CVE-2009-1725

Published: Jul 9, 2009Modified: Apr 23, 2026

9.3

Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability: 8.6 / Impact: 10.0

Source: NVD

Description

WebKit in Apple Safari before 4.0.2, as used on iPhone OS before 3.1, iPhone OS before 3.1.1 for iPod touch, and other platforms; KHTML in kdelibs in KDE; QtWebKit (aka Qt toolkit); and possibly other products do not properly handle numeric character references, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted HTML document.

Affected (55)

Products: Apple: Safari, Iphone Os, Ipod Touch

3 products

Configuration A

32 vulnerable

Vulnerable Software	Affected Versions
Apple Safari	Up to 4.0.1
Apple Safari	Version 2.0.0
Apple Safari	Version 2.0.1
Apple Safari	Version 2.0.2
Apple Safari	Version 2.0.3
Apple Safari	Version 2.0.3 417.8
Apple Safari	Version 2.0.3 417.9.2
Apple Safari	Version 2.0.3 417.9.3
Apple Safari	Version 2.0.3 417.9
Apple Safari	Version 2.0.4
Apple Safari	Version 2.0
Apple Safari	Version 3.0.0
Apple Safari	Version 3.0.0b
Apple Safari	Version 3.0.1
Apple Safari	Version 3.0.1 beta
Apple Safari	Version 3.0.1b
Apple Safari	Version 3.0.2
Apple Safari	Version 3.0.2b
Apple Safari	Version 3.0.3
Apple Safari	Version 3.0.3b
Apple Safari	Version 3.0.4
Apple Safari	Version 3.0.4b
Apple Safari	Version 3.0
Apple Safari	Version 3.1.0
Apple Safari	Version 3.1.0b
Apple Safari	Version 3.1.1
Apple Safari	Version 3.1.2
Apple Safari	Version 3.2.0
Apple Safari	Version 3.2.1
Apple Safari	Version 3.2.2
Apple Safari	Version 4.0.0b
Apple Safari	Version 4.0

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Apple Iphone Os	Up to 3.0.1
Apple Iphone Os	All versions

Configuration C

21 vulnerable

Vulnerable Software	Affected Versions
Apple Iphone Os	Up to 3.1
Apple Iphone Os	Version 1.0.0
Apple Iphone Os	Version 1.0.1
Apple Iphone Os	Version 1.0.2
Apple Iphone Os	Version 1.1.0
Apple Iphone Os	Version 1.1.1
Apple Iphone Os	Version 1.1.2
Apple Iphone Os	Version 1.1.3
Apple Iphone Os	Version 1.1.4
Apple Iphone Os	Version 1.1.5
Apple Iphone Os	Version 2.0.0
Apple Iphone Os	Version 2.0.1
Apple Iphone Os	Version 2.0.2
Apple Iphone Os	Version 2.0
Apple Iphone Os	Version 2.1.1
Apple Iphone Os	Version 2.1
Apple Iphone Os	Version 2.2.1
Apple Iphone Os	Version 2.2
Apple Iphone Os	Version 3.0.1
Apple Iphone Os	Version 3.0
Apple Ipod Touch	All versions

Related CWEs

CWE-189

References (66)

http://lists.apple.com/archives/security-announce/2009/Jul/msg00000.html

Source: cve@mitre.org

PatchVendor Advisory

http://lists.apple.com/archives/security-announce/2009/Sep/msg00001.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html

Source: cve@mitre.org

http://osvdb.org/55739

Source: cve@mitre.org

http://secunia.com/advisories/35758

Source: cve@mitre.org

http://secunia.com/advisories/36057

Source: cve@mitre.org

http://secunia.com/advisories/36062

Source: cve@mitre.org

http://secunia.com/advisories/36347

Source: cve@mitre.org

http://secunia.com/advisories/36677

Source: cve@mitre.org

http://secunia.com/advisories/36790

Source: cve@mitre.org

http://secunia.com/advisories/37746

Source: cve@mitre.org

http://secunia.com/advisories/43068

Source: cve@mitre.org

http://support.apple.com/kb/HT3666

Source: cve@mitre.org

PatchVendor Advisory

http://support.apple.com/kb/HT3860

Source: cve@mitre.org

http://websvn.kde.org/?view=rev&revision=1002162

Source: cve@mitre.org

http://websvn.kde.org/?view=rev&revision=1002163

Source: cve@mitre.org

http://websvn.kde.org/?view=rev&revision=1002164

Source: cve@mitre.org

http://www.debian.org/security/2009/dsa-1950

Source: cve@mitre.org

http://www.mandriva.com/security/advisories?name=MDVSA-2009:330

Source: cve@mitre.org

http://www.securityfocus.com/bid/35607

Source: cve@mitre.org

Patch

http://www.securitytracker.com/id?1022526

Source: cve@mitre.org

http://www.ubuntu.com/usn/USN-836-1

Source: cve@mitre.org

http://www.ubuntu.com/usn/USN-857-1

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2009/1827

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2011/0212

Source: cve@mitre.org

https://bugzilla.redhat.com/show_bug.cgi?id=513813

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5777

Source: cve@mitre.org

https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00931.html

Source: cve@mitre.org

https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00933.html

Source: cve@mitre.org

https://www.redhat.com/archives/fedora-package-announce/2009-July/msg01177.html

Source: cve@mitre.org

https://www.redhat.com/archives/fedora-package-announce/2009-July/msg01196.html

Source: cve@mitre.org

https://www.redhat.com/archives/fedora-package-announce/2009-July/msg01199.html

Source: cve@mitre.org

https://www.redhat.com/archives/fedora-package-announce/2009-July/msg01200.html

Source: cve@mitre.org

http://lists.apple.com/archives/security-announce/2009/Jul/msg00000.html