CVE-2009-1713
En bref
- Source
- NVD
- EPSS
- EPSS 2.05 % · centile 81 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- mitre
- Statut NVD
- Modified
Rechercher sur…
Description
The XSLT functionality in WebKit in Apple Safari before 4.0 does not properly implement the document function, which allows remote attackers to read (1) arbitrary local files and (2) files from different security zones via unspecified vectors.
Faiblesses (CWE)
- CWE-200 — Exposition d'informations sensibles à un acteur non autorisé
Références
- http://secunia.com/advisories/43068
- http://www.vupen.com/english/advisories/2011/0212
- http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/51267
- http://www.securityfocus.com/bid/35260
- http://osvdb.org/54975
- http://www.vupen.com/english/advisories/2009/1522
- http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
- http://secunia.com/advisories/35379
- http://www.ubuntu.com/usn/USN-857-1
- http://support.apple.com/kb/HT3613
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 2.0 | HIGH 7.1 | AV:N/AC:M/Au:N/C:C/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2009-1708
- GCVE · GCVE-0-2009-1713
Avis du CERT-FR
- CERTA-2009-AVI-223 — Multiples vulnérabilités dans Apple Safari · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:apple:safari:*:*:mac:*:*:*:*:*≤ 4.0_betacpe:2.3:a:apple:safari:0.8:*:mac:*:*:*:*:*cpe:2.3:a:apple:safari:0.9:*:mac:*:*:*:*:*cpe:2.3:a:apple:safari:1.0:*:mac:*:*:*:*:*cpe:2.3:a:apple:safari:1.0.3:*:mac:*:*:*:*:*cpe:2.3:a:apple:safari:1.1:*:mac:*:*:*:*:*cpe:2.3:a:apple:safari:1.2:*:mac:*:*:*:*:*cpe:2.3:a:apple:safari:1.3:*:mac:*:*:*:*:*cpe:2.3:a:apple:safari:1.3.1:*:mac:*:*:*:*:*cpe:2.3:a:apple:safari:1.3.2:*:mac:*:*:*:*:*cpe:2.3:a:apple:safari:2.0:*:mac:*:*:*:*:*cpe:2.3:a:apple:safari:2.0.2:*:mac:*:*:*:*:*cpe:2.3:a:apple:safari:2.0.4:*:mac:*:*:*:*:*cpe:2.3:a:apple:safari:3.0:*:mac:*:*:*:*:*cpe:2.3:a:apple:safari:3.0.2:-:mac:*:*:*:*:*cpe:2.3:a:apple:safari:3.0.3:*:mac:*:*:*:*:*cpe:2.3:a:apple:safari:3.0.4:*:mac:*:*:*:*:*cpe:2.3:a:apple:safari:3.1:*:mac:*:*:*:*:*cpe:2.3:a:apple:safari:3.1.1:*:mac:*:*:*:*:*cpe:2.3:a:apple:safari:3.1.2:*:mac:*:*:*:*:*cpe:2.3:a:apple:safari:3.2.1:*:mac:*:*:*:*:*cpe:2.3:a:apple:safari:3.2.3:*:mac:*:*:*:*:*cpe:2.3:a:apple:safari:*:*:windows:*:*:*:*:*≤ 3.2.3cpe:2.3:a:apple:safari:3.0:*:windows:*:*:*:*:*cpe:2.3:a:apple:safari:3.0.1:*:windows:*:*:*:*:*cpe:2.3:a:apple:safari:3.0.2:*:windows:*:*:*:*:*cpe:2.3:a:apple:safari:3.0.3:*:windows:*:*:*:*:*cpe:2.3:a:apple:safari:3.0.4:*:windows:*:*:*:*:*cpe:2.3:a:apple:safari:3.1:*:windows:*:*:*:*:*cpe:2.3:a:apple:safari:3.1.1:*:windows:*:*:*:*:*cpe:2.3:a:apple:safari:3.1.2:*:windows:*:*:*:*:*cpe:2.3:a:apple:safari:3.2:-:windows:*:*:*:*:*cpe:2.3:a:apple:safari:3.2.1:*:windows:*:*:*:*:*cpe:2.3:a:apple:safari:3.2.2:*:windows:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |