CVE-2009-1705

Опубликовано: 10 июн. 2009

Источник: nvd

CVSS2: 9.3

EPSS Низкий

Описание

CoreGraphics in Apple Safari before 4.0 on Windows does not properly use arithmetic during automatic hinting of TrueType fonts, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via crafted font data.

Ссылки

http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html
Patch
Vendor Advisory
http://osvdb.org/54974
http://secunia.com/advisories/35379
Vendor Advisory
http://support.apple.com/kb/HT3613
Patch
Vendor Advisory
http://www.securityfocus.com/bid/35260
Exploit
Patch
http://www.securityfocus.com/bid/35308
http://www.vupen.com/english/advisories/2009/1522
Patch
Vendor Advisory
http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html
Patch
Vendor Advisory
http://osvdb.org/54974
http://secunia.com/advisories/35379
Vendor Advisory
http://support.apple.com/kb/HT3613
Patch
Vendor Advisory
http://www.securityfocus.com/bid/35260
Exploit
Patch
http://www.securityfocus.com/bid/35308
http://www.vupen.com/english/advisories/2009/1522
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:apple:safari:*:-:windows:*:*:*:*:*

Версия до 3.2.3 (включая)

cpe:2.3:a:apple:safari:3.0:-:windows:*:*:*:*:*

cpe:2.3:a:apple:safari:3.0.1:-:windows:*:*:*:*:*

cpe:2.3:a:apple:safari:3.0.2:-:windows:*:*:*:*:*

cpe:2.3:a:apple:safari:3.0.3:-:windows:*:*:*:*:*

cpe:2.3:a:apple:safari:3.0.4:-:windows:*:*:*:*:*

cpe:2.3:a:apple:safari:3.1:-:windows:*:*:*:*:*

cpe:2.3:a:apple:safari:3.1.1:-:windows:*:*:*:*:*

cpe:2.3:a:apple:safari:3.1.2:-:windows:*:*:*:*:*

cpe:2.3:a:apple:safari:3.2:-:windows:*:*:*:*:*

cpe:2.3:a:apple:safari:3.2.1:-:windows:*:*:*:*:*

cpe:2.3:a:apple:safari:3.2.2:-:windows:*:*:*:*:*

EPSS

Процентиль: 90%

0.05154

Низкий

9.3 Critical

CVSS2

Дефекты

CWE-189

Связанные уязвимости

GHSA-x3g5-fg6f-g2mh

github

почти 4 года назад