Dean Mcnamee

Name of the Vulnerable Software and Affected Versions: Apple Safari versions prior to 4.0 iPhone OS versions 1.0 through 2.2.1 iPhone OS for iPod touch versions 1.1 through 2.2.1 Description: A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML by overwriting the `document.implementation` property of an embedded document or a parent document. Recommendations: For Apple Safari versions prior to 4.0, update to version 4.0 or later. For iPhone OS versions 1.0 through 2.2.1, update to a version later than 2.2.1. For iPhone OS for iPod touch versions 1.1 through 2.2.1, update to a version later than 2.2.1.

Name of the Vulnerable Software and Affected Versions: Safari versions prior to 4.0 Description: The issue allows remote attackers to spoof the browser's display of the host name, security indicators, and other UI elements. This is achieved through a custom cursor in conjunction with a modified CSS3 hotspot property. Recommendations: For versions prior to 4.0, update to version 4.0 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Apple iPod touch versions 1.1 through 2.0.2 Apple iPhone versions 1.0 through 2.0.2 Qt (affected versions not specified) **Description** The issue is related to a use-after-free vulnerability in WebKit and an error in resource management in the Qt cross-platform framework. This allows remote attackers to execute arbitrary code, cause a denial of service, or access and modify confidential data via a specially crafted web page. The vulnerability can be exploited through crafted Cascading Style Sheets (CSS) import statements or other specially created web pages. **Recommendations** For Apple iPod touch versions 1.1 through 2.0.2, update to a version outside of this range to resolve the issue. For Apple iPhone versions 1.0 through 2.0.2, update to a version outside of this range to resolve the issue. For Qt, at the moment, there is no information about a newer version that contains a fix for this vulnerability.