CVE-2009-2199

Severity: medium (CVSS 5.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-08-12 · updated 2026-06-16

Description

Incomplete blacklist vulnerability in WebKit in Apple Safari before 4.0.3, as used on iPhone OS before 3.1, iPhone OS before 3.1.1 for iPod touch, and other platforms, allows remote attackers to spoof domain names in URLs, and possibly conduct phishing attacks, via unspecified homoglyphs.

Affected products

Apple Iphone Os: through 3.0.1; through 3.1; 1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, 1.1.2 (+13)
Apple Safari: through 4.0.2; 2.0, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.3-417.8 (+26)

References

http://lists.apple.com/archives/security-announce/2009/Aug/msg00002.html
http://lists.apple.com/archives/security-announce/2009/Sep/msg00001.html
http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
http://secunia.com/advisories/36677
http://secunia.com/advisories/43068
http://support.apple.com/kb/HT3733
http://support.apple.com/kb/HT3860
http://www.securityfocus.com/bid/36026
http://www.securitytracker.com/id?1022719
http://www.vupen.com/english/advisories/2011/0212
http://lists.apple.com/archives/security-announce/2009/Aug/msg00002.html
http://lists.apple.com/archives/security-announce/2009/Sep/msg00001.html

Get alerted when CVE-2009-2199 or the next vulnerability affects your stack