CVE-2008-3950

Description

Off-by-one error in the _web_drawInRect:withFont:ellipsis:alignment:measureOnly function in WebKit in Safari in Apple iPhone 1.1.4 and 2.0 and iPod touch 1.1.4 and 2.0 allows remote attackers to cause a denial of service (browser crash) via a JavaScript alert call with an argument that lacks breakable characters and has a length that is a multiple of the memory page size, leading to an out-of-bounds read.

Read the notes from the security team

• How can I get the fixes?
• What do statuses mean?

Notes

References

• MITRE
• NVD
• Launchpad
• Debian

Other references

• http://www.coresecurity.com/content/iphone-safari-javascript-alert-denial-of-service
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=499771
• https://www.cve.org/CVERecord?id=CVE-2008-3950