Bug 284134 (CVE-2009-1699)

Summary:	[TRACKER] WebKit XSL external entity File Disclosure (CVE-2009-1699)
Product:	Gentoo Security	Reporter:	Alex Legler (RETIRED) <a3li>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	minor	Keywords:	Tracker
Priority:	High
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1699
Whiteboard:	B4 [ebuild]
Package list:		Runtime testing required:	---

Description Alex Legler (RETIRED) archtester

2009-09-08 11:04:02 UTC

CVE-2009-1699 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-1699):
  The XSL stylesheet implementation in WebKit in Apple Safari before
  4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1
  through 2.2.1 does not properly handle XML external entities, which
  allows remote attackers to read arbitrary files via a crafted DTD,
  as demonstrated by a file:///etc/passwd URL in an entity
  declaration, related to an "XXE attack."

Comment 1 Chris Reffett (RETIRED) gentoo-dev

2013-09-12 22:08:40 UTC

Presumably all affected versions are gone from tree. Closing as discussed with keytoaster.