NetSight
IP …
high7.5Public exploit code

CVE-2009-1699

The XSL stylesheet implementation in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not pr…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

The XSL stylesheet implementation in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not properly handle XML external entities, which allows remote attackers to read arbitrary files via a crafted DTD, as demonstrated by a file:///etc/passwd URL in an entity declaration, related to an "XXE attack."

Affected products

VendorProductAffected versions
AppleSafari
before 4.0
AppleIphone Os
from 1.0.0 through 2.2.1
CanonicalUbuntu Linux
Versions 8.10, 9.04
OpensuseOpensuse
Versions 11.2, 11.3

Weakness classification

CWE-611

References