CVE-2009-1725
Critical
Description
WebKit in Apple Safari before 4.0.2, as used on iPhone OS before 3.1, iPhone OS before 3.1.1 for iPod touch, and other platforms; KHTML in kdelibs in KDE; QtWebKit (aka Qt toolkit); and possibly other products do not properly handle numeric character references, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted HTML document.
SeverityCritical
CVSS9.3
Exploit probability—
Product
Apple Safari
PublishedJul 9, 2009
First seenJul 9, 2009
How to fix
Vendor advisories
- redhat.com/archives/fedora-package-announce/2009-July/msg01177.html
- redhat.com/archives/fedora-package-announce/2009-July/msg01199.html
- redhat.com/archives/fedora-package-announce/2009-August/msg00933.html
- redhat.com/archives/fedora-package-announce/2009-July/msg01196.html
- redhat.com/archives/fedora-package-announce/2009-August/msg00931.html
- redhat.com/archives/fedora-package-announce/2009-July/msg01200.html
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apple safari | v ≤ 4.0.1, 2.0, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 3.0, 3.0.0, 3.0.0b, 3.0.1, 3.0.1b, 3.0.2, 3.0.2b, 3.0.3, 3.0.3b, 3.0.4, 3.0.4b, 3.1.0, 3.1.0b, 3.1.1, 3.1.2, 3.2.0, 3.2.1, 3.2.2, 4.0, 4.0.0b | — |
| apple iphone_os | v ≤ 3.0.1, 1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.1.5, 2.0, 2.0.0, 2.0.1, 2.0.2, 2.1, 2.1.1, 2.2, 2.2.1, 3.0, No range specified, v ≤ 3.1, 3.0.1 | — |
| apple ipod_touch | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.