Unscored CVE-2009-0943 EUVD-2009-0940GHSA-3wf3-2hqv-7qjg

Help Viewer in Apple Mac OS X 10.4.11 and 10.5 before 10.5.7 does not verify that HTML pathnames are located in a registered help book, whi…

Published May 13, 2009 · Updated Aug 7, 2024 · Assigned by mitre

Description

Help Viewer in Apple Mac OS X 10.4.11 and 10.5 before 10.5.7 does not verify that HTML pathnames are located in a registered help book, which allows remote attackers to execute arbitrary code via a help: URL that triggers invocation of AppleScript files.

References

http://support.apple.com/kb/HT3549
35074 third-party-advisory
APPLE-SA-2009-05-12 vendor-advisory
macos-helpviewer-html-code-execution(50486) vdb-entry
34926 vdb-entry
TA09-133A third-party-advisory
ADV-2009-1297 vdb-entry
1022216 vdb-entry