CVE-2013-0974

MediumCVSS 5.1/10Last modified Jun 16, 2026

Description

StoreKit in Apple iOS before 6.1 does not properly handle the disabling of JavaScript within the preferences configuration of Mobile Safari, which allows remote attackers to bypass intended access restrictions and execute JavaScript code via a web site with a Smart App Banner.

Metrics

CVSS 2.0 5.1/10AV:N/AC:H/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.apple.com/archives/security-announce/2013/Jan/msg00000.htmlVendor Advisory
http://osvdb.org/89658
http://support.apple.com/kb/HT5642Vendor Advisory
http://lists.apple.com/archives/security-announce/2013/Jan/msg00000.htmlVendor Advisory
http://osvdb.org/89658
http://support.apple.com/kb/HT5642Vendor Advisory

Timeline

Published: Jan 29, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-09756.8Buffer overflow in QuickDraw Manager in Apple Mac OS X before 10.8.4 allows remote attackers to execute arbitrary code or cause a denial of CVE-2013-09766.8IOAcceleratorFamily in Apple Mac OS X before 10.8.3 allows remote attackers to execute arbitrary code or cause a denial of service (memory c CVE-2013-09774.6dyld in Apple iOS before 6.1.3 and Apple TV before 5.2.1 does not properly manage the state of file loading for Mach-O executable files, whi CVE-2013-09782.1The ARM prefetch abort handler in the kernel in Apple iOS before 6.1.3 and Apple TV before 5.2.1 does not ensure that it has been invoked in CVE-2013-09791.9lockdownd in Lockdown in Apple iOS before 6.1.3 does not properly consider file types during the permission-setting step of a backup restora CVE-2013-09802.1The Passcode Lock implementation in Apple iOS before 6.1.3 does not properly manage the lock state, which allows physically proximate attack CVE-2013-09817.2The IOUSBDeviceFamily driver in the USB implementation in the kernel in Apple iOS before 6.1.3 and Apple TV before 5.2.1 accesses pipe objec CVE-2013-09821.7The Private Browsing feature in CFNetwork in Apple Mac OS X before 10.8.4 does not prevent storage of permanent cookies upon exit from Safar CVE-2013-09836.8Stack consumption vulnerability in CoreAnimation in Apple Mac OS X before 10.8.4 allows remote attackers to execute arbitrary code or cause CVE-2013-09849.3Directory Service in Apple Mac OS X through 10.6.8 allows remote attackers to execute arbitrary code or cause a denial of service (daemon cr CVE-2013-09852.1Disk Management in Apple Mac OS X before 10.8.4 does not properly authenticate attempts to disable FileVault, which allows local users to ca CVE-2013-09869.3Buffer overflow in Apple QuickTime before 7.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (application