New Search

Array index error in the insertItemBefore method in WebKit as used in Apple Safari before 3.2.3 and 4 Public Beta iPhone OS 1.0 through 2.2.1 iPhone OS for iPod touch 1.1 through 2.2.1 Google Chrome Stable before 1.0.154.65 and possibly other products allows remote attackers to execute arbitrary code via a document with a SVGPathList data structure containing a negative index in the (1) SVGTransformList (2) SVGStringList (3) SVGNumberList (4) SVGPathSegList (5) SVGPointList or (6) SVGLengthList SVGList object which triggers memory corruption.

oval:org.mitre.oval:def:11584

Array index error in the insertItemBefore method in WebKit as used in Apple Safari before 3.2.3 and 4 Public Beta iPhone OS 1.0 through 2.2.1 iPhone OS for iPod touch 1.1 through 2.2.1 Google Chrome Stable before 1.0.154.65 and possibly other products allows remote attackers to execute arbitrary code via a document with a SVGPathList data structure containing a negative index in the (1) SVGTransformList (2) SVGStringList (3) SVGNumberList (4) SVGPathSegList (5) SVGPointList or (6) SVGLengthList SVGList object which triggers memory corruption.

Family:
unix
Status:
ACCEPTED
Platform(s):
  • Red Hat Enterprise Linux 5
  • CentOS Linux 5
  • Oracle Linux 5
Class:
vulnerability
Reference(s):
  • CVE-2009-0945
Product(s):