CVE-2007-2399

CriticalCVSS 9.3/10Last modified Jun 16, 2026

Description

WebKit in Apple Mac OS X 10.3.9, 10.4.9 and later, and iPhone before 1.0.1 performs an "invalid type conversion", which allows remote attackers to execute arbitrary code via unspecified frame sets that trigger memory corruption.

Metrics

CVSS 2.0 9.3/10AV:N/AC:M/Au:N/C:C/I:C/A:C

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://docs.info.apple.com/article.html?artnum=305759
http://docs.info.apple.com/article.html?artnum=306173
http://lists.apple.com/archives/Security-announce/2007/Jun/msg00003.html
http://osvdb.org/36130
http://osvdb.org/36450
http://secunia.com/advisories/25786Patch, Vendor Advisory
http://secunia.com/advisories/26287Vendor Advisory
http://www.kb.cert.org/vuls/id/389868US Government Resource
http://www.securityfocus.com/bid/24597
http://www.securitytracker.com/id?1018281Patch
http://www.vupen.com/english/advisories/2007/2296Vendor Advisory
http://www.vupen.com/english/advisories/2007/2316Vendor Advisory
http://www.vupen.com/english/advisories/2007/2731Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/35019
http://docs.info.apple.com/article.html?artnum=305759
http://docs.info.apple.com/article.html?artnum=306173
http://lists.apple.com/archives/Security-announce/2007/Jun/msg00003.html
http://osvdb.org/36130
http://osvdb.org/36450
http://secunia.com/advisories/25786Patch, Vendor Advisory
http://secunia.com/advisories/26287Vendor Advisory
http://www.kb.cert.org/vuls/id/389868US Government Resource
http://www.securityfocus.com/bid/24597
http://www.securitytracker.com/id?1018281Patch
http://www.vupen.com/english/advisories/2007/2296Vendor Advisory
http://www.vupen.com/english/advisories/2007/2316Vendor Advisory
http://www.vupen.com/english/advisories/2007/2731Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/35019

Timeline

Published: Jun 25, 2007
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2007

CVE-2007-24004.3Race condition in Apple Safari 3 Beta before 3.0.2 on Mac OS X, Windows XP, Windows Vista, and iPhone before 1.0.1, allows remote attackers CVE-2007-24014.3CRLF injection vulnerability in WebCore in Apple Mac OS X 10.3.9, 10.4.9 and later, and iPhone before 1.0.1, allows remote attackers to inje CVE-2007-24024.3QuickTime for Java in Apple Quicktime before 7.2 does not perform sufficient "access control," which allows remote attackers to obtain sensi CVE-2007-24036.8CFNetwork on Apple Mac OS X 10.3.9 and 10.4.10 does not properly validate ftp: URIs, which allows remote attackers to trigger the transmissi CVE-2007-24045.0CRLF injection vulnerability in CFNetwork on Apple Mac OS X 10.3.9 and 10.4.10 before 20070731 allows remote attackers to inject arbitrary H CVE-2007-24056.8Integer underflow in Preview in PDFKit on Apple Mac OS X 10.4.10 allows remote attackers to execute arbitrary code via a crafted PDF file.CVE-2007-24066.8Quartz Composer on Apple Mac OS X 10.4.10 does not initialize a certain object pointer, which might allow user-assisted remote attackers to CVE-2007-24074.0The Samba server on Apple Mac OS X 10.3.9 and 10.4.10, when Windows file sharing is enabled, does not enforce disk quotas after dropping pri CVE-2007-24086.8WebKit in Apple Safari 3 Beta before Update 3.0.3 does not properly recognize an unchecked "Enable Java" setting, which allows remote attack CVE-2007-24094.3Cross-domain vulnerability in WebCore on Apple Mac OS X 10.3.9 and 10.4.10 allows remote attackers to obtain sensitive information via a pop CVE-2007-24104.3WebCore on Apple Mac OS X 10.3.9 and 10.4.10 retains properties of certain global objects when a new URL is visited in the same window, whic CVE-2007-24117.5PHP remote file inclusion vulnerability in index.php in Sphider 1.2.x allows remote attackers to execute arbitrary PHP code via a URL in the