WebKit in Apple Safari before 4.0.2, as used on iPhone OS before 3.1, iPhone OS before 3.1.1 for iPod touch, and other platforms; KHTML in…

Description

WebKit in Apple Safari before 4.0.2, as used on iPhone OS before 3.1, iPhone OS before 3.1.1 for iPod touch, and other platforms; KHTML in kdelibs in KDE; QtWebKit (aka Qt toolkit); and possibly other products do not properly handle numeric character references, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted HTML document.

Scores

EPSS (exploitation in 30 days)

6.2% · top 6.5% of all CVEs (6 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 9.3.

Weakness

• n/a
• CWE-189 (opens in a new tab)All about CWE-189 and its CVEs

Affected products

• n/a

  • affected n/a

References (33)

• http://websvn.kde.org/?view=rev&revision=1002164 (opens in a new tab)x_refsource_CONFIRMx_transferred
• http://websvn.kde.org/?view=rev&revision=1002163 (opens in a new tab)x_refsource_CONFIRMx_transferred
• 43068 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• FEDORA-2009-8039 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
• MDVSA-2009:330 (opens in a new tab)vendor-advisoryx_refsource_MANDRIVAx_transferred
• http://support.apple.com/kb/HT3666 (opens in a new tab)x_refsource_CONFIRMx_transferred
• ADV-2011-0212 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• APPLE-SA-2009-07-08-1 (opens in a new tab)vendor-advisoryx_refsource_APPLEx_transferred
• http://websvn.kde.org/?view=rev&revision=1002162 (opens in a new tab)x_refsource_CONFIRMx_transferred
• FEDORA-2009-8046 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
• 35607 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
• ADV-2009-1827 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• 37746 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 55739 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 36790 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 36347 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• DSA-1950 (opens in a new tab)vendor-advisoryx_refsource_DEBIANx_transferred
• SUSE-SR:2011:002 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
• 36062 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• USN-857-1 (opens in a new tab)vendor-advisoryx_refsource_UBUNTUx_transferred
• 36057 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• FEDORA-2009-8802 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
• 1022526 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
• oval:org.mitre.oval:def:5777 (opens in a new tab)vdb-entrysignaturex_refsource_OVALx_transferred
• FEDORA-2009-8049 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
• https://bugzilla.redhat.com/show_bug.cgi?id=513813 (opens in a new tab)x_refsource_CONFIRMx_transferred
• USN-836-1 (opens in a new tab)vendor-advisoryx_refsource_UBUNTUx_transferred
• FEDORA-2009-8800 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
• APPLE-SA-2009-09-09-1 (opens in a new tab)vendor-advisoryx_refsource_APPLEx_transferred
• 36677 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• http://support.apple.com/kb/HT3860 (opens in a new tab)x_refsource_CONFIRMx_transferred
• 35758 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• FEDORA-2009-8020 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2009-1725](https://trackcve.app/badge/CVE-2009-1725.svg)](https://trackcve.app/cve/CVE-2009-1725)

Record last updated 7 Aug 2024, 05:20 UTC.