CVE-2009-1700: Infoleak
First published: Wed Jun 10 2009(Updated: )
The XSLT implementation in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not properly handle redirects, which allows remote attackers to read XML content from arbitrary web pages via a crafted document.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apple Mobile Safari | =3.0.4b | |
| Apple Mobile Safari | =2.0.3-417.9.3 | |
| Apple Mobile Safari | =3.0.4 | |
| Apple Mobile Safari | =3.0.1-beta | |
| Apple Mobile Safari | =2.0.1 | |
| Apple Mobile Safari | =2.0.3 | |
| Apple Mobile Safari | =2.0.2 | |
| Apple Mobile Safari | =3.0.0 | |
| Apple Mobile Safari | =3.0.1 | |
| Apple Mobile Safari | =3.0.2 | |
| Apple Mobile Safari | <=3.2.2 | |
| Apple Mobile Safari | =3.0.3b | |
| Apple Mobile Safari | =3.1.1 | |
| Apple Mobile Safari | =2.0.3-417.9 | |
| Apple Mobile Safari | =2.0.3-417.9.2 | |
| Apple Mobile Safari | =3.0.3 | |
| Apple Mobile Safari | =2.0 | |
| Apple Mobile Safari | =2.0.3-417.8 | |
| Apple Mobile Safari | =3.1.2 | |
| Apple Mobile Safari | =3.1.0b | |
| Apple Mobile Safari | =3.1.0 | |
| Apple Mobile Safari | =2.0.4 | |
| Apple Mobile Safari | =3.0.0b | |
| Apple Mobile Safari | =2.0.0 | |
| Apple Mobile Safari | =3.2.0 | |
| Apple Mobile Safari | =3.0.2b | |
| Apple Mobile Safari | =3.0.1b | |
| Apple Mobile Safari | =3.2.1 | |
| Apple Mobile Safari | =3.0 | |
| iStyle @cosme iPhone OS | =1.0.0 | |
| iStyle @cosme iPhone OS | =1.0.1 | |
| iStyle @cosme iPhone OS | =1.0.2 | |
| iStyle @cosme iPhone OS | =1.1.0 | |
| iStyle @cosme iPhone OS | =1.1.1 | |
| iStyle @cosme iPhone OS | =1.1.2 | |
| iStyle @cosme iPhone OS | =1.1.3 | |
| iStyle @cosme iPhone OS | =1.1.4 | |
| iStyle @cosme iPhone OS | =1.1.5 | |
| iStyle @cosme iPhone OS | =2.0 | |
| iStyle @cosme iPhone OS | =2.0.0 | |
| iStyle @cosme iPhone OS | =2.0.1 | |
| iStyle @cosme iPhone OS | =2.0.2 | |
| iStyle @cosme iPhone OS | =2.1 | |
| iStyle @cosme iPhone OS | =2.1.1 | |
| iStyle @cosme iPhone OS | =2.2 | |
| iStyle @cosme iPhone OS | =2.2.1 | |
| Apple iPod touch | ||
| iStyle @cosme iPhone OS |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://secunia.com/advisories/35379
- http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html
- http://www.securityfocus.com/bid/35260
- http://www.vupen.com/english/advisories/2009/1522
- http://support.apple.com/kb/HT3613
- http://osvdb.org/54973
- http://support.apple.com/kb/HT3639
- http://www.vupen.com/english/advisories/2009/1621
- http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html
- http://secunia.com/advisories/43068
- http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
- http://www.vupen.com/english/advisories/2011/0212
Frequently Asked Questions
What is the severity of CVE-2009-1700?
CVE-2009-1700 has been classified with a moderate severity level due to its potential for information disclosure.
How do I fix CVE-2009-1700?
To fix CVE-2009-1700, users should update their Safari browser to version 4.0 or later, or upgrade their iPhone OS to a secure version.
Which versions of Safari are affected by CVE-2009-1700?
CVE-2009-1700 affects several Safari versions, including 2.0.0 through 3.2.2.
What type of vulnerability is CVE-2009-1700?
CVE-2009-1700 is a redirect vulnerability in the XSLT implementation of WebKit, allowing remote attackers to read unauthorized XML content.
What platforms are impacted by CVE-2009-1700?
CVE-2009-1700 impacts Apple Safari browsers and iPhone OS versions before 2.2.1.
- agent/references
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- collector/nvd-historical
- agent/software-canonical-lookup-request
- agent/remedy
- agent/weakness
- agent/severity
- agent/author
- agent/softwarecombine
- agent/tags
- agent/description
- agent/event
- collector/nvd-index
- vendor/apple
- canonical/apple mobile safari
- version/apple mobile safari/3.0.4b
- version/apple mobile safari/2.0.3-417.9.3
- version/apple mobile safari/3.0.4
- version/apple mobile safari/3.0.1-beta
- version/apple mobile safari/2.0.1
- version/apple mobile safari/2.0.3
- version/apple mobile safari/2.0.2
- version/apple mobile safari/3.0.0
- version/apple mobile safari/3.0.1
- version/apple mobile safari/3.0.2
- version/apple mobile safari/3.2.2
- version/apple mobile safari/3.0.3b
- version/apple mobile safari/3.1.1
- version/apple mobile safari/2.0.3-417.9
- version/apple mobile safari/2.0.3-417.9.2
- version/apple mobile safari/3.0.3
- version/apple mobile safari/2.0
- version/apple mobile safari/2.0.3-417.8
- version/apple mobile safari/3.1.2
- version/apple mobile safari/3.1.0b
- version/apple mobile safari/3.1.0
- version/apple mobile safari/2.0.4
- version/apple mobile safari/3.0.0b
- version/apple mobile safari/2.0.0
- version/apple mobile safari/3.2.0
- version/apple mobile safari/3.0.2b
- version/apple mobile safari/3.0.1b
- version/apple mobile safari/3.2.1
- version/apple mobile safari/3.0
- canonical/istyle @cosme iphone os
- version/istyle @cosme iphone os/1.0.0
- version/istyle @cosme iphone os/1.0.1
- version/istyle @cosme iphone os/1.0.2
- version/istyle @cosme iphone os/1.1.0
- version/istyle @cosme iphone os/1.1.1
- version/istyle @cosme iphone os/1.1.2
- version/istyle @cosme iphone os/1.1.3
- version/istyle @cosme iphone os/1.1.4
- version/istyle @cosme iphone os/1.1.5
- version/istyle @cosme iphone os/2.0
- version/istyle @cosme iphone os/2.0.0
- version/istyle @cosme iphone os/2.0.1
- version/istyle @cosme iphone os/2.0.2
- version/istyle @cosme iphone os/2.1
- version/istyle @cosme iphone os/2.1.1
- version/istyle @cosme iphone os/2.2
- version/istyle @cosme iphone os/2.2.1
- canonical/apple ipod touch