APPLE-SA-2014-06-30-1 Safari 6.1.5 and Safari 7.0.5

APPLE-SA-2014-06-30-1 Safari 6.1.5 and Safari 7.0.5

Safari 6.1.5 and Safari 7.0.5 are now available and address the
following:

WebKit
Available for:  OS X Lion v10.7.5, OS X Lion Server v10.7.5,
OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.3
Impact:  Visiting a maliciously crafted website may lead to an
unexpected application termination or arbitrary code execution
Description:  Multiple memory corruption issues existed in WebKit.
These issues were addressed through improved memory handling.
CVE-ID
CVE-2014-1325 : Apple
CVE-2014-1340 : Apple
CVE-2014-1362 : Apple, miaubiz
CVE-2014-1363 : Apple
CVE-2014-1364 : Apple
CVE-2014-1365 : Apple, Google Chrome Security Team
CVE-2014-1366 : Apple
CVE-2014-1367 : Apple
CVE-2014-1368 : Wushi of Keen Team (Research Team of Keen Cloud Tech)
CVE-2014-1382 : Renata Hodovan of University of Szeged / Samsung
Electronics

WebKit
Available for:  OS X Lion v10.7.5, OS X Lion Server v10.7.5,
OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.3
Impact:  Dragging a URL from a maliciously crafted website to another
window could lead to the disclosure of local file content
Description:  Dragging a URL from a maliciously crafted website to
another window could have allowed the malicious site to access a
file:// URL. This issue was addressed through improved validation of
dragged resources.
CVE-ID
CVE-2014-1369 : Aaron Sigel of vtty.com

WebKit
Available for:  OS X Lion v10.7.5, OS X Lion Server v10.7.5,
OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.3
Impact:  A maliciously crafted website may be able to spoof its
domain name in the address bar
Description:  A spoofing issue existed in the handling of URLs. This
issue was addressed through improved encoding of URLs.
CVE-ID
CVE-2014-1345 : Erling Ellingsen of Facebook



For OS X Mavericks and OS X Mountain Lion systems, Safari 7.0.5
and Safari 6.1.5 may be obtained from Mac App Store.

For OS X Lion systems Safari 6.1.5 is available via the Apple
Software Update application.

Information will also be posted to the Apple Security Updates
web site: http://support.apple.com/kb/HT1222

This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/

-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.22 (Darwin)
Comment: GPGTools - http://gpgtools.org