7.1

CVE-2009-1713

Exploit
The XSLT functionality in WebKit in Apple Safari before 4.0 does not properly implement the document function, which allows remote attackers to read (1) arbitrary local files and (2) files from different security zones via unspecified vectors.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Apple ≫ Safari Editionmac Version <= 4.0_beta
Apple ≫ Safari Version0.8 Editionmac
Apple ≫ Safari Version0.9 Editionmac
Apple ≫ Safari Version1.0 Editionmac
Apple ≫ Safari Version1.0.3 Editionmac
Apple ≫ Safari Version1.1 Editionmac
Apple ≫ Safari Version1.2 Editionmac
Apple ≫ Safari Version1.3 Editionmac
Apple ≫ Safari Version1.3.1 Editionmac
Apple ≫ Safari Version1.3.2 Editionmac
Apple ≫ Safari Version2.0 Editionmac
Apple ≫ Safari Version2.0.2 Editionmac
Apple ≫ Safari Version2.0.4 Editionmac
Apple ≫ Safari Version3.0 Editionmac
Apple ≫ Safari Version3.0.2 Update- Editionmac
Apple ≫ Safari Version3.0.3 Editionmac
Apple ≫ Safari Version3.0.4 Editionmac
Apple ≫ Safari Version3.1 Editionmac
Apple ≫ Safari Version3.1.1 Editionmac
Apple ≫ Safari Version3.1.2 Editionmac
Apple ≫ Safari Version3.2.1 Editionmac
Apple ≫ Safari Version3.2.3 Editionmac
Apple ≫ Safari Editionwindows Version <= 3.2.3
Apple ≫ Safari Version3.0 Editionwindows
Apple ≫ Safari Version3.0.1 Editionwindows
Apple ≫ Safari Version3.0.2 Editionwindows
Apple ≫ Safari Version3.0.3 Editionwindows
Apple ≫ Safari Version3.0.4 Editionwindows
Apple ≫ Safari Version3.1 Editionwindows
Apple ≫ Safari Version3.1.1 Editionwindows
Apple ≫ Safari Version3.1.2 Editionwindows
Apple ≫ Safari Version3.2 Update- Editionwindows
Apple ≫ Safari Version3.2.1 Editionwindows
Apple ≫ Safari Version3.2.2 Editionwindows
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.05% 0.788
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.1 8.6 6.9
AV:N/AC:M/Au:N/C:C/I:N/A:N
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html
Patch
Vendor Advisory
http://secunia.com/advisories/35379
Vendor Advisory
http://support.apple.com/kb/HT3613
Patch
Vendor Advisory
http://www.vupen.com/english/advisories/2009/1522
Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
http://secunia.com/advisories/43068
http://www.vupen.com/english/advisories/2011/0212
http://www.ubuntu.com/usn/USN-857-1
http://www.securityfocus.com/bid/35260
Exploit
http://osvdb.org/54975
https://exchange.xforce.ibmcloud.com/vulnerabilities/51267