CVE-2011-3230 - Launch any file path from web page (Safari/OS X)(vttynotes.blogspot.com)

http://vttynotes.blogspot.com/2011/10/cve-2011-3230-launch-any-file-path-from.html

4 comments

Xuzz15 lat temu

Note this appears to be fixed in the recent Safari 5.1.1 update, according to Apple's support page here: http://support.apple.com/kb/HT5000

Did I get this right? Can you launch rm with arguments for instance? If so, this is huge.

deweller15 lat temu

No. You can't launch anything with arguments.

Then what's the point? :S

Click here to load Widget into WidgetFactory!

Then click on widgets. Then copy and paste this key in.

spleeyah15 lat temu

Doesn't seem to reproduce for me...

http://www.spleeyah.com/a/

cobrabyte15 lat temu

Guess I'll set Safari aside until they address this. Wild implications!

unfletch15 lat temu

Or until you install today's update. It's fixed in 5.1.1, which is included in the OS X 10.7.2 software update: http://support.apple.com/kb/HT5000