CVE-2009-2841
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 2.9%
The HTMLMediaElement::loadResource function in html/HTMLMediaElement.cpp in WebCore in WebKit before r49480, as used in Apple Safari before 4.0.4 on Mac OS X, does not perform the expected callbacks for HTML 5 media elements that have external URLs for media resources, which allows remote attackers to trigger sub-resource requests to arbitrary web sites via a crafted HTML document, as demonstrated by an HTML e-mail message that uses a media element for X-Confirm-Reading-To functionality, aka rdar problem 7271202.
Produtos afetados
n/a · n/aReferências
http://lists.apple.com/archives/security-announce/2009/Nov/msg00001.htmlhttp://lists.apple.com/archives/security-announce/2010/Feb/msg00000.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2010-July/044023.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2010-July/044031.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.htmlhttp://osvdb.org/59941https://bugzilla.redhat.com/show_bug.cgi?id=525791http://secunia.com/advisories/37346http://secunia.com/advisories/40557http://secunia.com/advisories/41856http://secunia.com/advisories/43068https://exchange.xforce.ibmcloud.com/vulnerabilities/54242