9.3

CVE-2009-1704

Exploit

CFNetwork in Apple Safari before 4.0 misinterprets downloaded image files as local HTML documents in unspecified circumstances, which allows remote attackers to execute arbitrary JavaScript code by placing it in an image file.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Apple ≫ Safari Editionmac Version <= 4.0_beta
Apple ≫ Safari Version0.8 Editionmac
Apple ≫ Safari Version0.9 Editionmac
Apple ≫ Safari Version1.0 Editionmac
Apple ≫ Safari Version1.0.3 Editionmac
Apple ≫ Safari Version1.1 Editionmac
Apple ≫ Safari Version1.2 Editionmac
Apple ≫ Safari Version1.3 Editionmac
Apple ≫ Safari Version1.3.1 Editionmac
Apple ≫ Safari Version1.3.2 Editionmac
Apple ≫ Safari Version2.0 Editionmac
Apple ≫ Safari Version2.0.2 Editionmac
Apple ≫ Safari Version2.0.4 Editionmac
Apple ≫ Safari Version3.0 Editionmac
Apple ≫ Safari Version3.0.2 Update- Editionmac
Apple ≫ Safari Version3.0.3 Editionmac
Apple ≫ Safari Version3.0.4 Editionmac
Apple ≫ Safari Version3.1 Editionmac
Apple ≫ Safari Version3.1.1 Editionmac
Apple ≫ Safari Version3.1.2 Editionmac
Apple ≫ Safari Version3.2.1 Editionmac
Apple ≫ Safari Version3.2.3 Editionmac
Apple ≫ Safari Editionwindows Version <= 3.2.3
Apple ≫ Safari Version3.0 Editionwindows
Apple ≫ Safari Version3.0.1 Editionwindows
Apple ≫ Safari Version3.0.2 Editionwindows
Apple ≫ Safari Version3.0.3 Editionwindows
Apple ≫ Safari Version3.0.4 Editionwindows
Apple ≫ Safari Version3.1 Editionwindows
Apple ≫ Safari Version3.1.1 Editionwindows
Apple ≫ Safari Version3.1.2 Editionwindows
Apple ≫ Safari Version3.2 Update- Editionwindows
Apple ≫ Safari Version3.2.1 Editionwindows
Apple ≫ Safari Version3.2.2 Editionwindows
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.36% 0.843
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.3 8.6 10
AV:N/AC:M/Au:N/C:C/I:C/A:C
CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

http://support.apple.com/kb/HT3613
Patch
Vendor Advisory