CVE-2009-2204

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 8.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2009-08-03 · updated 2026-06-16

Description

Unspecified vulnerability in the CoreTelephony component in Apple iPhone OS before 3.0.1 allows remote attackers to execute arbitrary code, obtain GPS coordinates, or enable the microphone via an SMS message that triggers memory corruption, as demonstrated by Charlie Miller at SyScan '09 Singapore.

Affected products

Apple Iphone Os: through 3.0; 1.0, 1.0.0, 1.0.1, 1.0.2, 1.1, 1.1.0 (+10)

References

http://lists.apple.com/archives/security-announce/2009/Jul/msg00001.html
http://news.cnet.com/8301-1009_3-10278472-83.html
http://secunia.com/advisories/36070
http://securitytracker.com/id?1022626
http://support.apple.com/kb/HT3754
http://www.blackhat.com/presentations/bh-usa-09/MILLER/BHUSA09-Miller-FuzzingPhone-PAPER.pdf
http://www.osvdb.org/55687
http://www.securityfocus.com/bid/35569
http://www.syscan.org/Sg/program.html
http://www.vupen.com/english/advisories/2009/2105
http://lists.apple.com/archives/security-announce/2009/Jul/msg00001.html
http://news.cnet.com/8301-1009_3-10278472-83.html

Get alerted when CVE-2009-2204 or the next vulnerability affects your stack