CFNetwork in Apple Safari before 4.0 misinterprets downloaded image files as local HTML documents in unspecified circumstances, which allows remote attackers to execute arbitrary JavaScript code by placing it in an image file.
References
| Link | Resource |
|---|---|
| http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html | Patch Vendor Advisory |
| http://osvdb.org/55010 | |
| http://secunia.com/advisories/35379 | Vendor Advisory |
| http://securitytracker.com/id?1022343 | Patch |
| http://support.apple.com/kb/HT3613 | Patch Vendor Advisory |
| http://www.securityfocus.com/bid/35260 | Exploit |
| http://www.securityfocus.com/bid/35344 | |
| http://www.vupen.com/english/advisories/2009/1522 | Patch Vendor Advisory |
| http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html | Patch Vendor Advisory |
| http://osvdb.org/55010 | |
| http://secunia.com/advisories/35379 | Vendor Advisory |
| http://securitytracker.com/id?1022343 | Patch |
| http://support.apple.com/kb/HT3613 | Patch Vendor Advisory |
| http://www.securityfocus.com/bid/35260 | Exploit |
| http://www.securityfocus.com/bid/35344 | |
| http://www.vupen.com/english/advisories/2009/1522 | Patch Vendor Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
No history.
Information
Published : 2009-06-10 18:00
Updated : 2025-04-09 00:30
NVD link : CVE-2009-1704
Mitre link : CVE-2009-1704
CVE.ORG link : CVE-2009-1704
JSON object : View
Products Affected
apple
- safari
CWE
CWE-94
Improper Control of Generation of Code ('Code Injection')