CVE-2009-1698

NameCVE-2009-1698
DescriptionWebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not initialize a pointer during handling of a Cascading Style Sheets (CSS) attr function call with a large numerical argument, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted HTML document.
SourceCVE (at NVD; oss-sec, fulldisc, OSVDB, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, more)
ReferencesDSA-1867-1, DSA-1868-1, DSA-1950-1, DSA-1988-1
NVD severityhigh (attack range: remote, user-initiated)
Debian Bugs534946, 534949
Debian/oldstablenot vulnerable.
Debian/stablenot vulnerable.
Debian/testingnot vulnerable.
Debian/unstablenot vulnerable.

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
kde4libs (PTS)squeeze4:4.4.5-2+squeeze3fixed
squeeze (lts)4:4.4.5-2+squeeze4fixed
wheezy, wheezy (security)4:4.8.4-4+deb7u1fixed
jessie, sid4:4.14.2-5fixed
kdelibs (PTS)squeeze4:3.5.10.dfsg.1-5fixed
qt4-x11 (PTS)squeeze4:4.6.3-4+squeeze1fixed
squeeze (lts)4:4.6.3-4+squeeze2fixed
wheezy4:4.8.2+dfsg-11fixed
jessie, sid4:4.8.6+git64-g5dc8b2b+dfsg-3fixed
webkit (PTS)squeeze1.2.7-0+squeeze2fixed
squeeze (security)1.2.7-0+squeeze1fixed
wheezy1.8.1-3.4fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
kde4libssource(unstable)4:4.3.0-1medium
kde4libssourcelenny4:4.1.0-3+lenny1highDSA-1868-1
kdelibssource(unstable)3.5.10.dfsg.1-2.1medium534949
kdelibssourceetch4:3.5.5a.dfsg.1-8etch2highDSA-1867-1
kdelibssourcelenny4:3.5.10.dfsg.1-0lenny2highDSA-1867-1
qt4-x11source(unstable)4:4.5.2-1high
qt4-x11sourceetch(not affected)
qt4-x11sourcelenny4.4.3-1+lenny1highDSA-1988-1
webkitsource(unstable)1.1.5-1medium534946
webkitsourcelenny1.0.1-4+lenny2highDSA-1950-1

Notes

http://trac.webkit.org/changeset/42081
[etch] - qt4-x11 <not-affected> (QTWebkit was introduced in 4.4)

Search for package or bug name: Reporting problems