What’s Vulnerable › Vulnerabilities

CVE-2009-1699

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 29.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2009-06-10 · updated 2026-06-16
• Weakness: CWE-611

Description

The XSL stylesheet implementation in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not properly handle XML external entities, which allows remote attackers to read arbitrary files via a crafted DTD, as demonstrated by a file:///etc/passwd URL in an entity declaration, related to an "XXE attack."

Affected products

• Apple Iphone Os: from 1.0.0 through 2.2.1
• Apple Safari: before 4.0 — fixed in 4.0
• Canonical Ubuntu Linux: 8.10, 9.04
• Opensuse: 11.2, 11.3

How to fix

Upgrade to a fixed version: Apple Safari 4.0. Check the vendor advisory for mitigations.

References

• http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html
• http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html
• http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
• http://osvdb.org/54972
• http://scary.beasts.org/security/CESA-2009-006.html
• http://scarybeastsecurity.blogspot.com/2009/06/apples-safari-4-fixes-local-file-theft.html
• http://secunia.com/advisories/35379
• http://secunia.com/advisories/43068
• http://support.apple.com/kb/HT3613
• http://support.apple.com/kb/HT3639
• http://www.securityfocus.com/bid/35260
• http://www.securityfocus.com/bid/35321

Get alerted when CVE-2009-1699 or the next vulnerability affects your stack