Unrated severityNVD Advisory· Published Jun 10, 2009· Updated Jun 16, 2026
CVE-2009-1698
CVE-2009-1698
Description
WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not initialize a pointer during handling of a Cascading Style Sheets (CSS) attr function call with a large numerical argument, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted HTML document.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
51cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*+ 29 more
- cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*range: <=3.2.2
- cpe:2.3:a:apple:safari:2.0:*:*:*:*:*:*:*
- cpe:2.3:a:apple:safari:2.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:apple:safari:2.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:apple:safari:2.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:apple:safari:2.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:apple:safari:2.0.3:417.8:*:*:*:*:*:*
- cpe:2.3:a:apple:safari:2.0.3:417.9:*:*:*:*:*:*
- cpe:2.3:a:apple:safari:2.0.3:417.9.2:*:*:*:*:*:*
- cpe:2.3:a:apple:safari:2.0.3:417.9.3:*:*:*:*:*:*
- cpe:2.3:a:apple:safari:2.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:apple:safari:3.0:*:*:*:*:*:*:*
- cpe:2.3:a:apple:safari:3.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:apple:safari:3.0.0b:*:*:*:*:*:*:*
- cpe:2.3:a:apple:safari:3.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:apple:safari:3.0.1b:*:*:*:*:*:*:*
- cpe:2.3:a:apple:safari:3.0.1:beta:*:*:*:*:*:*
- cpe:2.3:a:apple:safari:3.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:apple:safari:3.0.2b:*:*:*:*:*:*:*
- cpe:2.3:a:apple:safari:3.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:apple:safari:3.0.3b:*:*:*:*:*:*:*
- cpe:2.3:a:apple:safari:3.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:apple:safari:3.0.4b:*:*:*:*:*:*:*
- cpe:2.3:a:apple:safari:3.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:apple:safari:3.1.0b:*:*:*:*:*:*:*
- cpe:2.3:a:apple:safari:3.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:apple:safari:3.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:apple:safari:3.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:apple:safari:3.2.1:*:*:*:*:*:*:*
- (no CPE)range: <4.0
- cpe:2.3:h:apple:ipod_touch:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*+ 18 more
- cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
- cpe:2.3:o:apple:iphone_os:1.0.0:*:*:*:*:*:*:*
- cpe:2.3:o:apple:iphone_os:1.0.1:*:*:*:*:*:*:*
- cpe:2.3:o:apple:iphone_os:1.0.2:*:*:*:*:*:*:*
- cpe:2.3:o:apple:iphone_os:1.1.0:*:*:*:*:*:*:*
- cpe:2.3:o:apple:iphone_os:1.1.1:*:*:*:*:*:*:*
- cpe:2.3:o:apple:iphone_os:1.1.2:*:*:*:*:*:*:*
- cpe:2.3:o:apple:iphone_os:1.1.3:*:*:*:*:*:*:*
- cpe:2.3:o:apple:iphone_os:1.1.4:*:*:*:*:*:*:*
- cpe:2.3:o:apple:iphone_os:1.1.5:*:*:*:*:*:*:*
- cpe:2.3:o:apple:iphone_os:2.0:*:*:*:*:*:*:*
- cpe:2.3:o:apple:iphone_os:2.0.0:*:*:*:*:*:*:*
- cpe:2.3:o:apple:iphone_os:2.0.1:*:*:*:*:*:*:*
- cpe:2.3:o:apple:iphone_os:2.0.2:*:*:*:*:*:*:*
- cpe:2.3:o:apple:iphone_os:2.1:*:*:*:*:*:*:*
- cpe:2.3:o:apple:iphone_os:2.1.1:*:*:*:*:*:*:*
- cpe:2.3:o:apple:iphone_os:2.2:*:*:*:*:*:*:*
- cpe:2.3:o:apple:iphone_os:2.2.1:*:*:*:*:*:*:*
- (no CPE)range: 1.0 - 2.2.1
Patches
Vulnerability mechanics
References
34- lists.apple.com/archives/security-announce/2009/jun/msg00002.htmlnvdPatchVendor Advisory
- securitytracker.com/idnvdPatch
- support.apple.com/kb/HT3613nvdPatchVendor Advisory
- www.vupen.com/english/advisories/2009/1522nvdPatchVendor Advisory
- www.zerodayinitiative.com/advisories/ZDI-09-032/nvdPatch
- www.securityfocus.com/bid/35260nvdExploit
- secunia.com/advisories/35379nvdVendor Advisory
- blog.zoller.lu/2009/05/advisory-apple-safari-remote-code.htmlnvd
- lists.apple.com/archives/security-announce/2009/Jun/msg00005.htmlnvd
- lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.htmlnvd
- osvdb.org/55006nvd
- secunia.com/advisories/35588nvd
- secunia.com/advisories/36057nvd
- secunia.com/advisories/36062nvd
- secunia.com/advisories/36790nvd
- secunia.com/advisories/37746nvd
- secunia.com/advisories/43068nvd
- support.apple.com/kb/HT3639nvd
- www.debian.org/security/2009/dsa-1950nvd
- www.mandriva.com/security/advisoriesnvd
- www.redhat.com/support/errata/RHSA-2009-1128.htmlnvd
- www.securityfocus.com/archive/1/504173/100/0/threadednvd
- www.securityfocus.com/archive/1/504295/100/0/threadednvd
- www.securityfocus.com/bid/35318nvd
- www.ubuntu.com/usn/USN-822-1nvd
- www.ubuntu.com/usn/USN-836-1nvd
- www.ubuntu.com/usn/USN-857-1nvd
- www.vupen.com/english/advisories/2009/1621nvd
- www.vupen.com/english/advisories/2011/0212nvd
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9484nvd
- www.redhat.com/archives/fedora-package-announce/2009-July/msg01177.htmlnvd
- www.redhat.com/archives/fedora-package-announce/2009-July/msg01196.htmlnvd
- www.redhat.com/archives/fedora-package-announce/2009-July/msg01199.htmlnvd
- www.redhat.com/archives/fedora-package-announce/2009-July/msg01200.htmlnvd
News mentions
0No linked articles in our index yet.