CVE-2009-1702 Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to inject arbitrary w...
MediumCVSS 4.3
EPSS 2.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to inject arbitrary web script or HTML via vectors related to improper handling of Location and History objects.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apple Safari | <= 3.2.2 | No fix listed |
| apple Safari | = 2.0 | No fix listed |
| apple Safari | = 2.0.0 | No fix listed |
| apple Safari | = 2.0.1 | No fix listed |
| apple Safari | = 2.0.2 | No fix listed |
| apple Safari | = 2.0.3 | No fix listed |
| apple Safari | = 2.0.3-417.8 | No fix listed |
| apple Safari | = 2.0.3-417.9 | No fix listed |
| apple Safari | = 2.0.3-417.9.2 | No fix listed |
| apple Safari | = 2.0.3-417.9.3 | No fix listed |
| apple Safari | = 2.0.4 | No fix listed |
| apple Safari | = 3.0 | No fix listed |
| apple Safari | = 3.0.0 | No fix listed |
| apple Safari | = 3.0.0b | No fix listed |
| apple Safari | = 3.0.1 | No fix listed |
| apple Safari | = 3.0.1-beta | No fix listed |
| apple Safari | = 3.0.1b | No fix listed |
| apple Safari | = 3.0.2 | No fix listed |
| apple Safari | = 3.0.2b | No fix listed |
| apple Safari | = 3.0.3 | No fix listed |
| apple Safari | = 3.0.3b | No fix listed |
| apple Safari | = 3.0.4 | No fix listed |
| apple Safari | = 3.0.4b | No fix listed |
| apple Safari | = 3.1.0 | No fix listed |
| apple Safari | = 3.1.0b | No fix listed |
Show 24 more
| Product | Affected versions | Fixed in |
|---|---|---|
| apple Safari | = 3.1.1 | No fix listed |
| apple Safari | = 3.1.2 | No fix listed |
| apple Safari | = 3.2.0 | No fix listed |
| apple Safari | = 3.2.1 | No fix listed |
| apple iphone os | = 1.0.0 | No fix listed |
| apple iphone os | = 1.0.1 | No fix listed |
| apple iphone os | = 1.0.2 | No fix listed |
| apple iphone os | = 1.1.0 | No fix listed |
| apple iphone os | = 1.1.1 | No fix listed |
| apple iphone os | = 1.1.2 | No fix listed |
| apple iphone os | = 1.1.3 | No fix listed |
| apple iphone os | = 1.1.4 | No fix listed |
| apple iphone os | = 1.1.5 | No fix listed |
| apple iphone os | = 2.0 | No fix listed |
| apple iphone os | = 2.0.0 | No fix listed |
| apple iphone os | = 2.0.1 | No fix listed |
| apple iphone os | = 2.0.2 | No fix listed |
| apple iphone os | = 2.1 | No fix listed |
| apple iphone os | = 2.1.1 | No fix listed |
| apple iphone os | = 2.2 | No fix listed |
| apple iphone os | = 2.2.1 | No fix listed |
| apple iphone os | All versions | No fix listed |
| apple ipod touch | All versions | No fix listed |
| debian/qt4-x11(Debian:10) | < 4:4.6.2-4 | 4:4.6.2-4 |
References
- APPLE-SA-2009-06-17-1 vendor-advisory
- APPLE-SA-2009-06-08-1 patch vendor-advisory
- SUSE-SR:2011:002 vendor-advisory
- 54993 vdb-entry
- 35379 third-party-advisory vendor-advisory
- 43068 third-party-advisory vendor-advisory
- 1022344 patch vdb-entry
- support.apple.com patch vendor-advisory
- support.apple.com
- 35260 exploit vdb-entry
- 35327 vdb-entry
- ADV-2009-1522 patch vdb-entry vendor-advisory
- ADV-2009-1621 vdb-entry vendor-advisory
- ADV-2011-0212 vdb-entry vendor-advisory