CVE-2009-1690

Use-after-free vulnerability in WebKit, as used in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, iPhone OS for iPod touch 1.1 through 2.2.1, Google…

published June 10, 2009

CVSS
—
EPSS
7%
Percentile
93.8
In the wild
Unconfirmed
What it is

⚠️ A crafty recursion issue in WebKit could lead to serious headaches! This use-after-free vulnerability lets remote attackers execute code or crash your app, and it sneaks into Safari, Chrome, and more. 😱 Think of it like a hotel staff mistakenly reusing a room key that was just returned; they might accidentally let a stranger into your room! This occurs when child elements are freed, yet still referenced in HTML, causing chaos during error handling. 🏨 An attacker could potentially execute arbitrary code or crash the application entirely, leading to a denial of service. Imagine visitors being locked out of their own rooms while a rogue intruder takes over! That could leave users frustrated and vulnerable. 😬

Put simply

Think of it like a hotel staff mistakenly reusing a room key that was just returned; they might accidentally let a stranger into your room! This occurs when child elements are freed, yet still referenced in HTML, causing chaos during error handling. 🏨 This use-after-free vulnerability occurs due to improper handling of memory in WebKit when certain HTML properties are set. It allows for child elements to be freed and potentially accessed later, which could lead to memory corruption during specific DOM event handling. ⚡

What to do

An attacker could potentially execute arbitrary code or crash the application entirely, leading to a denial of service. Imagine visitors being locked out of their own rooms while a rogue intruder takes over! That could leave users frustrated and vulnerable. 😬 To mitigate this risk, ensure that you're using updated versions of affected browsers like Safari and Chrome. Regularly check for updates to the WebKit engine, and consider implementing additional security measures to monitor for abnormal application behavior. 🛡️ You've got this! Keep your software up to date and you'll be one step closer to a more secure browsing experience! 🌟

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.06618 · 93.8th percentile
Published
2009-06-10T14:00Z
EPSS history
Timeline
  • 10 JUN 14:00Z
    Use-after-free vulnerability in WebKit, as used in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, iPhone OS for iPod touch 1.1 through 2.2.1, Google…
    cvelistv5