RCE in Apple Safari
CVE-2009-1704
CFNetwork in Apple Safari before 4.0 misinterprets downloaded image files as local HTML documents in unspecified circumstances, which allows remote attackers to execute arbitrary JavaScript code by placing it in an image file.
Vulnerability class: RCE (Remote Code Execution)
EPSS: 0.025 (83.4th percentile) — read the EPSS interpretation.
Affected products
- Apple Safari — versions 0.8, 0.9, 1.0
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (vdb-entry, x_refsource_BID)
- cve@mitre.org (vendor-advisory, x_refsource_APPLE, Patch, Vendor Advisory)
- cve@mitre.org (Exploit, vdb-entry, x_refsource_BID)
- cve@mitre.org (Patch, vdb-entry, x_refsource_SECTRACK)
- cve@mitre.org (Patch, vdb-entry, x_refsource_VUPEN, Vendor Advisory)
- cve@mitre.org (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
- cve@mitre.org (x_refsource_CONFIRM, Patch, Vendor Advisory)
- cve@mitre.org (x_refsource_OSVDB, vdb-entry)