Release notes:

Safari 5.1.1 includes support for iCloud, a breakthrough set of free cloud services. iCloud stores your Safari bookmarks and Safari Reading List and automatically pushes them to all your devices.*

Safari 5.1.1 also contains various bug fixes and improvements to stability, compatibility, and security, including fixes that:

• Address issues that could cause hangs and excessive memory usage

• Improve stability when using Find, dragging tabs, and managing extensions

• Improve stability for netflix.com and other websites that use the Silverlight plug-in

• Improve stability when zooming on Google maps

• Address an issue that could prevent East Asian character input into webpages with Flash content

• Address an issue that could cause History items to appear incorrectly

• Address an issue that could cause cleared Reading List items to appear

• Improve printing from Safari

• Address an issue that could prevent the Google Safe Browsing Service from updating

Release notes:

• Leeslijst: U kunt eenvoudig webpagina's en koppelingen aan uw leeslijst toevoegen, zodat u deze kunt bekijken wanneer u er tijd voor hebt.

• Nieuwe procesarchitectuur: Safari is opnieuw geprogrammeerd, waardoor de stabiliteit verbeterd is en de reactiesnelheid is verhoogd. 

• Hervatten: In het paneel 'Algemeen' van de Safari-voorkeuren kunt u instellen dat bij het starten van Safari de vensters worden geopend die in de laatste browsersessie geopend waren.

• Meer privacy: Via het nieuwe paneel 'Privacy' in de Safari-voorkeuren kunt u eenvoudig gegevens verwijderen die websites mogelijk op uw computer achterlaten. 

• Veilig automatisch vullen: Met Safari kunt u formulieren snel invullen en uw persoonlijke gegevens privé houden. 

• Zoekoptie: Wanneer u zoekt in Safari, kunt u opgeven of u wilt zoeken naar tekst die de tekst bevat die u in het zoekveld typt of naar tekst die met deze zoektekst begint. 

• Downloads slepen: U kunt nu onderdelen uit het venster 'Downloads' slepen, zodat u gedownloade bestanden snel en eenvoudig op het bureaublad kunt plaatsen.

• Geavanceerde webtechnologieën: Safari biedt nu ondersteuning voor schermvullende webpagina's, het cachen van media met behulp van de HTML5-programmacache, MathML, Web Open Font Format, automatische woordafbreking volgens CSS3, verticale tekst volgens CSS3, tekstbenadrukking volgens CSS3, Window.onError en opgemaakte XML-bestanden.

• Nieuwe extensie-API's: Ontwikkelaars kunnen nu gebruikmaken van nieuwe Safari-extensieondersteuning voor popovers, menu's, nieuwe eventklassen en interactie met Reader.

• CFNetwork

  Available for: Windows 7, Vista, XP SP2 or later

  Impact: Visiting a maliciously crafted website may lead to a cross-site scripting attack

  Description: In certain situations, Safari may treat a file as HTML, even if it is served with the 'text/plain' content type. This may lead to a cross-site scripting attack on sites that allow untrusted users to post text files. This issue is addressed through improved handling of 'text/plain' content.

  CVE-ID

  CVE-2010-1420 : Hidetake Jo working with Microsoft Vulnerability Research (MSVR), Neal Poole of Matasano Security

• CFNetwork

  Available for: Windows 7, Vista, XP SP2 or later

  Impact: Authenticating to a maliciously crafted website may lead to arbitrary code execution

  Description: The NTLM authentication protocol is susceptible to a replay attack referred to as credential reflection. Authenticating to a maliciously crafted website may lead to arbitrary code execution. To mitigate this issue, Safari has been updated to utilize protection mechanisms recently added to Windows. This issue does not affect Mac OS X systems.

  CVE-ID

  CVE-2010-1383 : Takehiro Takahashi of IBM X-Force Research

• CFNetwork

  Available for: Windows 7, Vista, XP SP2 or later

  Impact: A root certificate that is disabled may still be trusted

  Description: CFNetwork did not properly validate that a certificate was trusted for use by a SSL server. As a result, if the user had marked a system root certificate as not trusted, Safari would still accept certificates signed by that root. This issue is addressed through improved certificate validation. This issue does not affect Mac OS X systems.

  CVE-ID

  CVE-2011-0214 : an anonymous reporter

• ColorSync

  Available for: Windows 7, Vista, XP SP2 or later

  Impact: Viewing a maliciously crafted image with an embedded ColorSync profile may lead to an unexpected application termination or arbitrary code execution

  Description: An integer overflow existed in the handling of images with an embedded ColorSync profile, which may lead to a heap buffer overflow. Opening a maliciously crafted image with an embedded ColorSync profile may lead to an unexpected application termination or arbitrary code execution. For Mac OS X v10.5 systems, this issue is addressed in Security Update 2011-004.

  CVE-ID

  CVE-2011-0200 : binaryproof working with TippingPoint's Zero Day Initiative

• CoreFoundation

  Available for: Windows 7, Vista, XP SP2 or later

  Impact: Applications that use the CoreFoundation framework may be vulnerable to an unexpected application termination or arbitrary code execution

  Description: An off-by-one buffer overflow issue existed in the handling of CFStrings. Applications that use the CoreFoundation framework may be vulnerable to an unexpected application termination or arbitrary code execution. For Mac OS X v10.6 systems, this issue is addressed in Mac OS X v10.6.8.

  CVE-ID

  CVE-2011-0201 : Harry Sintonen

• CoreGraphics

  Available for: Windows 7, Vista, XP SP2 or later

  Impact: Opening a maliciously crafted PDF file may lead to an unexpected application termination or arbitrary code execution

  Description: An integer overflow issue existed in the handling of Type 1 fonts. Viewing or downloading a document containing a maliciously crafted embedded font may lead to arbitrary code execution. For Mac OS X v10.6 systems, this issue is addressed in Mac OS X v10.6.8. For Mac OS X v10.5 systems, this issue is addressed in Security Update 2011-004.

  CVE-ID

  CVE-2011-0202 : Cristian Draghici of Modulo Consulting, Felix Grobert of the Google Security Team

• International Components for Unicode

  Available for: Windows 7, Vista, XP SP2 or later

  Impact: Applications that use ICU may be vulnerable to an unexpected application termination or arbitrary code execution

  Description: A buffer overflow issue existed in ICU's handling of uppercase strings. Applications that use ICU may be vulnerable to an unexpected application termination or arbitrary code execution. For Mac OS X v10.6 systems, this issue is addressed in Mac OS X v10.6.8.

  CVE-ID

  CVE-2011-0206 : David Bienvenu of Mozilla

• ImageIO

  Available for: Windows 7, Vista, XP SP2 or later

  Impact: Viewing a maliciously crafted TIFF image may lead to an unexpected application termination or arbitrary code execution

  Description: A heap buffer overflow existed in ImageIO's handling of TIFF images. Viewing a maliciously crafted TIFF image may lead to an unexpected application termination or arbitrary code execution. For Mac OS X v10.6 systems, this issue is addressed in Mac OS X v10.6.8. For Mac OS X v10.5 systems, this issue is addressed in Security Update 2011-004.

  CVE-ID

  CVE-2011-0204 : Dominic Chell of NGS Secure

• ImageIO

  Available for: Windows 7, Vista, XP SP2 or later

  Impact: Viewing a maliciously crafted TIFF image may lead to an unexpected application termination or arbitrary code execution

  Description: A heap buffer overflow existed in ImageIO's handling of CCITT Group 4 encoded TIFF images. Viewing a maliciously crafted TIFF image may lead to an unexpected application termination or arbitrary code execution.

  CVE-ID

  CVE-2011-0241 : Cyril CATTIAUX of Tessi Technologies

• ImageIO

  Available for: Windows 7, Vista, XP SP2 or later

  Impact: Viewing a maliciously crafted TIFF image may lead to an unexpected application termination or arbitrary code execution

  Description: A reentrancy issue existed in ImageIO's handling of TIFF images. Viewing a maliciously crafted TIFF image may lead to an unexpected application termination or arbitrary code execution. This issue does not affect Mac OS X systems.

  CVE-ID

  CVE-2011-0215 : Juan Pablo Lopez Yacubian working with iDefense VCP

• ImageIO

  Available for: Windows 7, Vista, XP SP2 or later

  Impact: Viewing a maliciously crafted TIFF image may lead to an unexpected application termination or arbitrary code execution

  Description: A heap buffer overflow existed in ImageIO's handling of TIFF images. Viewing a maliciously crafted TIFF image may lead to an unexpected application termination or arbitrary code execution. For Mac OS X v10.6 systems, this issue is addressed in Mac OS X v10.6.8. For Mac OS X v10.5 systems, this issue is addressed in Security Update 2011-004.

  CVE-ID

  CVE-2011-0204 : Dominic Chell of NGS Secure

• libxslt

  Available for: Windows 7, Vista, XP SP2 or later

  Impact: Visiting a maliciously crafted website may lead to the disclosure of addresses on the heap

  Description: libxslt's implementation of the generate-id() XPath function disclosed the address of a heap buffer. Visiting a maliciously crafted website may lead to the disclosure of addresses on the heap. This issue is addressed by generating an ID based on the difference between the addresses of two heap buffers. For Mac OS X v10.6 systems, this issue is addressed in Mac OS X v10.6.8. For Mac OS X v10.5 systems, this issue is addressed in Security Update 2011-004.

  CVE-ID

  CVE-2011-0195 : Chris Evans of the Google Chrome Security Team

• libxml

  Available for: Windows 7, Vista, XP SP2 or later

  Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution

  Description: A one-byte heap buffer overflow existed in libxml's handling of XML data. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution.

  CVE-ID

  CVE-2011-0216 : Billy Rios of the Google Security Team

• Safari

  Available for: Mac OS X v10.6.8 or later, Mac OS X Server v10.6.8 or later, Windows 7, Vista, XP SP2 or later

  Impact: If the "AutoFill web forms" feature is enabled, visiting a maliciously crafted website and typing may lead to the disclosure of information from the user's Address Book

  Description: Safari's "AutoFill web forms" feature filled in non-visible form fields, and the information was accessible by scripts on the site before the user submitted the form. This issue is addressed by displaying all fields that will be filled, and requiring the user's consent before AutoFill information is available to the form.

  CVE-ID

  CVE-2011-0217 : Florian Rienhardt of BSI, Alex Lambert, Jeremiah Grossman

• Safari

  Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8, Mac OS X v10.6.8 or later, Mac OS X Server v10.6.8 or later, Windows 7, Vista, XP SP2 or later

  Impact: With a certain Java configuration, visiting a malicious website may lead to unexpected text being displayed on other sites

  Description: A cross origin issue existed in the handling of Java Applets. This applies when Java is enabled in Safari, and Java is configured to run within the browser process. Fonts loaded by a Java applet could affect the display of text content from other sites. This issue is addressed by running Java applets in a separate process.

  CVE-ID

  CVE-2011-0219 : Joshua Smith of Kaon Interactive

• WebKit

  Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8, Mac OS X v10.6.8 or later, Mac OS X Server v10.6.8 or later, Windows 7, Vista, XP SP2 or later

  Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution

  Description: Multiple memory corruption issues existed in WebKit. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution.

  CVE-ID

  CVE-2010-1823 : David Weston of Microsoft and Microsoft Vulnerability Research (MSVR), wushi of team509, and Yong Li of Research In Motion Ltd

  CVE-2011-0164 : Apple

  CVE-2011-0218 : SkyLined of Google Chrome Security Team

  CVE-2011-0221 : Abhishek Arya (Inferno) of Google Chrome Security Team

  CVE-2011-0222 : Nikita Tarakanov and Alex Bazhanyuk of the CISS Research Team, and Abhishek Arya (Inferno) of Google Chrome Security Team

  CVE-2011-0223 : Jose A. Vazquez of spa-s3c.blogspot.com working with iDefense VCP

  CVE-2011-0225 : Abhishek Arya (Inferno) of Google Chrome Security Team

  CVE-2011-0232 : J23 working with TippingPoint's Zero Day Initiative

  CVE-2011-0233 : wushi of team509 working with TippingPoint's Zero Day Initiative

  CVE-2011-0234 : Rob King working with TippingPoint's Zero Day Initiative, wushi of team509 working with TippingPoint's Zero Day Initiative, wushi of team509 working with iDefense VCP

  CVE-2011-0235 : Abhishek Arya (Inferno) of Google Chrome Security Team

  CVE-2011-0237 : wushi of team509 working with iDefense VCP

  CVE-2011-0238 : Adam Barth of Google Chrome Security Team

  CVE-2011-0240 : wushi of team509 working with iDefense VCP

  CVE-2011-0253 : Richard Keen

  CVE-2011-0254 : An anonymous researcher working with TippingPoint's Zero Day Initiative

  CVE-2011-0255 : An anonymous researcher working with TippingPoint's Zero Day Initiative

  CVE-2011-0981 : Rik Cabanier of Adobe Systems, Inc

  CVE-2011-0983 : Martin Barbella

  CVE-2011-1109 : Sergey Glazunov

  CVE-2011-1114 : Martin Barbella

  CVE-2011-1115 : Martin Barbella

  CVE-2011-1117 : wushi of team509

  CVE-2011-1121 : miaubiz

  CVE-2011-1188 : Martin Barbella

  CVE-2011-1203 : Sergey Glazunov

  CVE-2011-1204 : Sergey Glazunov

  CVE-2011-1288 : Andreas Kling of Nokia

  CVE-2011-1293 : Sergey Glazunov

  CVE-2011-1296 : Sergey Glazunov

  CVE-2011-1449 : Marek Majkowski, wushi of team 509 working with iDefense VCP

  CVE-2011-1451 : Sergey Glazunov

  CVE-2011-1453 : wushi of team509 working with TippingPoint's Zero Day Initiative

  CVE-2011-1457 : John Knottenbelt of Google

  CVE-2011-1462 : wushi of team509

  CVE-2011-1797 : wushi of team509

• WebKit

  Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8, Mac OS X v10.6.8 or later, Mac OS X Server v10.6.8 or later, Windows 7, Vista, XP SP2 or later

  Impact: Visiting a maliciously crafted website may lead to arbitrary code execution

  Description: A configuration issue existed in WebKit's use of libxslt. Visiting a maliciously crafted website may lead to arbitrary files being created with the privileges of the user, which may lead to arbitrary code execution. This issue is addressed through improved libxslt security settings.

  CVE-ID

  CVE-2011-1774 : Nicolas Gregoire of Agarri

• WebKit

  Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8, Mac OS X v10.6.8 or later, Mac OS X Server v10.6.8 or later, Windows 7, Vista, XP SP2 or later

  Impact: Visiting a maliciously crafted website may lead to an information disclosure

  Description: A cross-origin issue existed in the handling of Web Workers. Visiting a maliciously crafted website may lead to an information disclosure.

  CVE-ID

  CVE-2011-1190 : Daniel Divricean of divricean.ro

• WebKit

  Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8, Mac OS X v10.6.8 or later, Mac OS X Server v10.6.8 or later, Windows 7, Vista, XP SP2 or later

  Impact: Visiting a maliciously crafted website may lead to a cross-site scripting attack

  Description: A cross-origin issue existed in the handling of URLs with an embedded username. Visiting a maliciously crafted website may lead to a cross-site scripting attack. This issue is addressed through improved handling of URLs with an embedded username.

  CVE-ID

  CVE-2011-0242 : Jobert Abma of Online24

• WebKit

  Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8, Mac OS X v10.6.8 or later, Mac OS X Server v10.6.8 or later, Windows 7, Vista, XP SP2 or later

  Impact: Visiting a maliciously crafted website may lead to a cross-site scripting attack

  Description: A cross-origin issue existed in the handling of DOM nodes. Visiting a maliciously crafted website may lead to a cross-site scripting attack.

  CVE-ID

  CVE-2011-1295 : Sergey Glazunov

• WebKit

  Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8, Mac OS X v10.6.8 or later, Mac OS X Server v10.6.8 or later, Windows 7, Vista, XP SP2 or later

  Impact: A maliciously crafted website may be able to cause a different URL to be shown in the address bar

  Description: A URL spoofing issue existed in the handling of the DOM history object. A maliciously crafted website may have been able to cause a different URL to be shown in the address bar.

  CVE-ID

  CVE-2011-1107 : Jordi Chancel

• WebKit

  Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8, Mac OS X v10.6.8 or later, Mac OS X Server v10.6.8 or later, Windows 7, Vista, XP SP2 or later

  Impact: Subscribing to a maliciously crafted RSS feed and clicking on a link within it may lead to an information disclosure

  Description: A canonicalization issue existed in the handling of URLs. Subscribing to a maliciously crafted RSS feed and clicking on a link within it may lead to arbitrary files being sent from the user's system to a remote server. This update addresses the issue through improved handling of URLs.

  CVE-ID

  CVE-2011-0244 : Jason Hullinger

• WebKit

  Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8, Mac OS X v10.6.8 or later, Mac OS X Server v10.6.8 or later, Windows 7, Vista, XP SP2 or later

  Impact: Applications that use WebKit, such as mail clients, may connect to an arbitrary DNS server upon processing HTML content

  Description: DNS prefetching was enabled by default in WebKit. Applications that use WebKit, such a s mail clients, may connect to an arbitrary DNS server upon processing HTML content. This update addresses the issue by requiring applications to opt in to DNS prefetching.

  CVE-ID

  CVE-2010-3829 : Mike Cardwell of Cardwell IT Ltd.

Release notes:

Safari 5.0.5

• WebKit

  Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8, Mac OS X v10.6.5 or later, Mac OS X Server v10.6.5 or later, Windows 7, Vista, XP SP2 or later

  Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution

  Description: An integer overflow issue existed in the handling of nodesets. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution.

  CVE-ID

  CVE-2011-1290 : Vincenzo Iozzo, Willem Pinckaers, and Ralf-Philipp Weinmann working with TippingPoint's Zero Day Initiative

• WebKit

  Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8, Mac OS X v10.6.5 or later, Mac OS X Server v10.6.5 or later, Windows 7, Vista, XP SP2 or later

  Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution

  Description: A use after free issue existed in the handling of text nodes. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution.

  CVE-ID

  CVE-2011-1344 : Vupen Security working with TippingPoint's Zero Day Initiative, and Martin Barbella

Release notes:

Release notes:

Release notes: