CVE-2009-1725

NameCVE-2009-1725
DescriptionWebKit in Apple Safari before 4.0.2, as used on iPhone OS before 3.1, iPhone OS before 3.1.1 for iPod touch, and other platforms; KHTML in kdelibs in KDE; QtWebKit (aka Qt toolkit); and possibly other products do not properly handle numeric character references, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted HTML document.
SourceCVE (at NVD; oss-sec, fulldisc, OSVDB, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, more)
ReferencesDSA-1950-1, DSA-1988-1
NVD severityhigh (attack range: remote, user-initiated)
Debian Bugs538346, 538347
Debian/oldoldstablenot vulnerable.
Debian/oldstablenot vulnerable.
Debian/stablenot vulnerable.
Debian/testingnot vulnerable.
Debian/unstablenot vulnerable.

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
kde4libs (PTS)squeeze4:4.4.5-2+squeeze3fixed
squeeze (lts)4:4.4.5-2+squeeze4fixed
wheezy (security), wheezy4:4.8.4-4+deb7u1fixed
stretch, jessie4:4.14.2-5fixed
sid4:4.14.10-3fixed
kdelibs (PTS)squeeze4:3.5.10.dfsg.1-5fixed
qt4-x11 (PTS)squeeze4:4.6.3-4+squeeze1fixed
squeeze (lts)4:4.6.3-4+squeeze3fixed
wheezy4:4.8.2+dfsg-11fixed
jessie4:4.8.6+git64-g5dc8b2b+dfsg-3+deb8u1fixed
stretch4:4.8.7+dfsg-1fixed
sid4:4.8.7+dfsg-3fixed
webkit (PTS)squeeze1.2.7-0+squeeze2fixed
squeeze (security)1.2.7-0+squeeze1fixed
wheezy1.8.1-3.4fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
kde4libssource(unstable)(not affected)
kdelibssource(unstable)(not affected)
qt4-x11source(unstable)4:4.5.2-2medium538347
qt4-x11sourceetch(not affected)
qt4-x11sourcelenny4.4.3-1+lenny1highDSA-1988-1
webkitsource(unstable)1.1.13-1medium538346
webkitsourcelenny1.0.1-4+lenny2highDSA-1950-1

Notes

[etch] - qt4-x11 <not-affected> (QTWebkit was introduced in 4.4)
- kdelibs <not-affected> (medium; bug #538350)
- kde4libs <not-affected> (medium; bug #538349)
https://bugzilla.redhat.com/show_bug.cgi?id=513813#c18
patch http://trac.webkit.org/changeset/44799/
PoC https://cevans-app.appspot.com/static/webkitentityoffbyone.html

Search for package or bug name: Reporting problems