CVE-2009-1699

Published: 10 June 2009

The XSL stylesheet implementation in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not properly handle XML external entities, which allows remote attackers to read arbitrary files via a crafted DTD, as demonstrated by a file:///etc/passwd URL in an entity declaration, related to an "XXE attack."

Priority

Medium

Status

Package Release Status
qt4-x11
Launchpad, Ubuntu, Debian
Upstream Needs triage

webkit
Launchpad, Ubuntu, Debian
Upstream Needs triage

Patches:
Upstream: http://trac.webkit.org/changeset/34534

Notes

AuthorNote
jdstrand
webkit is a fork of khtml from kdelibs. kdelibs5 is farther from
it, while qt4-x11 attempts to unify khtml and webkit
mdeslaur
PoC: http://scary.beasts.org/security/CESA-2009-006.html
PoC: http://www.milw0rm.com/exploits/8907
code doesn't seem present in kde4libs

References

Bugs