| Name | CVE-2009-1713 |
| Description | The XSLT functionality in WebKit in Apple Safari before 4.0 does not properly implement the document function, which allows remote attackers to read (1) arbitrary local files and (2) files from different security zones via unspecified vectors. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more) |
| References | DSA-1988-1 |
| NVD severity | high (attack range: remote) |
| Debian Bugs | 535793 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| kde4libs (PTS) | wheezy | 4:4.8.4-4+deb7u1 | fixed |
| wheezy (security) | 4:4.8.4-4+deb7u3 | fixed | |
| jessie (security), jessie | 4:4.14.2-5+deb8u2 | fixed | |
| stretch | 4:4.14.26-2 | fixed | |
| buster, sid | 4:4.14.35-1 | fixed | |
| qt4-x11 (PTS) | wheezy | 4:4.8.2+dfsg-11 | fixed |
| jessie | 4:4.8.6+git64-g5dc8b2b+dfsg-3+deb8u1 | fixed | |
| buster, sid, stretch | 4:4.8.7+dfsg-11 | fixed | |
| webkit (PTS) | wheezy | 1.8.1-3.4 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| kde4libs | source | (unstable) | (not affected) | |||
| kdelibs | source | (unstable) | (not affected) | |||
| qt4-x11 | source | (unstable) | 4:4.5.2-2 | high | ||
| qt4-x11 | source | etch | (not affected) | |||
| qt4-x11 | source | lenny | 4.4.3-1+lenny1 | high | DSA-1988-1 | |
| webkit | source | (unstable) | 1.0.1-4 | medium | 535793 |
[etch] - qt4-x11 <not-affected> (QTWebkit was introduced in 4.4)
http://trac.webkit.org/changeset/34533