CVE-2009-1709 — Improper Update of Reference Count in Apple Safari

CWE-399CWE-911 — Improper Update of Reference CountCWE-416 — Use After Free6 documents6 sources
Severity
9.3CRITICALNVD
EPSS
8.6%
top 7.56%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Apple Safari
Timeline
PublishedJun 10
Latest updateMay 2

Description

Use-after-free vulnerability in the garbage-collection implementation in WebCore in WebKit in Apple Safari before 4.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap corruption and application crash) via an SVG animation element, related to SVG set objects, SVG marker elements, the targetElement attribute, and unspecified "caches."

CVSS vector

AV:N/AC:M/C:C/I:C/A:CExploitability: 8.6 | Impact: 10.0

Affected Packages1 packages

▶NVDapple/safari4.0_beta+25

Patches

Patch: lists.apple.com ↗Patch: support.apple.com ↗Patch: lists.apple.com ↗

🔴Vulnerability Details

1
GHSA
GHSA-grpq-h627-xvm6: Use-after-free vulnerability in the garbage-collection implementation in WebCore in WebKit in Apple Safari before 4↗2022-05-02
▶

📋Vendor Advisories

2
Ubuntu
KDE-Graphics vulnerabilities↗2009-08-24
▶
Red Hat
kdegraphics: KSVG Pointer use-after-free error in the SVG animation element (DoS, ACE)↗2009-06-25
▶

📐Framework References

1
CWE
Improper Update of Reference Count↗
▶

💬Community

1
Bugzilla
CVE-2009-1709 kdegraphics: KSVG Pointer use-after-free error in the SVG animation element (DoS, ACE)↗2009-06-16
▶