CVE-2009-1685

Description

Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to inject arbitrary web script or HTML by overwriting the document.implementation property of (1) an embedded document or (2) a parent document.

References

http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html

http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html

http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html

http://osvdb.org/54983

http://secunia.com/advisories/35379

http://secunia.com/advisories/43068

http://securitytracker.com/id?1022344

http://support.apple.com/kb/HT3613

http://support.apple.com/kb/HT3639

http://www.securityfocus.com/bid/35260

http://www.securityfocus.com/bid/35319

http://www.vupen.com/english/advisories/2009/1522

http://www.vupen.com/english/advisories/2009/1621

http://www.vupen.com/english/advisories/2011/0212

Details

Risk Information

CVSS v2.0