CVE-2009-1713

NameCVE-2009-1713
DescriptionThe XSLT functionality in WebKit in Apple Safari before 4.0 does not properly implement the document function, which allows remote attackers to read (1) arbitrary local files and (2) files from different security zones via unspecified vectors.
SourceCVE (at NVD; oss-sec, fulldisc, OSVDB, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, more)
ReferencesDSA-1988-1
NVD severityhigh (attack range: remote, user-initiated)
Debian Bugs535793
Debian/oldoldstablenot vulnerable.
Debian/oldstablenot vulnerable.
Debian/stablenot vulnerable.
Debian/testingnot vulnerable.
Debian/unstablenot vulnerable.

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
kde4libs (PTS)squeeze4:4.4.5-2+squeeze3fixed
squeeze (lts)4:4.4.5-2+squeeze4fixed
wheezy (security), wheezy4:4.8.4-4+deb7u1fixed
stretch, jessie4:4.14.2-5fixed
sid4:4.14.10-3fixed
kdelibs (PTS)squeeze4:3.5.10.dfsg.1-5fixed
qt4-x11 (PTS)squeeze4:4.6.3-4+squeeze1fixed
squeeze (lts)4:4.6.3-4+squeeze3fixed
wheezy4:4.8.2+dfsg-11fixed
jessie4:4.8.6+git64-g5dc8b2b+dfsg-3+deb8u1fixed
stretch4:4.8.7+dfsg-1fixed
sid4:4.8.7+dfsg-3fixed
webkit (PTS)squeeze1.2.7-0+squeeze2fixed
squeeze (security)1.2.7-0+squeeze1fixed
wheezy1.8.1-3.4fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
kde4libssource(unstable)(not affected)
kdelibssource(unstable)(not affected)
qt4-x11source(unstable)4:4.5.2-2high
qt4-x11sourceetch(not affected)
qt4-x11sourcelenny4.4.3-1+lenny1highDSA-1988-1
webkitsource(unstable)1.0.1-4medium535793

Notes

[etch] - qt4-x11 <not-affected> (QTWebkit was introduced in 4.4)
http://trac.webkit.org/changeset/34533

Search for package or bug name: Reporting problems