CVE-2014-1346

Published: May 22, 2014Modified: May 6, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, does not properly interpret Unicode encoding, which allows remote attackers to spoof a postMessage origin, and bypass intended restrictions on sending a message to a connected frame or window, via crafted characters in a URL.

Affected (14)

Products: Apple: Safari

Apple

1 product

Safari

Configuration A

14 vulnerable

Vulnerable Software	Affected Versions
Apple Safari	Up to 6.1.3
Apple Safari	Version 6.0.1
Apple Safari	Version 6.0.2
Apple Safari	Version 6.0.3
Apple Safari	Version 6.0.4
Apple Safari	Version 6.0.5
Apple Safari	Version 6.0
Apple Safari	Version 6.1.1
Apple Safari	Version 6.1.2
Apple Safari	Version 6.1
Apple Safari	Version 7.0.1
Apple Safari	Version 7.0.2
Apple Safari	Version 7.0.3
Apple Safari	Version 7.0