The Mail component in Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1 dismisses the call approval dialog w…

published 2009-06-19 17 y ago modified 2026-06-16 4 mo ago also EUVD-2009-0958

cvss: 5.0; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 6.4%; EPSS 6.4% chance of exploitation in 30 days, percentile 93%
public exploits: 3; Exploit-DB

The Mail component in Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1 dismisses the call approval dialog when another alert appears, which might allow remote attackers to force the iPhone to place a call without user approval by causing an application to trigger an alert.

Patch / fix

links 1

support.apple.com/kb/HT3639 advisory

Timeline

2009-05-17 First public exploit (EDB-33046)
2009-06-19 Published

Exploit prediction

6.38% chance of exploitation in the next 30 days, higher than 93% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

EDB-33046 Apple iPhone 2.2.1 - Call Approval Dialog Security Bypass (3) remote, 2009-05-17
EDB-33045 Apple iPhone 2.2.1 - Call Approval Dialog Security Bypass (2) remote, 2009-05-17
EDB-33044 Apple iPhone 2.2.1 - Call Approval Dialog Security Bypass (1) remote, 2009-05-17

CVSS scores

assigned by	version	score	vector
NVD	2.0	5.0	AV:N/AC:L/Au:N/C:N/I:P/A:N

References

support.apple.com /kb/HT3639
patch, vendor-advisory
lists.apple.com /archives/security-announce/2009/Jun/msg00005.html
vendor-advisory
vupen.com /english/advisories/2009/1621
vdb-entry
osvdb.org /55238
vdb-entry
securityfocus.com /bid/35414
vdb-entry
exchange.xforce.ibmcloud.com /vulnerabilities/51210
vdb-entry

Sources

CVE List CVE-2009-0961
NVD CVE-2009-0961

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary