Description
WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not initialize a pointer during handling of a Cascading Style Sheets (CSS) attr function call with a large numerical argument, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted HTML document.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | kde4libs | 4:4.1.0-3+lenny1 | DSA-1868-1 |
| Debian 5.0 | kdelibs | 4:3.5.10.dfsg.1-0lenny2 | DSA-1867-1 |
| Debian 5.0 | qt4-x11 | 4.4.3-1+lenny1 | DSA-1988-1 |
| Debian 5.0 | webkit | 1.0.1-4+lenny2 | DSA-1950-1 |
| Debian 4.0 | kdelibs | 4:3.5.5a.dfsg.1-8etch2 | DSA-1867-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | kdelibs +2 | 6:3.5.4-22.el5_3 | RHSA-2009:1127 |
| RHEL 4 | kdelibs +1 | 6:3.3.1-14.el4 | RHSA-2009:1127 |
| RHEL 3 | kdelibs +1 | 6:3.1.3-6.13 | RHSA-2009:1128 |
Advisories 6
- RHSA-2009:1127 Red Hat Security Advisory: kdelibs security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2009:1128 Red Hat Security Advisory: kdelibs security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1988-1 qt4-x11 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1950-1 webkit - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1867-1 kdelibs - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1868-1 kde4libs - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- USN-822-1 vendor-advisory
- http://support.apple.com/kb/HT3639
- 43068 third-party-advisory
- FEDORA-2009-8039 vendor-advisory
- MDVSA-2009:330 vendor-advisory
- ADV-2009-1621 vdb-entry
- ADV-2011-0212 vdb-entry
- APPLE-SA-2009-06-08-1 vendor-advisory
- 35588 third-party-advisory
- 35260 vdb-entry
- FEDORA-2009-8046 vendor-advisory
- ADV-2009-1522 vdb-entry
- 37746 third-party-advisory
- http://www.zerodayinitiative.com/advisories/ZDI-09-032/
- 1022345 vdb-entry
- 36790 third-party-advisory
- APPLE-SA-2009-06-17-1 vendor-advisory
- 20090608 ZDI-09-032: Apple WebKit attr() Invalid Attribute Memory Corruption Vulnerability mailing-list
- 20090614 [TZO-37-2009] Apple Safari <v4 Remote code execution mailing-list
- DSA-1950 vendor-advisory
- SUSE-SR:2011:002 vendor-advisory
- RHSA-2009:1128 vendor-advisory
- 35379 third-party-advisory
- 55006 vdb-entry
- oval:org.mitre.oval:def:9484 vdb-entry signature
- 36062 third-party-advisory
- USN-857-1 vendor-advisory
- 36057 third-party-advisory
- FEDORA-2009-8049 vendor-advisory
- http://support.apple.com/kb/HT3613
- USN-836-1 vendor-advisory
- 35318 vdb-entry
- http://blog.zoller.lu/2009/05/advisory-apple-safari-remote-code.html
- FEDORA-2009-8020 vendor-advisory