Eric Seidel

The issue allows remote attackers to execute arbitrary code or cause a denial of service, resulting in memory corruption and application crash, via a crafted web site. This is a distinct issue from other WebKit vulnerabilities.

The issue arises from improper handling of clipboard operations for URLs, specifically drag and paste actions, allowing user-assisted remote attackers to read arbitrary files via a crafted HTML document.

Name of the Vulnerable Software and Affected Versions: Apple Safari versions prior to 4.0 Description: The issue allows user-assisted remote attackers to obtain sensitive information via vectors involving drag events and the dragging of content over a crafted web page. Recommendations: For versions prior to 4.0, update to Apple Safari version 4.0 or later to resolve the issue.

A buffer overflow issue in WebKit, used by Apple Safari, allows remote attackers to execute arbitrary code via crafted regular expressions in JavaScript.