CVE-2009-1687

Published: Jun 10, 2009Modified: Apr 23, 2026

9.3

Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability: 8.6 / Impact: 10.0

Source: NVD

Description

The JavaScript garbage collector in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not properly handle allocation failures, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted HTML document that triggers write access to an "offset of a NULL pointer."

Affected (34)

Products: Apple: Safari

1 product

Configuration A

22 vulnerable

Vulnerable Software	Affected Versions
Apple Safari	Up to 4.0_beta
Apple Safari	Version 0.8
Apple Safari	Version 0.9
Apple Safari	Version 1.0.3
Apple Safari	Version 1.0
Apple Safari	Version 1.1
Apple Safari	Version 1.2
Apple Safari	Version 1.3.1
Apple Safari	Version 1.3.2
Apple Safari	Version 1.3
Apple Safari	Version 2.0.2
Apple Safari	Version 2.0.4
Apple Safari	Version 2.0
Apple Safari	Version 3.0.2
Apple Safari	Version 3.0.3
Apple Safari	Version 3.0.4
Apple Safari	Version 3.0
Apple Safari	Version 3.1.1
Apple Safari	Version 3.1.2
Apple Safari	Version 3.1
Apple Safari	Version 3.2.1
Apple Safari	Version 3.2.3

Configuration B

12 vulnerable

Vulnerable Software	Affected Versions
Apple Safari	Up to 3.2.3
Apple Safari	Version 3.0.1
Apple Safari	Version 3.0.2
Apple Safari	Version 3.0.3
Apple Safari	Version 3.0.4
Apple Safari	Version 3.0
Apple Safari	Version 3.1.1
Apple Safari	Version 3.1.2
Apple Safari	Version 3.1
Apple Safari	Version 3.2.1
Apple Safari	Version 3.2.2
Apple Safari	Version 3.2

Related CWEs

References (56)

http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html

Source: cve@mitre.org

http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html

Source: cve@mitre.org

Vendor Advisory

http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html

Source: cve@mitre.org

http://osvdb.org/54985

Source: cve@mitre.org

http://secunia.com/advisories/35379

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/36057

Source: cve@mitre.org

http://secunia.com/advisories/36062

Source: cve@mitre.org

http://secunia.com/advisories/36790

Source: cve@mitre.org

http://secunia.com/advisories/37746

Source: cve@mitre.org

http://secunia.com/advisories/43068

Source: cve@mitre.org

http://securitytracker.com/id?1022345

Source: cve@mitre.org

Patch

http://support.apple.com/kb/HT3613

Source: cve@mitre.org

Vendor Advisory

http://support.apple.com/kb/HT3639

Source: cve@mitre.org

http://www.debian.org/security/2009/dsa-1950

Source: cve@mitre.org

http://www.mandriva.com/security/advisories?name=MDVSA-2009:330

Source: cve@mitre.org

http://www.securityfocus.com/bid/35260

Source: cve@mitre.org

Exploit

http://www.securityfocus.com/bid/35309

Source: cve@mitre.org

http://www.ubuntu.com/usn/USN-822-1

Source: cve@mitre.org

http://www.ubuntu.com/usn/USN-836-1

Source: cve@mitre.org

http://www.ubuntu.com/usn/USN-857-1

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2009/1522

Source: cve@mitre.org

PatchVendor Advisory

http://www.vupen.com/english/advisories/2009/1621

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2011/0212

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10260

Source: cve@mitre.org

https://www.redhat.com/archives/fedora-package-announce/2009-July/msg01177.html

Source: cve@mitre.org

https://www.redhat.com/archives/fedora-package-announce/2009-July/msg01196.html

Source: cve@mitre.org

https://www.redhat.com/archives/fedora-package-announce/2009-July/msg01199.html

Source: cve@mitre.org

https://www.redhat.com/archives/fedora-package-announce/2009-July/msg01200.html

Source: cve@mitre.org

http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://osvdb.org/54985

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/35379

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/36057

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/36062

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/36790

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/37746

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/43068

Source: af854a3a-2127-422b-91ae-364da2661108

http://securitytracker.com/id?1022345

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://support.apple.com/kb/HT3613

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://support.apple.com/kb/HT3639

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.debian.org/security/2009/dsa-1950

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mandriva.com/security/advisories?name=MDVSA-2009:330

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/35260

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://www.securityfocus.com/bid/35309

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ubuntu.com/usn/USN-822-1

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ubuntu.com/usn/USN-836-1

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ubuntu.com/usn/USN-857-1

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2009/1522

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://www.vupen.com/english/advisories/2009/1621

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2011/0212

Source: af854a3a-2127-422b-91ae-364da2661108

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10260

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.redhat.com/archives/fedora-package-announce/2009-July/msg01177.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.redhat.com/archives/fedora-package-announce/2009-July/msg01196.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.redhat.com/archives/fedora-package-announce/2009-July/msg01199.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.redhat.com/archives/fedora-package-announce/2009-July/msg01200.html

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.