PT-2009-4185 · Apple · Coregraphics+1

Clint Ruoho + 1 · Published 2009-06-10 · Updated 2009-06-13 · CVE-2009-1705

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Apple Safari version 3.x and earlier on Windows

Description: The issue is related to the CoreGraphics component in Apple Safari, which does not properly handle arithmetic during automatic hinting of TrueType fonts. This can be exploited by remote attackers using crafted font data, potentially leading to the execution of arbitrary code or causing a denial of service due to memory corruption and application crash.

Recommendations: For Apple Safari version 3.x and earlier on Windows, update to version 4.0 or later to resolve the issue.

Exploit

Fix

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2009-1705

Affected Products

Coregraphics

Safari

References · 8

• 🔥 http://securityfocus.com/bid/35260 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-1705 · Security Note
• http://secunia.com/advisories/35379 · Vendor Advisory
• http://support.apple.com/kb/HT3613 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html · Vendor Advisory
• http://vupen.com/english/advisories/2009/1522 · Vendor Advisory
• http://securityfocus.com/bid/35308 · Note
• http://osvdb.org/54974 · Note