PT-2009-2830 · Microsoft+1 · Windows Vista+3

Billy Rios + 2 · Publicado 2009-02-12 · Atualizado 2009-08-19 · CVE-2009-0137

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Safari versions in Apple Mac OS X 10.4.11 and 10.5.6 Safari versions in Windows XP and Vista

Description The issue is related to input validation problems, allowing remote attackers to execute arbitrary JavaScript in the local security zone via a crafted feed URL.

Recommendations For Safari versions in Apple Mac OS X 10.4.11 and 10.5.6: update to a version with improved input validation. For Safari versions in Windows XP and Vista: update to a version with improved input validation. As a temporary workaround, consider restricting the use of feed URLs to minimize the risk of exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2009-0137

Produtos afetados

Macos X

Safari

Windows Vista

Windows Xp

Referências · 4

• http://lists.apple.com/archives/security-announce/2009/Feb/msg00001.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-0137 · Nota de Segurança
• http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html · Aviso do Fabricante
• http://support.apple.com/kb/HT3438 · Nota