CVE-2009-2842

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

Apple Safari before 4.0.4 does not properly implement certain (1) Open Image and (2) Open Link menu options, which allows remote attackers to read local HTML files via a crafted web site.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:P/I:N/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.apple.com/archives/security-announce/2009/Nov/msg00001.htmlPatch, Vendor Advisory
http://osvdb.org/59942
http://secunia.com/advisories/37346Vendor Advisory
http://support.apple.com/kb/HT3949Patch, Vendor Advisory
http://www.securityfocus.com/bid/36994
http://www.securitytracker.com/id?1023164
http://www.vupen.com/english/advisories/2009/3217Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/54238
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5915
http://lists.apple.com/archives/security-announce/2009/Nov/msg00001.htmlPatch, Vendor Advisory
http://osvdb.org/59942
http://secunia.com/advisories/37346Vendor Advisory
http://support.apple.com/kb/HT3949Patch, Vendor Advisory
http://www.securityfocus.com/bid/36994
http://www.securitytracker.com/id?1023164
http://www.vupen.com/english/advisories/2009/3217Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/54238
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5915

Timeline

Published: Nov 13, 2009
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2009

CVE-2009-28435.0Java for Mac OS X 10.5 before Update 6 and 10.6 before Update 1 accepts expired certificates for applets, which makes it easier for remote a CVE-2009-28447.8cfg80211 in net/wireless/scan.c in the Linux kernel 2.6.30-rc1 and other versions before 2.6.31-rc6 allows remote attackers to cause a denia CVE-2009-28467.8The eisa_eeprom_read function in the parisc isa-eeprom component (drivers/parisc/eisa_eeprom.c) in the Linux kernel before 2.6.31-rc6 allows CVE-2009-28474.9The do_sigaltstack function in kernel/signal.c in Linux kernel 2.4 through 2.4.37 and 2.6 before 2.6.31-rc5, when running on 64-bit systems,CVE-2009-28485.9The execve function in the Linux kernel, possibly 2.6.30-rc6 and earlier, does not properly clear the current->clear_child_tid pointer, whic CVE-2009-28494.7The md driver (drivers/md/md.c) in the Linux kernel before 2.6.30.2 might allow local users to cause a denial of service (NULL pointer deref CVE-2009-28509.3Multiple buffer overflows in NASA Common Data Format (CDF) allow context-dependent attackers to execute arbitrary code, as demonstrated usin CVE-2009-28514.3Cross-site scripting (XSS) vulnerability in the administrator interface in WordPress before 2.8.2 allows remote attackers to inject arbitrar CVE-2009-28526.8WP-Syntax plugin 0.9.1 and earlier for Wordpress, with register_globals enabled, allows remote attackers to execute arbitrary PHP code via t CVE-2009-285310.0Wordpress before 2.8.3 allows remote attackers to gain privileges via a direct request to (1) admin-footer.php, (2) edit-category-form.php, CVE-2009-28546.4Wordpress before 2.8.3 does not check capabilities for certain actions, which allows remote attackers to make unauthorized edits or addition CVE-2009-28555.0The strListGetItem function in src/HttpHeaderTools.c in Squid 2.7 allows remote attackers to cause a denial of service via a crafted auth he