CVE-2009-1699

The XSL stylesheet implementation in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not…

published June 10, 2009

CVSS
—
EPSS
29%
Percentile
98.2
In the wild
Unconfirmed
What it is

The XSL stylesheet implementation in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not properly handle XML external entities, which allows remote attackers to read arbitrary files via a crafted DTD, as demonstrated by a file:///etc/passwd URL in an entity declaration, related to an "XXE attack."

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.29098 · 98.2th percentile
Published
2009-06-10T17:37Z
EPSS history
Timeline
  • 10 JUN 17:37Z
    The XSL stylesheet implementation in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not…
    cvelistv5