CVE-2009-1699
N/A
N/A
Summary
The XSL stylesheet implementation in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not properly handle XML external entities, which allows remote attackers to read arbitrary files via a crafted DTD, as demonstrated by a file:///etc/passwd URL in an entity declaration, related to an "XXE attack."
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| n/a | n/a | n/a | affected |
Weaknesses
- n/a
ADP Enrichment
CVE Program Container
Additional References
- http://support.apple.com/kb/HT3639
- http://secunia.com/advisories/43068
- http://www.vupen.com/english/advisories/2009/1621
- https://www.exploit-db.com/exploits/8907
- http://www.vupen.com/english/advisories/2011/0212
- http://scary.beasts.org/security/CESA-2009-006.html
- http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html
- http://osvdb.org/54972
- http://www.securityfocus.com/bid/35260
- http://www.vupen.com/english/advisories/2009/1522
- http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
- http://secunia.com/advisories/35379
- http://www.ubuntu.com/usn/USN-857-1
- http://www.securityfocus.com/bid/35321
- http://scarybeastsecurity.blogspot.com/2009/06/apples-safari-4-fixes-local-file-theft.html
- http://support.apple.com/kb/HT3613
References
- http://support.apple.com/kb/HT3639
- http://secunia.com/advisories/43068
- http://www.vupen.com/english/advisories/2009/1621
- https://www.exploit-db.com/exploits/8907
- http://www.vupen.com/english/advisories/2011/0212
- http://scary.beasts.org/security/CESA-2009-006.html
- http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html
- http://osvdb.org/54972
- http://www.securityfocus.com/bid/35260
- http://www.vupen.com/english/advisories/2009/1522
- http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
- http://secunia.com/advisories/35379
- http://www.ubuntu.com/usn/USN-857-1
- http://www.securityfocus.com/bid/35321
- http://scarybeastsecurity.blogspot.com/2009/06/apples-safari-4-fixes-local-file-theft.html
- http://support.apple.com/kb/HT3613
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.