var-200902-0472
Vulnerability from variot
Multiple unspecified vulnerabilities in Safari RSS in Apple Mac OS X 10.4.11 and 10.5.6, and Windows XP and Vista, allow remote attackers to execute arbitrary JavaScript in the local security zone via a crafted feed: URL, related to "input validation issues.". Safari RSS Has a feed URL In the local security zone. JavaScript There is a vulnerability that is executed.Any remote attacker JavaScript May be executed. Apple Safari is prone to multiple input-validation vulnerabilities. An attacker can exploit these issues by enticing an unsuspecting victim to visit a malicious website. Successfully exploiting these issues will allow the attacker to execute arbitrary JavaScript code in the local security zone. This may allow the attacker to obtain sensitive information that can aid in further attacks; other consequences may also occur. These issues affect versions prior to Safari 3.2.2 for Windows. NOTE: This BID was previously titled 'Apple Safari RSS Feed Information Disclosure Vulnerability', but has been updated to reflect new information. Mac OS X is the operating system used by the Apple family of machines
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", "affected_products": { "@id": "https://www.variotdbs.pl/ref/affected_products" }, "configurations": { "@id": "https://www.variotdbs.pl/ref/configurations" }, "credits": { "@id": "https://www.variotdbs.pl/ref/credits" }, "cvss": { "@id": "https://www.variotdbs.pl/ref/cvss/" }, "description": { "@id": "https://www.variotdbs.pl/ref/description/" }, "exploit_availability": { "@id": "https://www.variotdbs.pl/ref/exploit_availability/" }, "external_ids": { "@id": "https://www.variotdbs.pl/ref/external_ids/" }, "iot": { "@id": "https://www.variotdbs.pl/ref/iot/" }, "iot_taxonomy": { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/" }, "patch": { "@id": "https://www.variotdbs.pl/ref/patch/" }, "problemtype_data": { "@id": "https://www.variotdbs.pl/ref/problemtype_data/" }, "references": { "@id": "https://www.variotdbs.pl/ref/references/" }, "sources": { "@id": "https://www.variotdbs.pl/ref/sources/" }, "sources_release_date": { "@id": "https://www.variotdbs.pl/ref/sources_release_date/" }, "sources_update_date": { "@id": "https://www.variotdbs.pl/ref/sources_update_date/" }, "threat_type": { "@id": "https://www.variotdbs.pl/ref/threat_type/" }, "title": { "@id": "https://www.variotdbs.pl/ref/title/" }, "type": { "@id": "https://www.variotdbs.pl/ref/type/" } }, "@id": "https://www.variotdbs.pl/vuln/VAR-200902-0472", "affected_products": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "model": "safari", "scope": "eq", "trust": 1.0, "vendor": "apple", "version": "*" }, { "model": "mac os x", "scope": "eq", "trust": 0.8, "vendor": "apple", "version": "v10.4.11" }, { "model": "mac os x", "scope": "eq", "trust": 0.8, "vendor": "apple", "version": "v10.5.6" }, { "model": "mac os x server", "scope": "eq", "trust": 0.8, "vendor": "apple", "version": "v10.4.11" }, { "model": "mac os x server", "scope": "eq", "trust": 0.8, "vendor": "apple", "version": "v10.5.6" }, { "model": "safari", "scope": "lt", "trust": 0.8, "vendor": "apple", "version": "3.2.2" }, { "model": "safari", "scope": null, "trust": 0.6, "vendor": "apple", "version": null }, { "model": "safari for windows", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "3.2.1" }, { "model": "safari for windows", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "3.1.2" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "3.1.2" }, { "model": "safari for windows", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "3.1.1" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "3.1.1" }, { "model": "safari beta for windows", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "3.0.4" }, { "model": "safari beta for windows", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "3.0.3" }, { "model": "safari beta", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "3.0.3" }, { "model": "safari beta for windows", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "3.0.2" }, { "model": "safari beta", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "3.0.2" }, { "model": "safari beta for windows", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "3.0.1" }, { "model": "safari beta", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "3.0.1" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "3.2" }, { "model": "safari for windows", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "3.1" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "3.1" }, { "model": "safari beta for windows", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "3" }, { "model": "safari beta", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "3" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "3" }, { "model": "mac os server", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.5.6" }, { "model": "mac os server", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.5.5" }, { "model": "mac os server", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.5.4" }, { "model": "mac os server", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.5.3" }, { "model": "mac os server", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.5.2" }, { "model": "mac os server", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.5.1" }, { "model": "mac os server", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.4.11" }, { "model": "mac os server", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.4.10" }, { "model": "mac os server", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.4.9" }, { "model": "mac os server", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.4.8" }, { "model": "mac os server", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.4.7" }, { "model": "mac os server", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.4.6" }, { "model": "mac os server", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.4.5" }, { "model": "mac os server", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.4.4" }, { "model": "mac os server", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.4.3" }, { "model": "mac os server", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.4.2" }, { "model": "mac os server", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.4.1" }, { "model": "mac os server", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.4" }, { "model": "mac os server", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.5" }, { "model": "mac os", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.5.6" }, { "model": "mac os", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.5.5" }, { "model": "mac os", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.5.4" }, { "model": "mac os", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.5.3" }, { "model": "mac os", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.5.2" }, { "model": "mac os", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.5.1" }, { "model": "mac os", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.4.11" }, { "model": "mac os", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.4.10" }, { "model": "mac os", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.4.9" }, { "model": "mac os", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.4.8" }, { "model": "mac os", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.4.7" }, { "model": "mac os", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.4.6" }, { "model": "mac os", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.4.5" }, { "model": "mac os", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.4.4" }, { "model": "mac os", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.4.3" }, { "model": "mac os", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.4.2" }, { "model": "mac os", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.4.1" }, { "model": "mac os", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.4" }, { "model": "mac os", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.5" }, { "model": "safari for windows", "scope": "ne", "trust": 0.3, "vendor": "apple", "version": "3.2.2" } ], "sources": [ { "db": "BID", "id": "33234" }, { "db": "JVNDB", "id": "JVNDB-2009-001081" }, { "db": "CNNVD", "id": "CNNVD-200902-314" }, { "db": "NVD", "id": "CVE-2009-0137" } ] }, "configurations": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", "children": { "@container": "@list" }, "cpe_match": { "@container": "@list" }, "data": { "@container": "@list" }, "nodes": { "@container": "@list" } }, "data": [ { "CVE_data_version": "4.0", "nodes": [ { "cpe_match": [ { "cpe22Uri": "cpe:/o:apple:mac_os_x", "vulnerable": true }, { "cpe22Uri": "cpe:/o:apple:mac_os_x_server", "vulnerable": true }, { "cpe22Uri": "cpe:/a:apple:safari", "vulnerable": true } ], "operator": "OR" } ] } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2009-001081" } ] }, "credits": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Graham PerrinClint RuohoBilly Rios", "sources": [ { "db": "CNNVD", "id": "CNNVD-200902-314" } ], "trust": 0.6 }, "cve": "CVE-2009-0137", "cvss": { "@context": { "cvssV2": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2" }, "cvssV3": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/" }, "severity": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#" }, "@id": "https://www.variotdbs.pl/ref/cvss/severity" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "cvssV2": [ { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "author": "nvd@nist.gov", "availabilityImpact": "COMPLETE", "baseScore": 10.0, "confidentialityImpact": "COMPLETE", "exploitabilityScore": 10.0, "id": "CVE-2009-0137", "impactScore": 10.0, "integrityImpact": "COMPLETE", "severity": "HIGH", "trust": 1.8, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0" }, { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "author": "VULHUB", "availabilityImpact": "COMPLETE", "baseScore": 10.0, "confidentialityImpact": "COMPLETE", "exploitabilityScore": 10.0, "id": "VHN-37583", "impactScore": 10.0, "integrityImpact": "COMPLETE", "severity": "HIGH", "trust": 0.1, "vectorString": "AV:N/AC:L/AU:N/C:C/I:C/A:C", "version": "2.0" } ], "cvssV3": [], "severity": [ { "author": "nvd@nist.gov", "id": "CVE-2009-0137", "trust": 1.0, "value": "HIGH" }, { "author": "NVD", "id": "CVE-2009-0137", "trust": 0.8, "value": "High" }, { "author": "CNNVD", "id": "CNNVD-200902-314", "trust": 0.6, "value": "CRITICAL" }, { "author": "VULHUB", "id": "VHN-37583", "trust": 0.1, "value": "HIGH" } ] } ], "sources": [ { "db": "VULHUB", "id": "VHN-37583" }, { "db": "JVNDB", "id": "JVNDB-2009-001081" }, { "db": "CNNVD", "id": "CNNVD-200902-314" }, { "db": "NVD", "id": "CVE-2009-0137" } ] }, "description": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Multiple unspecified vulnerabilities in Safari RSS in Apple Mac OS X 10.4.11 and 10.5.6, and Windows XP and Vista, allow remote attackers to execute arbitrary JavaScript in the local security zone via a crafted feed: URL, related to \"input validation issues.\". Safari RSS Has a feed URL In the local security zone. JavaScript There is a vulnerability that is executed.Any remote attacker JavaScript May be executed. Apple Safari is prone to multiple input-validation vulnerabilities. \nAn attacker can exploit these issues by enticing an unsuspecting victim to visit a malicious website. \nSuccessfully exploiting these issues will allow the attacker to execute arbitrary JavaScript code in the local security zone. This may allow the attacker to obtain sensitive information that can aid in further attacks; other consequences may also occur. \nThese issues affect versions prior to Safari 3.2.2 for Windows. \nNOTE: This BID was previously titled \u0027Apple Safari RSS Feed Information Disclosure Vulnerability\u0027, but has been updated to reflect new information. Mac OS X is the operating system used by the Apple family of machines", "sources": [ { "db": "NVD", "id": "CVE-2009-0137" }, { "db": "JVNDB", "id": "JVNDB-2009-001081" }, { "db": "BID", "id": "33234" }, { "db": "VULHUB", "id": "VHN-37583" } ], "trust": 1.98 }, "external_ids": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "db": "NVD", "id": "CVE-2009-0137", "trust": 2.8 }, { "db": "JVNDB", "id": "JVNDB-2009-001081", "trust": 0.8 }, { "db": "APPLE", "id": "APPLE-SA-2009-02-12", "trust": 0.6 }, { "db": "CNNVD", "id": "CNNVD-200902-314", "trust": 0.6 }, { "db": "BID", "id": "33234", "trust": 0.3 }, { "db": "VULHUB", "id": "VHN-37583", "trust": 0.1 } ], "sources": [ { "db": "VULHUB", "id": "VHN-37583" }, { "db": "BID", "id": "33234" }, { "db": "JVNDB", "id": "JVNDB-2009-001081" }, { "db": "CNNVD", "id": "CNNVD-200902-314" }, { "db": "NVD", "id": "CVE-2009-0137" } ] }, "id": "VAR-200902-0472", "iot": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": true, "sources": [ { "db": "VULHUB", "id": "VHN-37583" } ], "trust": 0.01 }, "last_update_date": "2024-11-23T20:23:39.811000Z", "patch": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "title": "HT3438", "trust": 0.8, "url": "http://support.apple.com/kb/HT3438" }, { "title": "HT3439", "trust": 0.8, "url": "http://support.apple.com/kb/HT3439" }, { "title": "HT3439", "trust": 0.8, "url": "http://support.apple.com/kb/HT3439?viewlocale=ja_JP" }, { "title": "HT3438", "trust": 0.8, "url": "http://support.apple.com/kb/HT3438?viewlocale=ja_JP" } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2009-001081" } ] }, "problemtype_data": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "problemtype": "CWE-20", "trust": 1.9 } ], "sources": [ { "db": "VULHUB", "id": "VHN-37583" }, { "db": "JVNDB", "id": "JVNDB-2009-001081" }, { "db": "NVD", "id": "CVE-2009-0137" } ] }, "references": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "trust": 2.0, "url": "http://support.apple.com/kb/ht3438" }, { "trust": 1.7, "url": "http://lists.apple.com/archives/security-announce/2009/feb/msg00000.html" }, { "trust": 1.7, "url": "http://lists.apple.com/archives/security-announce/2009/feb/msg00001.html" }, { "trust": 0.8, "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2009-0137" }, { "trust": 0.8, "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2009-0137" }, { "trust": 0.3, "url": "http://brian.mastenbrook.net/display/27" }, { "trust": 0.3, "url": "http://www.apple.com/safari/" } ], "sources": [ { "db": "VULHUB", "id": "VHN-37583" }, { "db": "BID", "id": "33234" }, { "db": "JVNDB", "id": "JVNDB-2009-001081" }, { "db": "CNNVD", "id": "CNNVD-200902-314" }, { "db": "NVD", "id": "CVE-2009-0137" } ] }, "sources": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", "data": { "@container": "@list" } }, "data": [ { "db": "VULHUB", "id": "VHN-37583" }, { "db": "BID", "id": "33234" }, { "db": "JVNDB", "id": "JVNDB-2009-001081" }, { "db": "CNNVD", "id": "CNNVD-200902-314" }, { "db": "NVD", "id": "CVE-2009-0137" } ] }, "sources_release_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2009-02-13T00:00:00", "db": "VULHUB", "id": "VHN-37583" }, { "date": "2009-01-11T00:00:00", "db": "BID", "id": "33234" }, { "date": "2009-03-18T00:00:00", "db": "JVNDB", "id": "JVNDB-2009-001081" }, { "date": "2009-02-13T00:00:00", "db": "CNNVD", "id": "CNNVD-200902-314" }, { "date": "2009-02-13T00:30:05", "db": "NVD", "id": "CVE-2009-0137" } ] }, "sources_update_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2009-08-19T00:00:00", "db": "VULHUB", "id": "VHN-37583" }, { "date": "2016-07-06T14:18:00", "db": "BID", "id": "33234" }, { "date": "2009-03-18T00:00:00", "db": "JVNDB", "id": "JVNDB-2009-001081" }, { "date": "2009-02-13T00:00:00", "db": "CNNVD", "id": "CNNVD-200902-314" }, { "date": "2024-11-21T00:59:08.640000", "db": "NVD", "id": "CVE-2009-0137" } ] }, "threat_type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "remote", "sources": [ { "db": "CNNVD", "id": "CNNVD-200902-314" } ], "trust": 0.6 }, "title": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Safari RSS In any JavaScript Vulnerability to be executed", "sources": [ { "db": "JVNDB", "id": "JVNDB-2009-001081" } ], "trust": 0.8 }, "type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "input validation", "sources": [ { "db": "CNNVD", "id": "CNNVD-200902-314" } ], "trust": 0.6 } }
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.