CVE-2009-0153

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-05-13 · updated 2026-06-16
Weakness: CWE-79

Description

International Components for Unicode (ICU) 4.0, 3.6, and other 3.x versions, as used in Apple Mac OS X 10.5 before 10.5.7, iPhone OS 1.0 through 2.2.1, iPhone OS for iPod touch 1.1 through 2.2.1, Fedora 9 and 10, and possibly other operating systems, does not properly handle invalid byte sequences during Unicode conversion, which might allow remote attackers to conduct cross-site scripting (XSS) attacks.

Affected products

macOS: 10.5.0, 10.5.1, 10.5.2, 10.5.3, 10.5.4, 10.5.5 (+1)
Apple Mac Os X Server: 10.5.0, 10.5.1, 10.5.2, 10.5.3, 10.5.4, 10.5.5 (+1)

References

http://bugs.icu-project.org/trac/ticket/5691
http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html
http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html
http://secunia.com/advisories/35074
http://secunia.com/advisories/35379
http://secunia.com/advisories/35436
http://secunia.com/advisories/35498
http://secunia.com/advisories/35584
http://support.apple.com/kb/HT3549
http://support.apple.com/kb/HT3613
http://support.apple.com/kb/HT3639

Get alerted when CVE-2009-0153 or the next vulnerability affects your stack