The XSL stylesheet implementation in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not properly handle XML external entities, which allows remote attackers to read arbitrary files via a crafted DTD, as demonstrated by a file:///etc/passwd URL in an entity declaration, related to an "XXE attack."
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Ios | — | Upgrade to the latest version of Apple iOS | Oct 8, 2014 | Jun 10, 2009 |
| Apple Safari | — | Uninstall Apple Safari on WindowsUpgrade to Apple Safari version 4.0 | Jan 5, 2012 | Jun 10, 2009 |
| Suse | — | Upgrade libwebkit-develUpgrade libwebkit-1_0-2-32bitUpgrade libwebkit-langUpgrade webkit-jscUpgrade libwebkit-1_0-2 | Feb 17, 2015 | Jun 10, 2009 |
| Ubuntu | — | Upgrade libqt4-webkit | Nov 8, 2024 | Jun 10, 2009 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub