Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.8

Safari (pre‑6.1.5/7.0.5) can be crashed or hijacked by web page

CVE-2014-1340 · published 12 years ago
Summary

Apple Safari versions earlier than 6.1.5 and 7.0.5 can be tricked by a specially crafted website to either crash the browser or run unwanted code on the computer. This happens because of a flaw in the WebKit engine that processes web pages. Updating Safari to the latest version fixes the problem.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
– apple safari 7.0
7.0.1
7.0.2
7.0.3
7.0.4
<= 6.1.4
6.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
4 more version ranges
cpe:2.3:a:apple:safari:7.0:*:*:*:*:*:*:*
Ubuntu:16.04:LTS canonical qtwebkit-opensource-src All versions
Ubuntu:16.04:LTS canonical qtwebkit-source All versions
Original advisory text
WebKit, as used in Apple Safari before 6.1.5 and 7.x before 7.0.5, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a cra...
WebKit, as used in Apple Safari before 6.1.5 and 7.x before 7.0.5, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-06-30-1.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
6.8 Medium
Exploitation
2% chance of attack within 30 days
Type
CWE-119Buffer Overflow
Timeline
Published1 Jul 2014
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2014-1340 · NVD
UBUNTU-CVE-2014-1340 · OSV
Track software like this
Free during beta