{"id":"CVE-2009-0945","aliases":["DSA-1866-1","DSA-1950-1","DSA-1988-1","EUVD-2009-0942","GHSA-8rhj-8gqw-pxm4","RHSA-2009:1130","openSUSE-SU-2024:10180-1"],"status":"published","title":"Array index error in the insertItemBefore method in WebKit, as used in Apple Safari before 3.2.3...","description":"Array index error in the insertItemBefore method in WebKit, as used in Apple Safari before 3.2.3 and 4 Public Beta, iPhone OS 1.0 through 2.2.1, iPhone OS for iPod touch 1.1 through 2.2.1, Google Chrome Stable before 1.0.154.65, and possibly other products allows remote attackers to execute arbitrary code via a document with a SVGPathList data structure containing a negative index in the (1) SVGTransformList, (2) SVGStringList, (3) SVGNumberList, (4) SVGPathSegList, (5) SVGPointList, or (6) SVGLengthList SVGList object, which triggers memory corruption.","severity":{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.09322,"percentile":0.95419,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-94"],"published":"2009-05-13T17:00:00Z","modified":"2026-06-26T12:18:39Z","affected":[{"source":"osv","ecosystem":"Debian:4.0","package":"kdegraphics","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:3.5.5-3etch4"}]}],"versions":["4:3.5.5-3","4:3.5.5-3etch1","4:3.5.5-3etch2","4:3.5.5-3etch3"],"bundled":2},{"source":"osv","ecosystem":"Debian:5.0","package":"kdegraphics","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:3.5.9-3+lenny2"}]}],"versions":["4:3.5.9-3","4:3.5.9-3+lenny1"],"bundled":2},{"source":"osv","ecosystem":"Debian:5.0","package":"webkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-4+lenny2"}]}],"versions":["1.0.1-4"],"bundled":16},{"source":"osv","ecosystem":"Debian:5.0","package":"qt4-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.3-1+lenny1"}]}],"versions":["4.4.3-1"],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"kdegraphics","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.5.4-13.el5_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"kdegraphics-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.5.4-13.el5_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"kdegraphics-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.5.4-13.el5_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"kdegraphics","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.5.4-13.el5_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"kdegraphics-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.5.4-13.el5_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_productivity:5","package":"kdegraphics","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.5.4-13.el5_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_productivity:5","package":"kdegraphics-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.5.4-13.el5_3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_productivity:5","package":"kdegraphics-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.5.4-13.el5_3"}]}],"bundled":2}],"products":[{"vendor":"apple","product":"safari"}],"references":[{"url":"http://www.ubuntu.com/usn/USN-822-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/35805","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://support.apple.com/kb/HT3639","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://secunia.com/advisories/43068","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2009-July/msg01177.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://www.vupen.com/english/advisories/2009/1621","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","advisory"]},{"url":"http://support.apple.com/kb/HT3549","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix"]},{"url":"http://googlechromereleases.blogspot.com/2009/05/stable-update-bug-fix.html","tags":["x_refsource_CONFIRM","x_transferred","article"]},{"url":"http://www.vupen.com/english/advisories/2011/0212","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","advisory"]},{"url":"http://www.securitytracker.com/id?1022207","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"http://www.securityfocus.com/archive/1/503594/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","web"]},{"url":"http://www.redhat.com/support/errata/RHSA-2009-1130.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","web"]},{"url":"http://www.vupen.com/english/advisories/2009/1298","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/35576","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/35074","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/37746","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/36790","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","web"]},{"url":"http://lists.apple.com/archives/security-announce/2009/May/msg00002.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","Patch","Vendor Advisory","fix"]},{"url":"http://secunia.com/advisories/35056","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www.zerodayinitiative.com/advisories/ZDI-09-022","tags":["x_refsource_MISC","x_transferred","advisory"]},{"url":"http://www.securityfocus.com/bid/34924","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://secunia.com/advisories/36461","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/50477","tags":["vdb-entry","x_refsource_XF","x_transferred","web"]},{"url":"http://lists.apple.com/archives/security-announce/2009/May/msg00000.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","Patch","Vendor Advisory","fix"]},{"url":"https://usn.ubuntu.com/823-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"http://www.debian.org/security/2009/dsa-1950","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://secunia.com/advisories/36062","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-857-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://lists.apple.com/archives/security-announce/2009/May/msg00001.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","Patch","Vendor Advisory","fix"]},{"url":"http://www.us-cert.gov/cas/techalerts/TA09-133A.html","tags":["third-party-advisory","x_refsource_CERT","x_transferred","US Government Resource","web"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11584","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred","web"]},{"url":"http://www.vupen.com/english/advisories/2009/1297","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/35095","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2009-July/msg01196.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://support.apple.com/kb/HT3550","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00303.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://www.ubuntu.com/usn/USN-836-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://www.vupen.com/english/advisories/2009/1321","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","advisory"]},{"url":"http://code.google.com/p/chromium/issues/detail?id=9019","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-0945","tags":["advisory"]},{"url":"https://usn.ubuntu.com/823-1"},{"url":"https://github.com/advisories/GHSA-8rhj-8gqw-pxm4"},{"url":"https://access.redhat.com/errata/RHSA-2009:1130","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#critical","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=506246","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=506703","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1130.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-0945","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-0945","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-1709","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-1709","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-1709","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2009-0945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-3193","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-3922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4929","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-6093","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0254","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4549","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0295","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1858","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1859","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1860","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2009-0945","description":"Array index error in the insertItemBefore method in WebKit, as used in Apple Safari before 3.2.3 and 4 Public Beta, iPhone OS 1.0 through 2.2.1, iPhone OS for iPod touch 1.1 through 2.2.1, Google Chrome Stable before 1.0.154.65, and possibly other products allows remote attackers to execute arbitrary code via a document with a SVGPathList data structure containing a negative index in the (1) SVGTransformList, (2) SVGStringList, (3) SVGNumberList, (4) SVGPathSegList, (5) SVGPointList, or (6) SVGLengthList SVGList object, which triggers memory corruption.","status":"published","published":"2009-05-13T17:00:00Z","modified":"2024-08-07T04:57:17.523Z","updated_at":"2026-11-02T14:33:26.302774Z"}],"euvd":[{"id":"EUVD-2009-0942","description":"Array index error in the insertItemBefore method in WebKit, as used in Apple Safari before 3.2.3 and 4 Public Beta, iPhone OS 1.0 through 2.2.1, iPhone OS for iPod touch 1.1 through 2.2.1, Google Chrome Stable before 1.0.154.65, and possibly other products allows remote attackers to execute arbitrary code via a document with a SVGPathList data structure containing a negative index in the (1) SVGTransformList, (2) SVGStringList, (3) SVGNumberList, (4) SVGPathSegList, (5) SVGPointList, or (6) SVGLengthList SVGList object, which triggers memory corruption.","status":"published","published":"2009-05-13T17:00:00Z","modified":"2024-08-07T04:57:17Z","updated_at":"2026-11-03T01:39:23.782527Z"}],"ghsa":[{"id":"GHSA-8rhj-8gqw-pxm4","title":"Array index error in the insertItemBefore method in WebKit, as used in Apple Safari before 3.2.3...","description":"Array index error in the insertItemBefore method in WebKit, as used in Apple Safari before 3.2.3 and 4 Public Beta, iPhone OS 1.0 through 2.2.1, iPhone OS for iPod touch 1.1 through 2.2.1, Google Chrome Stable before 1.0.154.65, and possibly other products allows remote attackers to execute arbitrary code via a document with a SVGPathList data structure containing a negative index in the (1) SVGTransformList, (2) SVGStringList, (3) SVGNumberList, (4) SVGPathSegList, (5) SVGPointList, or (6) SVGLengthList SVGList object, which triggers memory corruption.","status":"published","published":"2022-05-02T03:20:00Z","modified":"2025-04-09T04:10:51Z","cwes":["CWE-94"],"updated_at":"2026-11-02T15:01:00.026247Z"}],"nvd":[{"id":"CVE-2009-0945","description":"Array index error in the insertItemBefore method in WebKit, as used in Apple Safari before 3.2.3 and 4 Public Beta, iPhone OS 1.0 through 2.2.1, iPhone OS for iPod touch 1.1 through 2.2.1, Google Chrome Stable before 1.0.154.65, and possibly other products allows remote attackers to execute arbitrary code via a document with a SVGPathList data structure containing a negative index in the (1) SVGTransformList, (2) SVGStringList, (3) SVGNumberList, (4) SVGPathSegList, (5) SVGPointList, or (6) SVGLengthList SVGList object, which triggers memory corruption.","status":"published","published":"2009-05-13T17:30:00.187Z","modified":"2026-06-16T23:06:10.023Z","cvss":[{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:01:35.136779Z"}],"osv":[{"id":"CVE-2009-0945","description":"Array index error in the insertItemBefore method in WebKit, as used in Apple Safari before 3.2.3 and 4 Public Beta, iPhone OS 1.0 through 2.2.1, iPhone OS for iPod touch 1.1 through 2.2.1, Google Chrome Stable before 1.0.154.65, and possibly other products allows remote attackers to execute arbitrary code via a document with a SVGPathList data structure containing a negative index in the (1) SVGTransformList, (2) SVGStringList, (3) SVGNumberList, (4) SVGPathSegList, (5) SVGPointList, or (6) SVGLengthList SVGList object, which triggers memory corruption.","status":"withdrawn","published":"2009-05-13T17:30:00Z","modified":"2024-06-30T15:59:07.737739Z","updated_at":"2026-11-02T15:43:57.452479Z"},{"id":"DSA-1866-1","title":"kdegraphics - several vulnerabilities","status":"published","published":"2009-08-19T00:00:00Z","modified":"2026-03-09T01:22:20.391529Z","updated_at":"2026-11-02T15:46:14.734124Z"},{"id":"DSA-1950-1","title":"webkit - several vulnerabilities","status":"published","published":"2009-12-12T00:00:00Z","modified":"2026-03-09T01:21:30.335823Z","updated_at":"2026-11-02T15:46:15.108335Z"},{"id":"DSA-1988-1","title":"qt4-x11 - several vulnerabilities","status":"published","published":"2010-02-02T00:00:00Z","modified":"2026-03-09T01:22:40.009614Z","updated_at":"2026-11-02T15:46:15.108335Z"},{"id":"openSUSE-SU-2024:10180-1","title":"libqt4-32bit-4.8.7-5.4 on GA media","description":"These are all security issues fixed in the libqt4-32bit-4.8.7-5.4 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:34:43.783361Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"RHSA-2009:1130","title":"Red Hat Security Advisory: kdegraphics security update","status":"published","published":"2024-09-15T18:01:11Z","modified":"2026-06-26T12:18:39.268951705Z","updated_at":"2026-11-02T15:53:00.468834Z"}]}}