Last week, Jeremiah Grossman, chief security officer of WhiteHat Security, released a proof of concept showing how AutoFill can be misused to grab the name, work place, city, state, and email address of a visitor to a web page. No user action is required beyond navigating to the malicious page.

Grossman reported the issue to Apple a little over a month before going public, but said he could get no response from the company other than an automated reply to his original notification.

In addition to delivering extensions, Safari 5.0.1 fixes the problem by prohibiting AutoFill from using information without user action. According to Apple, the change affects both the Mac OS X and Windows versions of Safari.

Both versions also include changes to the handling of RSS feeds to block a cross-site scripting attack.

Multiple security-related changes have been made to the WebKit framework that underpins Safari. The 13 vulnerabilities are all said to potentially allow the execution of arbitrary code.

Page 2 - what's affected in WebKit, and what about those stuck on Safari 4?

---

The diverse set of WebKit issues affect the processing of element focus, inline elements, text nodes, CSS counters, SVG, JavaScript, and regular expressions. They all affect the Mac OS X and Windows versions of the browser.

Corresponding security patches have been delivered in Safari 4.1.1 for Mac OS X 10.4.

Safari can be updated most conveniently via Software Update (Apple Software Update on Windows). A complete installer is also available at www.apple.com/safari/download/.