Description: A vulnerability was reported in Blackberry Device Software. A remote user can cause arbitrary code to be executed on the target user’s system.
A remote user can create specially crafted HTML that, when loaded by the target user, will execute arbitrary code on the target system.
The code can access user data stored on the media card and in the built-in media storage on the BlackBerry smartphone, but not email and other personal information stored on the file system of the BlackBerry smartphone.
The following devices are affected:
* BlackBerry Bold 9650 smartphone
* BlackBerry Bold 9700 smartphone
* BlackBerry Bold 9780 smartphone
* BlackBerry Curve 9300 Series
* BlackBerry Pearl 9100 Series
* BlackBerry Style 9670 smartphone
* BlackBerry Torch 9800 smartphone
This vulnerability was demonstrated at the Pwn2Own 2011 Contest.
Vincenzo Iozzo, Ralf Philipp Weinmann, and Willem Pinckaers reported this vulnerability via TippingPoint’s Zero Day Initiative.