CVE-2009-1698

2009-06-1000:00:00

ubuntu.com

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.035 Low

EPSS

Percentile

91.5%

JSON

WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone
OS for iPod touch 1.1 through 2.2.1 does not initialize a pointer during
handling of a Cascading Style Sheets (CSS) attr function call with a large
numerical argument, which allows remote attackers to execute arbitrary code
or cause a denial of service (memory corruption and application crash) via
a crafted HTML document.

Bugs

Notes

Author	Note
jdstrand	webkit is a fork of khtml from kdelibs. kdelibs5 is farther from it, while qt4-x11 attempts to unify khtml and webkit
mdeslaur	reproducer: http://trac.webkit.org/browser/trunk/LayoutTests/fast/css/attr-parsing.html?rev=42081&format=txt expected results: http://trac.webkit.org/browser/trunk/LayoutTests/fast/css/attr-parsing-expected.txt?rev=42081&format=txt

OSVersionArchitecturePackageVersionFilename
ubuntu8.10noarchkde4libs< 4:4.1.4-0ubuntu1~intrepid1.2UNKNOWN
ubuntu9.04noarchkde4libs< 4:4.2.2-0ubuntu5.1UNKNOWN
ubuntu8.04noarchkdelibs< 4:3.5.10-0ubuntu1~hardy1.2UNKNOWN
ubuntu8.10noarchkdelibs< 4:3.5.10-0ubuntu6.1UNKNOWN
ubuntu9.04noarchkdelibs< 4:3.5.10.dfsg.1-1ubuntu8.1UNKNOWN
ubuntu9.10noarchkdelibs< 4:3.5.10.dfsg.1-2ubuntu5UNKNOWN
ubuntu10.04noarchkdelibs< 4:3.5.10.dfsg.1-2ubuntu5UNKNOWN
ubuntu10.10noarchkdelibs< 4:3.5.10.dfsg.1-2ubuntu5UNKNOWN
ubuntu11.04noarchkdelibs< 4:3.5.10.dfsg.1-2ubuntu5UNKNOWN
ubuntu8.10noarchqt4-x11< 4.4.3-0ubuntu1.4UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	8.10	noarch	kde4libs	< 4:4.1.4-0ubuntu1~intrepid1.2	UNKNOWN
ubuntu	9.04	noarch	kde4libs	< 4:4.2.2-0ubuntu5.1	UNKNOWN
ubuntu	8.04	noarch	kdelibs	< 4:3.5.10-0ubuntu1~hardy1.2	UNKNOWN
ubuntu	8.10	noarch	kdelibs	< 4:3.5.10-0ubuntu6.1	UNKNOWN
ubuntu	9.04	noarch	kdelibs	< 4:3.5.10.dfsg.1-1ubuntu8.1	UNKNOWN
ubuntu	9.10	noarch	kdelibs	< 4:3.5.10.dfsg.1-2ubuntu5	UNKNOWN
ubuntu	10.04	noarch	kdelibs	< 4:3.5.10.dfsg.1-2ubuntu5	UNKNOWN
ubuntu	10.10	noarch	kdelibs	< 4:3.5.10.dfsg.1-2ubuntu5	UNKNOWN
ubuntu	11.04	noarch	kdelibs	< 4:3.5.10.dfsg.1-2ubuntu5	UNKNOWN
ubuntu	8.10	noarch	qt4-x11	< 4.4.3-0ubuntu1.4	UNKNOWN