PT-2009-2830 · Microsoft+1 · Windows Vista+3

Billy Rios + 2 · Published 2009-02-12 · Updated 2009-08-19 · CVE-2009-0137

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Safari versions in Apple Mac OS X 10.4.11 and 10.5.6 Safari versions in Windows XP and Vista

Description The issue is related to input validation problems, allowing remote attackers to execute arbitrary JavaScript in the local security zone via a crafted feed URL.

Recommendations For Safari versions in Apple Mac OS X 10.4.11 and 10.5.6: update to a version with improved input validation. For Safari versions in Windows XP and Vista: update to a version with improved input validation. As a temporary workaround, consider restricting the use of feed URLs to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2009-0137

Affected Products

Macos X

Safari

Windows Vista

Windows Xp

References · 4

• http://lists.apple.com/archives/security-announce/2009/Feb/msg00001.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-0137 · Security Note
• http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html · Vendor Advisory
• http://support.apple.com/kb/HT3438 · Note