CVE-2009-1705

2009-06-1018:00:00

CWE-189

[email protected]

web.nvd.nist.gov

coregraphics

apple safari

windows

arbitrary code execution

denial of service

font data

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

7.9 High

AI Score

Confidence

High

0.028 Low

EPSS

Percentile

90.8%

JSON

CoreGraphics in Apple Safari before 4.0 on Windows does not properly use arithmetic during automatic hinting of TrueType fonts, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via crafted font data.

Affected configurations

NVD

Node

applesafariRange≤3.2.3-windows

applesafariMatch3.0-windows

applesafariMatch3.0.1-windows

applesafariMatch3.0.2-windows

applesafariMatch3.0.3-windows

applesafariMatch3.0.4-windows

applesafariMatch3.1-windows

applesafariMatch3.1.1-windows

applesafariMatch3.1.2-windows

applesafariMatch3.2-windows

applesafariMatch3.2.1-windows

applesafariMatch3.2.2-windows

CPENameOperatorVersion
apple:safariapple safarile3.2.3
apple:safariapple safarieq3.0
apple:safariapple safarieq3.0.1
apple:safariapple safarieq3.0.2
apple:safariapple safarieq3.0.3
apple:safariapple safarieq3.0.4
apple:safariapple safarieq3.1
apple:safariapple safarieq3.1.1
apple:safariapple safarieq3.1.2
apple:safariapple safarieq3.2

CPE	Name	Operator	Version
apple:safari	apple safari	le	3.2.3
apple:safari	apple safari	eq	3.0
apple:safari	apple safari	eq	3.0.1
apple:safari	apple safari	eq	3.0.2
apple:safari	apple safari	eq	3.0.3
apple:safari	apple safari	eq	3.0.4
apple:safari	apple safari	eq	3.1
apple:safari	apple safari	eq	3.1.1
apple:safari	apple safari	eq	3.1.2
apple:safari	apple safari	eq	3.2