CVE-2009-2199 json
Incomplete blacklist vulnerability in WebKit in Apple Safari before 4.0.3, as used on iPhone OS before 3.1, iPhone OS before 3.1.1 for iPod…
published 2009-08-12 17 y ago modified 2026-06-16 4 mo ago also EUVD-2009-2195
- cvss
- 5.8
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.6%
- EPSS 2.6% chance of exploitation in 30 days, percentile 85%
- public exploits
- 0
- none known
Summary
Incomplete blacklist vulnerability in WebKit in Apple Safari before 4.0.3, as used on iPhone OS before 3.1, iPhone OS before 3.1.1 for iPod touch, and other platforms, allows remote attackers to spoof domain names in URLs, and possibly conduct phishing attacks, via unspecified homoglyphs.
Patch / fix
Exploit prediction
2.59% chance of exploitation in the next 30 days, higher than 85% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 5.8 | AV:N/AC:M/Au:N/C:N/I:P/A:P |
References
-
lists.apple.com
/archives/security-announce/2009/Aug/msg00002.html
vendor-advisory, patch
-
securityfocus.com
/bid/36026
vdb-entry, patch
-
support.apple.com
/kb/HT3733
patch, vendor-advisory
-
lists.opensuse.org
/opensuse-security-announce/2011-01/msg00006.html
vendor-advisory
-
lists.apple.com
/archives/security-announce/2009/Sep/msg00001.html
vendor-advisory
-
secunia.com
/advisories/43068
third-party-advisory, vendor-advisory
-
vupen.com
/english/advisories/2011/0212
vdb-entry, vendor-advisory
-
secunia.com
/advisories/36677
third-party-advisory, vendor-advisory
-
securitytracker.com
/id?1022719
vdb-entry
- support.apple.com /kb/HT3860
Sources
- CVE List CVE-2009-2199
- NVD CVE-2009-2199
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.