Description
Array index error in the insertItemBefore method in WebKit, as used in Apple Safari before 3.2.3 and 4 Public Beta, iPhone OS 1.0 through 2.2.1, iPhone OS for iPod touch 1.1 through 2.2.1, Google Chrome Stable before 1.0.154.65, and possibly other products allows remote attackers to execute arbitrary code via a document with a SVGPathList data structure containing a negative index in the (1) SVGTransformList, (2) SVGStringList, (3) SVGNumberList, (4) SVGPathSegList, (5) SVGPointList, or (6) SVGLengthList SVGList object, which triggers memory corruption.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | kdegraphics | 4:3.5.9-3+lenny2 | DSA-1866-1 |
| Debian 5.0 | qt4-x11 | 4.4.3-1+lenny1 | DSA-1988-1 |
| Debian 5.0 | webkit | 1.0.1-4+lenny2 | DSA-1950-1 |
| Debian 4.0 | kdegraphics | 4:3.5.5-3etch4 | DSA-1866-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | kdegraphics +1 | 7:3.5.4-13.el5_3 | RHSA-2009:1130 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Productivity 5 | kdegraphics +1 | 7:3.5.4-13.el5_3 | RHSA-2009:1130 |
Advisories 4
- RHSA-2009:1130 Red Hat Security Advisory: kdegraphics security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1988-1 qt4-x11 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1866-1 kdegraphics - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1950-1 webkit - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- USN-822-1 vendor-advisory
- 35805 third-party-advisory
- http://support.apple.com/kb/HT3639
- 43068 third-party-advisory
- FEDORA-2009-8039 vendor-advisory
- ADV-2009-1621 vdb-entry
- http://support.apple.com/kb/HT3549
- http://googlechromereleases.blogspot.com/2009/05/stable-update-bug-fix.html
- ADV-2011-0212 vdb-entry
- 1022207 vdb-entry
- 20090519 ZDI-09-022: Apple Safari Malformed SVGList Parsing Code Execution Vulnerability mailing-list
- RHSA-2009:1130 vendor-advisory
- ADV-2009-1298 vdb-entry
- 35576 third-party-advisory
- 35074 third-party-advisory
- 37746 third-party-advisory
- 36790 third-party-advisory
- APPLE-SA-2009-06-17-1 vendor-advisory
- APPLE-SA-2009-05-12 vendor-advisory
- 35056 third-party-advisory
- http://www.zerodayinitiative.com/advisories/ZDI-09-022
- 34924 vdb-entry
- 36461 third-party-advisory
- safari-webkit-svglist-bo(50477) vdb-entry
- APPLE-SA-2009-05-12 vendor-advisory
- USN-823-1 vendor-advisory
- DSA-1950 vendor-advisory
- SUSE-SR:2011:002 vendor-advisory
- 36062 third-party-advisory
- USN-857-1 vendor-advisory
- APPLE-SA-2009-05-12 vendor-advisory
- TA09-133A third-party-advisory
- oval:org.mitre.oval:def:11584 vdb-entry signature
- ADV-2009-1297 vdb-entry
- 35095 third-party-advisory
- FEDORA-2009-8049 vendor-advisory
- http://support.apple.com/kb/HT3550
- FEDORA-2009-6166 vendor-advisory
- USN-836-1 vendor-advisory
- ADV-2009-1321 vdb-entry
- http://code.google.com/p/chromium/issues/detail?id=9019