CVE-2011-0161

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

WebKit, as used in Apple Safari before 5.0.4 and iOS before 4.3, does not properly handle the Attr.style accessor, which allows remote attackers to bypass the Same Origin Policy and inject Cascading Style Sheets (CSS) token sequences via a crafted web site.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-20 CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.apple.com/archives/security-announce/2011//Mar/msg00003.htmlVendor Advisory
http://lists.apple.com/archives/security-announce/2011//Mar/msg00004.htmlVendor Advisory
http://support.apple.com/kb/HT4564Vendor Advisory
http://support.apple.com/kb/HT4566Vendor Advisory
http://www.securityfocus.com/bid/46814
http://www.securitytracker.com/id?1025182
https://exchange.xforce.ibmcloud.com/vulnerabilities/66000
http://lists.apple.com/archives/security-announce/2011//Mar/msg00003.htmlVendor Advisory
http://lists.apple.com/archives/security-announce/2011//Mar/msg00004.htmlVendor Advisory
http://support.apple.com/kb/HT4564Vendor Advisory
http://support.apple.com/kb/HT4566Vendor Advisory
http://www.securityfocus.com/bid/46814
http://www.securitytracker.com/id?1025182
https://exchange.xforce.ibmcloud.com/vulnerabilities/66000

Timeline

Published: Mar 11, 2011
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2011

CVE-2011-01627.8Wi-Fi in Apple iOS before 4.3 and Apple TV before 4.2 does not properly perform bounds checking for Wi-Fi frames, which allows remote attack CVE-2011-01634.3WebKit, as used in Apple Safari before 5.0.4 and iOS before 4.3, does not properly handle unspecified "cached resources," which allows remot CVE-2011-01647.6WebKit, as used in Apple iTunes before 10.2 on Windows, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of se CVE-2011-01657.6WebKit, as used in Apple iTunes before 10.2 on Windows, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of se CVE-2011-01665.8The HTML5 drag and drop functionality in WebKit in Apple Safari before 5.0.4 allows user-assisted remote attackers to bypass the Same Origin CVE-2011-01674.3The windows functionality in WebKit in Apple Safari before 5.0.4 allows remote attackers to bypass the Same Origin Policy, and force the upl CVE-2011-01687.6WebKit, as used in Apple iTunes before 10.2 on Windows, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of se CVE-2011-01692.6WebKit in Apple Safari before 5.0.4, when the Web Inspector is used, does not properly handle the window.console._inspectorCommandLineAPI pr CVE-2011-01709.3Heap-based buffer overflow in ImageIO in CoreGraphics in Apple iTunes before 10.2 on Windows allows remote attackers to execute arbitrary co CVE-2011-01724.9AirPort in Apple Mac OS X 10.6 before 10.6.7 allows remote attackers to cause a denial of service (divide-by-zero error and reboot) via Wi-F CVE-2011-01736.8Multiple format string vulnerabilities in AppleScript in Apple Mac OS X before 10.6.7 allow context-dependent attackers to execute arbitrary CVE-2011-01746.8Heap-based buffer overflow in Apple Type Services (ATS) in Apple Mac OS X before 10.6.7 allows remote attackers to execute arbitrary code vi