CVE-2009-1725

NameCVE-2009-1725
DescriptionWebKit in Apple Safari before 4.0.2, as used on iPhone OS before 3.1, iPhone OS before 3.1.1 for iPod touch, and other platforms; KHTML in kdelibs in KDE; QtWebKit (aka Qt toolkit); and possibly other products do not properly handle numeric character references, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted HTML document.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-1950-1, DSA-1988-1
Debian Bugs538346, 538347

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
kde4libs (PTS)jessie, jessie (lts)4:4.14.2-5+deb8u3fixed
stretch (lts), stretch4:4.14.26-2+deb9u1fixed
buster4:4.14.38-3fixed
qt4-x11 (PTS)jessie, jessie (lts)4:4.8.6+git64-g5dc8b2b+dfsg-3+deb8u5fixed
stretch (security)4:4.8.7+dfsg-11+deb9u3fixed
stretch (lts), stretch4:4.8.7+dfsg-11+deb9u4fixed
buster (security), buster, buster (lts)4:4.8.7+dfsg-18+deb10u2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
kde4libssource(unstable)(not affected)
kdelibssource(unstable)(not affected)
qt4-x11sourceetch(not affected)
qt4-x11sourcelenny4.4.3-1+lenny1DSA-1988-1
qt4-x11source(unstable)4:4.5.2-2medium538347
webkitsourcelenny1.0.1-4+lenny2DSA-1950-1
webkitsource(unstable)1.1.13-1medium538346

Notes

[etch] - qt4-x11 <not-affected> (QTWebkit was introduced in 4.4)
- kdelibs <not-affected> (medium; bug #538350)
- kde4libs <not-affected> (medium; bug #538349)
https://bugzilla.redhat.com/show_bug.cgi?id=513813#c18
patch http://trac.webkit.org/changeset/44799/
PoC http://web.archive.org/web/20110813092643/https://cevans-app.appspot.com/static/webkitentityoffbyone.html

Search for package or bug name: Reporting problems