Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
The HTMLMediaElement::loadResource function in html/HTMLMediaElement.cpp in WebCore in WebKit before r49480, as used in Apple Safari before 4.0.4 on Mac OS X, does not perform the expected callbacks for HTML 5 media elements that have external URLs for media resources, which allows remote attackers to trigger sub-resource requests to arbitrary web sites via a crafted HTML document, as demonstrated by an HTML e-mail message that uses a media element for X-Confirm-Reading-To functionality, aka rdar problem 7271202.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Apple Safari WebKit WebCore任意站点访问控制漏洞
Vulnerability Description
Apple Safari中的WebKit的WebCore中的html/HTMLMediaElement.cpp的HTMLMediaElement::loadResource函数没有对HTML 5媒介元素执行与预期的回收操作，且这些媒介元素都具有对媒介资源的外界URLs。远程攻击者可借助特制的HTML文件，触发对任意web站点的请求。例如使用一个对X-Confirm-Reading-To功能的媒介元素的一个HTML e-mail信息。
CVSS Information
N/A
Vulnerability Type
N/A