CVE-2009-0945

Array index error in the insertItemBefore method in WebKit, as used in Apple Safari before 3.2.3...

9.3 HighFix available

Array index error in the insertItemBefore method in WebKit, as used in Apple Safari before 3.2.3 and 4 Public Beta, iPhone OS 1.0 through 2.2.1, iPhone OS for iPod touch 1.1 through 2.2.1, Google Chrome Stable before 1.0.154.65, and possibly other products allows remote attackers to execute arbitrary code via a document with a SVGPathList data structure containing a negative index in the (1) SVGTransformList, (2) SVGStringList, (3) SVGNumberList, (4) SVGPathSegList, (5) SVGPointList, or (6) SVGLengthList SVGList object, which triggers memory corruption.

Exploit likelihood

9.32%Up 0.1 points since Feb 4, 2022

What each source reports

NVD Score used 9.3

Record: CVE-2009-0945
CVSS 2.0: 9.3 HighAV:N/AC:M/Au:N/C:C/I:C/A:C
Weakness: CWE-94
Updated: 2026-11-02

CVE List No score

Record: CVE-2009-0945
Updated: 2026-11-02

EUVDEUVD-2009-0942 No score

Record: EUVD-2009-0942
Updated: 2026-11-03

GitHub AdvisoriesGHSA-8rhj-8gqw-pxm4 No score

Array index error in the insertItemBefore method in WebKit, as used in Apple Safari before 3.2.3...

Record: GHSA-8rhj-8gqw-pxm4
Weakness: CWE-94
Updated: 2026-11-02

OSV No score

Record: CVE-2009-0945
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10180-1 No score

libqt4-32bit-4.8.7-5.4 on GA media

These are all security issues fixed in the libqt4-32bit-4.8.7-5.4 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10180-1
Updated: 2026-11-02

Affected products

apple safari

Affected packages

Affected packages
Package	Affected	Fixed
`kdegraphics` Debian:4.0	before 4:3.5.5-3etch4, plus listed versions 4:3.5.5-34:3.5.5-3etch14:3.5.5-3etch24:3.5.5-3etch3	4:3.5.5-3etch4
`kdegraphics` Debian:5.0	before 4:3.5.9-3+lenny2, plus listed versions 4:3.5.9-34:3.5.9-3+lenny1	4:3.5.9-3+lenny2
`webkit` Debian:5.0	before 1.0.1-4+lenny2, plus listed versions 1.0.1-4	1.0.1-4+lenny2
`qt4-x11` Debian:5.0	before 4.4.3-1+lenny1, plus listed versions 4.4.3-1	4.4.3-1+lenny1
`kdegraphics` Red Hat:enterprise_linux:5::client_workstation	before 7:3.5.4-13.el5_3	7:3.5.4-13.el5_3
`kdegraphics-debuginfo` Red Hat:enterprise_linux:5::client_workstation	before 7:3.5.4-13.el5_3	7:3.5.4-13.el5_3
`kdegraphics-devel` Red Hat:enterprise_linux:5::client_workstation	before 7:3.5.4-13.el5_3	7:3.5.4-13.el5_3
`kdegraphics` Red Hat:enterprise_linux:5::client	before 7:3.5.4-13.el5_3	7:3.5.4-13.el5_3
`kdegraphics-debuginfo` Red Hat:enterprise_linux:5::client	before 7:3.5.4-13.el5_3	7:3.5.4-13.el5_3
`kdegraphics` Red Hat:rhel_productivity:5	before 7:3.5.4-13.el5_3	7:3.5.4-13.el5_3
`kdegraphics-debuginfo` Red Hat:rhel_productivity:5	before 7:3.5.4-13.el5_3	7:3.5.4-13.el5_3
`kdegraphics-devel` Red Hat:rhel_productivity:5	before 7:3.5.4-13.el5_3	7:3.5.4-13.el5_3

History

History
Recorded	Changed	Sources
Nov 3, 2026	affected
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2009-0945 is a high vulnerability (CVSS 9.3) in Apple Safari, published May 13, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 9.32%, the 95th percentile. Fixed in kdegraphics 4:3.5.5-3etch4.

References

Show 59 moreShow less