CVE-2008-2303 in the critical feed json
Integer signedness error in Safari on Apple iPhone before 2.0 and iPod touch before 2.0 allows remote attackers to execute arbitrary code o…
published 2008-07-14 18 y ago modified 2026-06-16 4 mo ago also EUVD-2008-2299
- cvss
- 10.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 13.0%
- EPSS 13.0% chance of exploitation in 30 days, percentile 96%
- public exploits
- 1
- Exploit-DB
Summary
Integer signedness error in Safari on Apple iPhone before 2.0 and iPod touch before 2.0 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving JavaScript array indices that trigger an out-of-bounds access, a different vulnerability than CVE-2008-2307.
Timeline
- First public exploit (EDB-32048)
- Published
Exploit prediction
12.99% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-32048 Apple iPhone / Apple iPod Touch < 2.0 - Multiple Remote Vulnerabilities remote, 2008-07-11
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Classification
- Weakness
-
- CWE-189 Numeric Errors
References
-
lists.apple.com
/archives/security-announce//2008/Nov/msg00001.html
vendor-advisory
-
lists.apple.com
/archives/security-announce/2008//Jul/msg00001.html
vendor-advisory
-
exchange.xforce.ibmcloud.com
/vulnerabilities/43736
vdb-entry
-
securityfocus.com
/bid/30186
vdb-entry
-
secunia.com
/advisories/32706
third-party-advisory
- support.apple.com /kb/HT3298
-
vupen.com
/english/advisories/2008/2094/references
vdb-entry
-
secunia.com
/advisories/31074
third-party-advisory
Sources
- CVE List CVE-2008-2303
- NVD CVE-2008-2303
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.