From the Debian advisory:
CVE-2009-1714:
Cross-site scripting (XSS) vulnerability in Web Inspector in WebKit allows
user-assisted remote attackers to inject arbitrary web script or HTML, and read
local files, via vectors related to the improper escaping of HTML attributes.
CVE-2009-1710:
WebKit allows remote attackers to spoof the browser's display of the host name,
security indicators, and unspecified other UI elements via a custom cursor in
conjunction with a modified CSS3 hotspot property.
CVE-2009-1697:
CRLF injection vulnerability in WebKit allows remote attackers to inject HTTP
headers and bypass the Same Origin Policy via a crafted HTML document, related
to cross-site scripting (XSS) attacks that depend on communication with
arbitrary web sites on the same server through use of XMLHttpRequest without a
Host header.
CVE-2009-1695:
Cross-site scripting (XSS) vulnerability in WebKit allows remote attackers to
inject arbitrary web script or HTML via vectors involving access to frame
contents after completion of a page transition.
CVE-2009-1693:
WebKit allows remote attackers to read images from arbitrary web sites via a
CANVAS element with an SVG image, related to a "cross-site image capture issue."
CVE-2009-1694:
WebKit does not properly handle redirects, which allows remote attackers to read
images from arbitrary web sites via vectors involving a CANVAS element and
redirection, related to a "cross-site image capture issue."
CVE-2009-1681:
WebKit does not prevent web sites from loading third-party content into a
subframe, which allows remote attackers to bypass the Same Origin Policy and
conduct "clickjacking" attacks via a crafted HTML document.
CVE-2009-1684:
Cross-site scripting (XSS) vulnerability in WebKit allows remote attackers to
inject arbitrary web script or HTML via an event handler that triggers script
execution in the context of the next loaded document.
CVE-2009-1692:
WebKit allows remote attackers to cause a denial of service (memory consumption
or device reset) via a web page containing an HTMLSelectElement object with a
large length attribute, related to the length property of a Select object.
| 