CVE-2009-0959

HighCVSS 7.1/10Last modified Jun 16, 2026

Description

The MPEG-4 video codec in Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to cause a denial of service (device reset) via a crafted MPEG-4 video file that triggers an "input validation issue."

Metrics

CVSS 2.0 7.1/10AV:N/AC:M/Au:N/C:N/I:N/A:C

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.htmlVendor Advisory
http://osvdb.org/55237
http://support.apple.com/kb/HT3639Patch, Vendor Advisory
http://www.securityfocus.com/bid/35414
http://www.securityfocus.com/bid/35433
http://www.vupen.com/english/advisories/2009/1621Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/51211
http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.htmlVendor Advisory
http://osvdb.org/55237
http://support.apple.com/kb/HT3639Patch, Vendor Advisory
http://www.securityfocus.com/bid/35414
http://www.securityfocus.com/bid/35433
http://www.vupen.com/english/advisories/2009/1621Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/51211

Timeline

Published: Jun 19, 2009
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2009

CVE-2009-09604.3The Mail component in Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1 does not provide an option to disable CVE-2009-09615.0The Mail component in Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1 dismisses the call approval dialog wh CVE-2009-09627.5Unspecified vulnerability in Futomi's CGI Cafe MP Form Mail CGI eCommerce 1.3.0 and earlier, and CGI Professional 3.2.2 and earlier, allows CVE-2009-09637.5Multiple SQL injection vulnerabilities in PHPRunner 4.2, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via CVE-2009-09647.5UserView_list.php in PHPRunner 4.2, and possibly earlier, stores passwords in cleartext in the database, which allows attackers to gain priv CVE-2009-09657.5SQL injection vulnerability in functions/browse.php in Ganesha Digital Library (GDL) 4.0 and 4.2 allows remote attackers to execute arbitrar CVE-2009-09667.5PHP remote file inclusion vulnerability in cross.php in YABSoft Mega File Hosting 1.2 allows remote attackers to execute arbitrary PHP code CVE-2009-09674.0The FTP server in Serv-U 7.0.0.1 through 7.4.0.1 allows remote authenticated users to cause a denial of service (service hang) via a large n CVE-2009-09687.5SQL injection vulnerability in fmoblog.php in the fMoblog plugin 2.1 for WordPress allows remote attackers to execute arbitrary SQL commands CVE-2009-09696.8Cross-site request forgery (CSRF) vulnerability in account/settings/account/index.php in phpFoX 1.6.21 allows remote attackers to hijack the CVE-2009-09706.8PHP remote file inclusion vulnerability in includes/class_image.php in PHP Pro Bid 6.05, when register_globals is enabled, allows remote att CVE-2009-09714.3Cross-site scripting (XSS) vulnerability in futomi's CGI Cafe Access Analyzer CGI Standard Version 3.8.1 and earlier allows remote attackers