CVE-2009-2066: Medium severity Safari vulnerability

Q: What is the severity of CVE-2009-2066?

CVE-2009-2066 is classified as a moderate severity vulnerability.

Q: How do I fix CVE-2009-2066?

To mitigate CVE-2009-2066, users should upgrade to a patched version of Apple Safari.

Q: What is CVE-2009-2066?

CVE-2009-2066 is a vulnerability in Apple Safari that allows potential man-in-the-middle attacks due to improper handling of mixed content.

Q: Which versions of Apple Safari are affected by CVE-2009-2066?

CVE-2009-2066 affects multiple versions of Apple Safari including versions 1.0 through 3.2.

Q: What types of attacks can exploit CVE-2009-2066?

CVE-2009-2066 can be exploited to execute arbitrary web scripts in the context of an HTTPS site via mixed content.

Published Jun 15, 2009

Updated

Apple Safari detects http content in https web pages only when the top-level frame uses https, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying an http page to include an https iframe that references a script file on an http site, related to "HTTP-Intended-but-HTTPS-Loadable (HPIHSL) pages."

Affected Software

66 affected components

Safari=3.0.4b

Safari=1.3.0

Safari=1.0.3-85.8

Safari=2.0.3-417.9.3

Safari=1.3.2

Safari=2

Safari=1.1.1

Safari=3.0.4

Safari=1.2.2

Safari=3.0.1-beta

Safari=2.0.1

Safari=2.0.3

Safari=1.0.3

Safari=2.0.2

Safari=1.0.2

Safari=3.0.0

Safari=3.0.1

Safari=3.0.2

Safari=1.0

Safari=2.0.4_419.3

Safari=3.0.3b

Safari=3.1.1

Safari=1.3

Safari=3.1

Safari=2.0.3-417.9

Safari=1.2.5

Safari=2.0.3-417.9.2

Safari=3.2

Safari=3.0.3

Safari=2.0

Safari=1.2.4

Safari=1.0.1

Safari<=3.2.1

Safari=2.0.3-417.8

Safari=3.1.2

Safari=1.2.1

Safari=3.1.0b

Safari=1.0.3-85.8.1

Safari=3.1.0

Safari=1.0-beta

Safari=0.8

Safari=2.0.4

Safari=1.0-beta2

Safari=1.1

Safari=1.3.2-312.5

Safari=3.0.0b

Safari=1.3.1

Safari=2.0.0

Safari=3.2.0

Safari=1.1.0

Safari=3.0.2b

Safari=1.2

Safari=1.2.0

Safari=3.0.1b

Safari=2.0_pre

Safari=1.0.0b1

Safari=3.0

Safari=3.0.4_beta

Safari=3.0.3-522.15.5

Safari=2.0.3_417.9.3

Safari=1.0.0

Safari=1.2.3

Safari=1.3.2-312.6

Safari=3

Safari=1.0.0b2

Safari=0.9

Event History

Jun 15, 2009

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2009-2066?

CVE-2009-2066 is classified as a moderate severity vulnerability.

How do I fix CVE-2009-2066?

To mitigate CVE-2009-2066, users should upgrade to a patched version of Apple Safari.

What is CVE-2009-2066?