CVE - CVE-2009-1725

CVE-ID
CVE-2009-1725	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
WebKit in Apple Safari before 4.0.2, as used on iPhone OS before 3.1, iPhone OS before 3.1.1 for iPod touch, and other platforms; KHTML in kdelibs in KDE; QtWebKit (aka Qt toolkit); and possibly other products do not properly handle numeric character references, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted HTML document.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
CONFIRM:http://support.apple.com/kb/HT3666 CONFIRM:http://websvn.kde.org/?view=rev&revision=1002162 CONFIRM:http://websvn.kde.org/?view=rev&revision=1002163 CONFIRM:http://websvn.kde.org/?view=rev&revision=1002164 CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=513813 CONFIRM:http://support.apple.com/kb/HT3860 APPLE:APPLE-SA-2009-07-08-1 URL:http://lists.apple.com/archives/security-announce/2009/Jul/msg00000.html APPLE:APPLE-SA-2009-09-09-1 URL:http://lists.apple.com/archives/security-announce/2009/Sep/msg00001.html DEBIAN:DSA-1950 URL:http://www.debian.org/security/2009/dsa-1950 FEDORA:FEDORA-2009-8020 URL:https://www.redhat.com/archives/fedora-package-announce/2009-July/msg01200.html FEDORA:FEDORA-2009-8039 URL:https://www.redhat.com/archives/fedora-package-announce/2009-July/msg01177.html FEDORA:FEDORA-2009-8046 URL:https://www.redhat.com/archives/fedora-package-announce/2009-July/msg01199.html FEDORA:FEDORA-2009-8049 URL:https://www.redhat.com/archives/fedora-package-announce/2009-July/msg01196.html FEDORA:FEDORA-2009-8800 URL:https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00931.html FEDORA:FEDORA-2009-8802 URL:https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00933.html MANDRIVA:MDVSA-2009:330 URL:http://www.mandriva.com/security/advisories?name=MDVSA-2009:330 SUSE:SUSE-SR:2011:002 URL:http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html UBUNTU:USN-857-1 URL:http://www.ubuntu.com/usn/USN-857-1 UBUNTU:USN-836-1 URL:http://www.ubuntu.com/usn/USN-836-1 BID:35607 URL:http://www.securityfocus.com/bid/35607 OSVDB:55739 URL:http://osvdb.org/55739 OVAL:oval:org.mitre.oval:def:5777 URL:https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5777 SECTRACK:1022526 URL:http://www.securitytracker.com/id?1022526 SECUNIA:35758 URL:http://secunia.com/advisories/35758 SECUNIA:36057 URL:http://secunia.com/advisories/36057 SECUNIA:36062 URL:http://secunia.com/advisories/36062 SECUNIA:36347 URL:http://secunia.com/advisories/36347 SECUNIA:36677 URL:http://secunia.com/advisories/36677 SECUNIA:37746 URL:http://secunia.com/advisories/37746 SECUNIA:36790 URL:http://secunia.com/advisories/36790 SECUNIA:43068 URL:http://secunia.com/advisories/43068 VUPEN:ADV-2009-1827 URL:http://www.vupen.com/english/advisories/2009/1827 VUPEN:ADV-2011-0212 URL:http://www.vupen.com/english/advisories/2011/0212
Assigning CNA
N/A
Date Entry Created
20090520	Disclaimer: The entry creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20090520)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an entry on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: cve@mitre.org

Use of the Common Vulnerabilities and Exposures (CVE®) List and the associated references from this website are subject to the terms of use. CVE is sponsored by US-CERT in the office of Cybersecurity and Communications at the U.S. Department of Homeland Security. Copyright © 1999–2018, The MITRE Corporation. CVE and the CVE logo are registered trademarks of The MITRE Corporation. For more information, please contact us.