Published: 10/06/2009 Updated: 17/02/2011

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

CRLF injection vulnerability in WebKit in Apple Safari prior to 4.0, iPhone OS 1.0 up to and including 2.2.1, and iPhone OS for iPod touch 1.1 up to and including 2.2.1 allows remote malicious users to inject HTTP headers and bypass the Same Origin Policy via a crafted HTML document, related to cross-site scripting (XSS) attacks that depend on communication with arbitrary web sites on the same server through use of XMLHttpRequest without a Host header.

Vulnerable Product	Search on Vulmon	Subscribe to Product
apple safari 3.1.1
apple safari 1.3
apple safari 1.3.1
apple safari
apple safari 3.0.2
apple safari 3.1
apple safari 3.1.2
apple safari 1.3.2
apple safari 2.0
apple safari 0.9
apple safari 3.0.3
apple safari 0.8
apple safari 1.0
apple safari 2.0.2
apple safari 2.0.4
apple safari 3.0
apple safari 3.0.4
apple safari 1.1
apple safari 1.2
apple safari 3.2.1
apple safari 3.2.3
apple safari 1.0.3
apple safari 3.0.1
apple safari 3.2.2
apple safari 3.2

Several vulnerabilities have been discovered in WebKit, a Web content engine library for Gtk+ The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2009-0945 Array index error in the insertItemBefore method in WebKit, allows remote attackers to execute arbitrary code via a document with a SVGPathList data structu ...

Debian Bug report logs - #534946 webkit: CVE-2009-1698 CVE-2009-1690 CVE-2009-1687 Package: webkit; Maintainer for webkit is (unknown); Reported by: Giuseppe Iuculano <giuseppe@iuculanoit> Date: Sun, 28 Jun 2009 12:48:02 UTC Severity: grave Tags: lenny, patch, security Found in version 101-4 Fixed in versions 115-1, ...

Debian Bug report logs - #535793 webkit: deluge of security vulnerabilities Package: webkit; Maintainer for webkit is (unknown); Reported by: Michael S Gilbert <michaelsgilbert@gmailcom> Date: Sun, 5 Jul 2009 05:18:04 UTC Severity: grave Tags: fixed-upstream, security Found in version 101-4 Fixed in version 1121-1 ...

CWE-20 http://www.securityfocus.com/bid/35260 http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html http://secunia.com/advisories/35379 http://www.vupen.com/english/advisories/2009/1522 http://support.apple.com/kb/HT3613 http://securitytracker.com/id?1022344 http://osvdb.org/54992 http://www.vupen.com/english/advisories/2009/1621 http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html http://support.apple.com/kb/HT3639 http://www.debian.org/security/2009/dsa-1950 http://secunia.com/advisories/37746 http://secunia.com/advisories/43068 http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html http://www.vupen.com/english/advisories/2011/0212 https://www.debian.org/security/./dsa-1950 https://nvd.nist.gov

CVE-2009-1697

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect