WebKit in Apple Safari before 4.0.2, as used on iPhone OS before 3.1, iPhone OS before 3.1.1 for iPod touch, and other platforms; KHTML in kdelibs in KDE; QtWebKit (aka Qt toolkit); and possibly other products do not properly handle numeric character references, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted HTML document.
CVSS Details
- CVSS 3.1 Base Score: 8.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Ios | — | Upgrade to the latest version of Apple iOS | Oct 8, 2014 | Jul 9, 2009 |
| Apple Safari | — | Upgrade to Apple Safari version 4.0.2Uninstall Apple Safari on Windows | Jan 5, 2012 | Jul 9, 2009 |
| Suse | — | Upgrade kdelibs3-default-style-32bitUpgrade kdelibs4-coreUpgrade libkde4-x86Upgrade libkdecore4-x86Upgrade kdelibs4Upgrade kdelibs3-default-style-x86Upgrade kdelibs3Upgrade libkde4Upgrade kdelibs3-default-styleUpgrade libkdecore4Upgrade kdelibs3-x86Upgrade libkdecore4-32bitUpgrade kdelibs3-32bitUpgrade libkde4-32bit | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade libwebkit-devUpgrade libwebkit-1.0-1-dbgUpgrade libqt4-webkitUpgrade libwebkit-1.0-1 | Nov 8, 2024 | Jul 9, 2009 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub