遂にWindows版Safari、IE5.01SP4より脆弱なブラウザになる

｢Safari 5.1.7 for Windows｣には121もの未修正の脆弱性がある
といわれてるわけですが、更に、全バージョンで追加のセキュリティホールが見つかりました。

「Safari」Windows版は使用中止を、JVNが注意喚起、脆弱性が未修正のまま -INTERNET Watch
いかがこちらで調べてみたセキュリティホール一覧です。

CVE-2012-0679
Apple Safari before 6.0 allows remote attackers to read arbitrary files via a feed:// URL.(4.3/2.9/8.6)

CVE-2012-0680
Apple Safari before 6.0 does not properly
handle the autocomplete attribute of a password input element, which
allows remote attackers to bypass authentication by leveraging an
unattended workstation.(5.0/2.9/10.0)

CVE-2012-0682
CVE-2012-0683
CVE-2012-1520
CVE-2012-3589 - 3597
CVE-2012-3599
CVE-2012-3600
CVE-2012-3603
CVE-2012-3604
CVE-2012-3605
CVE-2012-3608
CVE-2012-3609
CVE-2012-3610
CVE-2012-3611
CVE-2012-3615
CVE-2012-3618
CVE-2012-3620
CVE-2012-3625 - 3631
CVE-2012-3633 - 3642
CVE-2012-3644
CVE-2012-3645
CVE-2012-3646
CVE-2012-3648
CVE-2012-3653
CVE-2012-3655
CVE-2012-3656
CVE-2012-3661
CVE-2012-3663 - 3670
CVE-2012-3678
CVE-2012-3679
CVE-2012-3674
CVE-2012-3680
CVE-2012-3681
CVE-2012-3682
CVE-2012-3683
CVE-2012-3686
CVE-2012-3689
CVE-2012-3691
CVE-2012-3694
WebKit, as used in Apple Safari before 6.0, allows remote attackers to
execute arbitrary code or cause a denial of service (memory corruption
and application crash) via a crafted web site, a different
vulnerability than other WebKit CVEs listed in APPLE-SA-2012-07-25-1.(9.3/10.0/8.6)

CVE-2012-3650
WebKit in Apple Safari before 6.0 accesses
uninitialized memory locations during the rendering of SVG images,
which allows remote attackers to obtain sensitive information from
process memory via a crafted web site.(4.3/2.9/8.6)

CVE-2012-3690
WebKit in Apple Safari before 6.0 does not properly handle
drag-and-drop events, which allows user-assisted remote attackers to
read arbitrary files via a crafted web site.(4.3/2.9/8.6)

CVE-2012-3693
Incomplete
blacklist vulnerability in WebKit in Apple Safari before 6.0 allows
remote attackers to spoof domain names in URLs, and possibly conduct
phishing attacks, by leveraging the availability of IDN support and
Unicode fonts to construct unspecified homoglyphs.(5.0/2.9/10.0)

CVE-2012-0678
CVE-2012-3695
Cross-site
scripting (XSS) vulnerability in WebKit in Apple Safari before 6.0
allows remote attackers to inject arbitrary web script or HTML by
leveraging improper URL canonicalization during the handling of the
location.href property.(4.3/2.9/8.6)

CVE-2012-3696
CRLF injection vulnerability in WebKit in
Apple Safari before 6.0 allows remote attackers to inject arbitrary
HTTP headers and conduct HTTP request splitting attacks via a crafted
web site that leverages improper WebSockets URI handling.(4.3/2.9/8.6)

CVE-2012-3697
WebKit in Apple Safari before 6.0 does not
properly handle file: URLs, which allows remote attackers to bypass
intended sandbox restrictions and read arbitrary files by leveraging a
WebProcess compromise.(7.1/6.9/8.6)

CVE-2012-3713
Apple
Safari before 6.0.1 does not properly handle the Quarantine attribute
of HTML documents, which allows user-assisted remote attackers to read
arbitrary files by leveraging the presence of a downloaded
document.(4.3/2.9/8.6)

CVE-2012-3714
The
Form Autofill feature in Apple Safari before 6.0.1 does not restrict
the filled fields to the set of fields contained in an Autofill
popover, which allows remote attackers to obtain the Me card from an
Address Book via a crafted web site.(4.3/2.9/8.6)

CVE-2012-3715
Apple
Safari before 6.0.1 makes http requests for https URIs in certain
circumstances involving a paste into the address bar, which allows
user-assisted remote attackers to obtain sensitive information by
sniffing the network.(4.3/2.9/8.6)

Internet Explorer 5.01 Service Pack 4 ですら、最新のセキュリティパッチがあるのに突然のサポート停止でしたからね ・ω・
手厚いサポートを受けたいなら、Apple 製品は使うな といういい教訓ですね。

一応、Twitterの方でアナウンスしたのですが、 Palemoon v3 のサポートを 完全に Palemoonが終了することが決定してしまった後、30個以上のかなり危険なセキュリティホールが明らかになっているため、 Palemoon v3版の Ese-Lolifox の計画は破棄して、 10.0.9 ESR ベースで作っています。
予定より遅れてしまってますが申し訳ないです ・ω・；