Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

Safari may let attackers run code or crash

CVE-2008-2317 · published 18 years ago
Summary

Safari on iPhone and iPod touch before version 2.0 does not clean up certain web page data correctly. A malicious web page can cause the browser to execute unwanted code or stop working, which could let an attacker control the device or cause a denial of service. Install the latest iOS/Safari update to protect your devices.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
apple safari All versions
cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
Original advisory text
WebCore in Apple Safari does not properly perform garbage collection of JavaScript document elements, which allows remote attackers to execute arbitrary code or cause a denial of service (heap corr...
WebCore in Apple Safari does not properly perform garbage collection of JavaScript document elements, which allows remote attackers to execute arbitrary code or cause a denial of service (heap corruption and application crash) via a reference to the ownerNode property of a copied CSSStyleSheet object of a STYLE element, as originally demonstrated on Apple iPhone before 2.0 and iPod touch before 2.0, a different vulnerability than CVE-2008-1590.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
9.3 Critical
Exploitation
8% chance of attack within 30 days
Type
CWE-399Resource Management Errors
Timeline
Published14 Jul 2008
Updated15 Oct 2026
First seen29 Sep 2026
Sources
CVE-2008-2317 · NVD
Track software like this
Free during beta