vulnwire
9.3crit

CVE-2008-4231

Safari in Apple iPhone OS 1.0 through 2.1 and iPhone OS for iPod touch 1.1 through 2.1 does not properly handle HTML TABLE elements, which…

Published 17 y ago · modified 4 mo ago · JSON

CVSS
9.3
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
5.9%
percentile 93%
Public exploits
0
none known

Safari in Apple iPhone OS 1.0 through 2.1 and iPhone OS for iPod touch 1.1 through 2.1 does not properly handle HTML TABLE elements, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted HTML document.

Exploit prediction (EPSS)

5.85% probability of exploitation in the next 30 days, higher than 93% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD2.09.3AV:N/AC:M/Au:N/C:C/I:C/A:C

Classification

Weakness

References

  • fortiguardcenter.com /advisory/FGA-2009-23.html · x_refsource_MISC, x_transferred
  • lists.apple.com /archives/security-announce/2009/jun/msg00002.html · vendor-advisory, x_refsource_APPLE, x_transferred
  • lists.apple.com /archives/security-announce/2008/Nov/msg00002.html · vendor-advisory, x_refsource_APPLE, x_transferred
  • vupen.com /english/advisories/2009/1522 · vdb-entry, x_refsource_VUPEN, x_transferred
  • vupen.com /english/advisories/2008/3232 · vdb-entry, x_refsource_VUPEN, x_transferred
  • secunia.com /advisories/35379 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • securityfocus.com /archive/1/504211/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • support.apple.com /kb/HT3318 · x_refsource_CONFIRM, x_transferred
  • securitytracker.com /id?1021272 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • osvdb.org /50028 · vdb-entry, x_refsource_OSVDB, x_transferred
  • securityfocus.com /bid/32394 · vdb-entry, x_refsource_BID, x_transferred
  • support.apple.com /kb/HT3613 · x_refsource_CONFIRM, x_transferred
  • secunia.com /advisories/32756 · third-party-advisory, x_refsource_SECUNIA, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.