security Team
CVE-2013-6625 : cloudfuzzer
CVE-2014-1289 : Apple
CVE-2014-1290 : ant4g0nist (SegFault) working with HP's Zero Day
Initiative, Google Chrome Security Team
CVE-2014-1291 : Google Chrome Security Team
CVE-2014-1292 : Google Chrome Security Team
CVE-2014-1293 : Google Chrome Security Team
CVE-2014-1294 : Google Chrome Security Team
CVE-2014-1298 : Google Chrome Security Team
CVE-2014-1299 : Google Chrome Security Team, Apple, Renata Hodovan of
University of Szeged / Samsung Electronics
CVE-2014-1300 : Ian Beer of Google Project Zero working with HP's
Zero Day Initiative
CVE-2014-1301 : Google Chrome Security Team
CVE-2014-1302 : Google Chrome Security Team, Apple
CVE-2014-1303 : KeenTeam working with HP's Zero Day Initiative
CVE-2014-1304 : Apple
CVE-2014-1305 : Apple
CVE-2014-1307 : Google Chrome Security Team
CVE-2014-1308 : Google Chrome Security Team
CVE-2014-1309 : cloudfuzzer
CVE-2014-1310 : Google Chrome Security Team
CVE-2014-1311 : Google Chrome Security Team
CVE-2014-1312 : Google Chrome Security Team
CVE-2014-1313 : Google Chrome Security Team
CVE-2014-1713 : VUPEN working with HP's Zero Day Initiative


WebKit
Available for:  OS X Lion v10.7.5, OS X Lion Server v10.7.5,
OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.2

Impact:  An attacker running arbitary code in the WebProcess may be
able to read arbitrary files despite sandbox restrictions

Description:  A logic issue existed in the handling of IPC messages
from the WebProcess. This issue was addressed through additional
validation of IPC messages.

CVE-ID
CVE-2014-1297 : Ian Beer of Google Project Zero


For OS X Mavericks and OS X Mountain Lion systems, Safari 7.0.3
and Safari 6.1.3 may be obtained from Mac App Store.


For OS X Lion systems Safari 6.1.3 is available via the Apple
Software Update application.


Information will also be posted to the Apple Security Updates
web site: http://support.apple.com/kb/HT1222


This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/

=========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================