CVE-2009-1704 json
CFNetwork in Apple Safari before 4.0 misinterprets downloaded image files as local HTML documents in unspecified circumstances, which allow…
published 2009-06-10 17 y ago modified 2026-06-16 4 mo ago also EUVD-2009-1699
- cvss
- 9.3
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.5%
- EPSS 2.5% chance of exploitation in 30 days, percentile 85%
- public exploits
- 0
- none known
Summary
CFNetwork in Apple Safari before 4.0 misinterprets downloaded image files as local HTML documents in unspecified circumstances, which allows remote attackers to execute arbitrary JavaScript code by placing it in an image file.
Patch / fix
Exploit prediction
2.55% chance of exploitation in the next 30 days, higher than 85% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- securityfocus.com http://www.securityfocus.com/bid/35260 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 9.3 | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Classification
- Weakness
-
- CWE-94 Improper Control of Generation of Code
References
-
lists.apple.com
/archives/security-announce/2009/jun/msg00002.html
vendor-advisory, patch
-
securitytracker.com
/id?1022343
vdb-entry, patch
-
vupen.com
/english/advisories/2009/1522
vdb-entry, patch, vendor-advisory
-
support.apple.com
/kb/HT3613
patch, vendor-advisory
-
securityfocus.com
/bid/35260
vdb-entry, exploit
-
secunia.com
/advisories/35379
third-party-advisory, vendor-advisory
-
securityfocus.com
/bid/35344
vdb-entry
-
osvdb.org
/55010
vdb-entry
Sources
- CVE List CVE-2009-1704
- NVD CVE-2009-1704
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.