VULNERABILITY INTELLIGENCE
CVE-2009-1699
CVSS score7.5 HIGH
EPSS probability29.10%
CISA KEVNot currently listed
Published2009-06-10
Last modified2026-06-16
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Description
The XSL stylesheet implementation in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not properly handle XML external entities, which allows remote attackers to read arbitrary files via a crafted DTD, as demonstrated by a file:///etc/passwd URL in an entity declaration, related to an "XXE attack."
Weakness classification
- CWE-611: Improper Restriction of XML External Entity Reference
Primary references
- cve@mitre.org — Mailing List
- cve@mitre.org — Broken Link, Mailing List, Patch, Vendor Advisory
- cve@mitre.org — Mailing List
- cve@mitre.org — Broken Link
- cve@mitre.org — Exploit
- cve@mitre.org — Exploit
- cve@mitre.org — Broken Link, Vendor Advisory
- cve@mitre.org — Broken Link
- cve@mitre.org — Patch, Vendor Advisory
- cve@mitre.org — Vendor Advisory
- cve@mitre.org — Broken Link, Exploit, Third Party Advisory, VDB Entry
- cve@mitre.org — Broken Link, Third Party Advisory, VDB Entry