WebKit in Apple Safari before 4.0.2, as used on iPhone OS before 3.1, iPhone OS before 3.1.1 for iPod touch, and other platforms; KHTML in kdelibs in KDE; QtWebKit (aka Qt toolkit); and possibly other products do not properly handle numeric character references, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted HTML document.
CVSS Details
- CVSS 3.1 Base Score: 8.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Ios | — | Upgrade to the latest version of Apple iOS | Oct 8, 2014 | Jul 9, 2009 |
| Apple Safari | — | Upgrade to Apple Safari version 4.0.2Uninstall Apple Safari on Windows | Jan 5, 2012 | Jul 9, 2009 |
| Suse | — | Upgrade kdelibs3-32bitUpgrade libkdecore4-32bitUpgrade kdelibs3-x86Upgrade libkde4-32bitUpgrade libkdecore4-x86Upgrade libkde4Upgrade kdelibs3-default-styleUpgrade libkde4-x86Upgrade kdelibs3-default-style-32bitUpgrade libkdecore4Upgrade kdelibs4Upgrade kdelibs3Upgrade kdelibs4-coreUpgrade kdelibs3-default-style-x86 | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade libqt4-webkitUpgrade libwebkit-1.0-1-dbgUpgrade libwebkit-devUpgrade libwebkit-1.0-1 | Nov 8, 2024 | Jul 9, 2009 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub