Published: 10/06/2009 Updated: 17/02/2011

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 435

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari prior to 4.0, iPhone OS 1.0 up to and including 2.2.1, and iPhone OS for iPod touch 1.1 up to and including 2.2.1 allows remote malicious users to inject arbitrary web script or HTML via an event handler that triggers script execution in the context of the next loaded document.

Vulnerable Product	Search on Vulmon	Subscribe to Product
apple safari 3.1.1
apple safari 3.1
apple safari 1.3.1
apple safari 1.3.2
apple safari 3.0.2
apple safari 0.9
apple safari 1.0
apple safari 1.1
apple safari 2.0.4
apple safari 3.2.1
apple safari 3.0.4
apple safari 1.0.3
apple safari 1.2
apple safari 1.3
apple safari 3.2.3
apple safari
apple safari 3.1.2
apple safari 0.8
apple safari 2.0
apple safari 2.0.2
apple safari 3.0.3
apple safari 3.0
apple safari 3.0.1
apple safari 3.2.2
apple safari 3.2

Several vulnerabilities have been discovered in WebKit, a Web content engine library for Gtk+ The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2009-0945 Array index error in the insertItemBefore method in WebKit, allows remote attackers to execute arbitrary code via a document with a SVGPathList data structu ...

Debian Bug report logs - #534946 webkit: CVE-2009-1698 CVE-2009-1690 CVE-2009-1687 Package: webkit; Maintainer for webkit is (unknown); Reported by: Giuseppe Iuculano <giuseppe@iuculanoit> Date: Sun, 28 Jun 2009 12:48:02 UTC Severity: grave Tags: lenny, patch, security Found in version 101-4 Fixed in versions 115-1, ...

Debian Bug report logs - #535793 webkit: deluge of security vulnerabilities Package: webkit; Maintainer for webkit is (unknown); Reported by: Michael S Gilbert <michaelsgilbert@gmailcom> Date: Sun, 5 Jul 2009 05:18:04 UTC Severity: grave Tags: fixed-upstream, security Found in version 101-4 Fixed in version 1121-1 ...

source: wwwsecurityfocuscom/bid/35315/info WebKit is prone to a cross-domain scripting vulnerability because it fails to properly restrict the access of JavaScript code when loading new webpages A remote attacker can exploit this vulnerability to bypass the same-origin policy and obtain potentially sensitive information or to launch spo ...

CWE-79 http://www.vupen.com/english/advisories/2009/1522 http://support.apple.com/kb/HT3613 http://securitytracker.com/id?1022344 http://secunia.com/advisories/35379 http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html http://www.securityfocus.com/bid/35260 http://osvdb.org/54987 http://www.vupen.com/english/advisories/2009/1621 http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html http://support.apple.com/kb/HT3639 http://secunia.com/advisories/37746 http://www.debian.org/security/2009/dsa-1950 http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html http://secunia.com/advisories/43068 http://www.vupen.com/english/advisories/2011/0212 https://nvd.nist.gov https://www.debian.org/security/./dsa-1950 https://www.exploit-db.com/exploits/33033/

CVE-2009-1684

Vulnerability Summary

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect