{"schemaVersion":3,"id":"CVE-2009-0945","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Array index error in the insertItemBefore method in WebKit, as used in Apple Safari before 3.2.3 and 4 Public Beta, iPhone OS 1.0 through 2.2.1, iPhone OS for iPod touch 1.1 through 2.2.1, Google Chrome Stable before 1.0.154.65, and possibly other products allows remote attackers to execute arbitrary code via a document with a SVGPathList data structure containing a negative index in the (1) SVGTransformList, (2) SVGStringList, (3) SVGNumberList, (4) SVGPathSegList, (5) SVGPointList, or (6) SVGLengthList SVGList object, which triggers memory corruption.","dates":{"published":"2009-05-13T17:00:00.000Z","modified":"2024-08-07T04:57:17.523Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":9.3,"severity":"high","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","computed":false,"selection":"backend-summary"},"metrics":[{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":9.3,"severity":"high","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.09322,"percentile":0.95342,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.09322},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.09322,"percentile":0.95342}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.09322,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.09322,"percentile":0.95342}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-94","name":"Improper Control of Generation of Code ('Code Injection')","description":"The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/94.html"}],"affected":[{"vendor":"apple","product":"safari","name":"safari","label":"safari","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 3.2.2","noFixRecorded":false,"fixedIn":null},{"text":"0.8","noFixRecorded":false,"fixedIn":null},{"text":"0.9","noFixRecorded":false,"fixedIn":null},{"text":"1.0","noFixRecorded":false,"fixedIn":null},{"text":"1.0:beta","noFixRecorded":false,"fixedIn":null},{"text":"1.0:beta2","noFixRecorded":false,"fixedIn":null},{"text":"1.0.0","noFixRecorded":false,"fixedIn":null},{"text":"1.0.0b1","noFixRecorded":false,"fixedIn":null},{"text":"1.0.0b2","noFixRecorded":false,"fixedIn":null},{"text":"1.0.1","noFixRecorded":false,"fixedIn":null},{"text":"1.0.2","noFixRecorded":false,"fixedIn":null},{"text":"1.0.3","noFixRecorded":false,"fixedIn":null},{"text":"1.0.3:85.8","noFixRecorded":false,"fixedIn":null},{"text":"1.0.3:85.8.1","noFixRecorded":false,"fixedIn":null},{"text":"1.1","noFixRecorded":false,"fixedIn":null},{"text":"1.1.0","noFixRecorded":false,"fixedIn":null},{"text":"1.1.1","noFixRecorded":false,"fixedIn":null},{"text":"1.2","noFixRecorded":false,"fixedIn":null},{"text":"1.2.0","noFixRecorded":false,"fixedIn":null},{"text":"1.2.1","noFixRecorded":false,"fixedIn":null},{"text":"1.2.2","noFixRecorded":false,"fixedIn":null},{"text":"1.2.3","noFixRecorded":false,"fixedIn":null},{"text":"1.2.4","noFixRecorded":false,"fixedIn":null},{"text":"1.2.5","noFixRecorded":false,"fixedIn":null},{"text":"1.3","noFixRecorded":false,"fixedIn":null},{"text":"1.3.0","noFixRecorded":false,"fixedIn":null},{"text":"1.3.1","noFixRecorded":false,"fixedIn":null},{"text":"1.3.2","noFixRecorded":false,"fixedIn":null},{"text":"1.3.2:312.5","noFixRecorded":false,"fixedIn":null},{"text":"1.3.2:312.6","noFixRecorded":false,"fixedIn":null},{"text":"2","noFixRecorded":false,"fixedIn":null},{"text":"2.0","noFixRecorded":false,"fixedIn":null},{"text":"2.0.0","noFixRecorded":false,"fixedIn":null},{"text":"2.0.1","noFixRecorded":false,"fixedIn":null},{"text":"2.0.2","noFixRecorded":false,"fixedIn":null},{"text":"2.0.3","noFixRecorded":false,"fixedIn":null},{"text":"2.0.3:417.8","noFixRecorded":false,"fixedIn":null},{"text":"2.0.3:417.9","noFixRecorded":false,"fixedIn":null},{"text":"2.0.3:417.9.2","noFixRecorded":false,"fixedIn":null},{"text":"2.0.4","noFixRecorded":false,"fixedIn":null},{"text":"3","noFixRecorded":false,"fixedIn":null},{"text":"3.0","noFixRecorded":false,"fixedIn":null},{"text":"3.0.0","noFixRecorded":false,"fixedIn":null},{"text":"3.0.1","noFixRecorded":false,"fixedIn":null},{"text":"3.0.2","noFixRecorded":false,"fixedIn":null},{"text":"3.0.3","noFixRecorded":false,"fixedIn":null},{"text":"3.0.4","noFixRecorded":false,"fixedIn":null},{"text":"3.1","noFixRecorded":false,"fixedIn":null},{"text":"3.1.0","noFixRecorded":false,"fixedIn":null},{"text":"3.1.1","noFixRecorded":false,"fixedIn":null},{"text":"3.1.2","noFixRecorded":false,"fixedIn":null},{"text":"3.2","noFixRecorded":false,"fixedIn":null},{"text":"3.2.0","noFixRecorded":false,"fixedIn":null},{"text":"3.2.1","noFixRecorded":false,"fixedIn":null},{"text":"4.0:beta","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 3.2.2 | 0.8 | 0.9 | 1.0 | 1.0:beta | 1.0:beta2 | 1.0.0 | 1.0.0b1 | 1.0.0b2 | 1.0.1 | 1.0.2 | 1.0.3 | 1.0.3:85.8 | 1.0.3:85.8.1 | 1.1 | 1.1.0 | 1.1.1 | 1.2 | 1.2.0 | 1.2.1 | 1.2.2 | 1.2.3 | 1.2.4 | 1.2.5 | 1.3 | 1.3.0 | 1.3.1 | 1.3.2 | 1.3.2:312.5 | 1.3.2:312.6 | 2 | 2.0 | 2.0.0 | 2.0.1 | 2.0.2 | 2.0.3 | 2.0.3:417.8 | 2.0.3:417.9 | 2.0.3:417.9.2 | 2.0.4 | 3 | 3.0 | 3.0.0 | 3.0.1 | 3.0.2 | 3.0.3 | 3.0.4 | 3.1 | 3.1.0 | 3.1.1 | 3.1.2 | 3.2 | 3.2.0 | 3.2.1 | 4.0:beta","eol":null,"hubHref":"/vendor/apple/safari"},{"vendor":"debian","product":"kde4libs","name":"kde4libs","label":"kde4libs","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/kde4libs","purlType":"deb","versions":[{"text":"< 4:4.3.0-1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4:4.3.0-1","eol":null,"hubHref":null},{"vendor":"debian","product":"qt4-x11","name":"qt4-x11","label":"qt4-x11","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/qt4-x11","purlType":"deb","versions":[{"text":"< 4:4.5.2-1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4:4.5.2-1","eol":null,"hubHref":null}],"affectedCount":3,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://www.ubuntu.com/usn/USN-822-1","label":"www.ubuntu.com/usn/USN-822-1","hostname":"www.ubuntu.com","tags":["Vendor Advisory","X Refsource UBUNTU","Advisory"]},{"url":"http://secunia.com/advisories/35805","label":"secunia.com/advisories/35805","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Advisory"]},{"url":"http://support.apple.com/kb/HT3639","label":"support.apple.com/kb/HT3639","hostname":"support.apple.com","tags":["X Refsource CONFIRM","WEB"]},{"url":"http://secunia.com/advisories/43068","label":"secunia.com/advisories/43068","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Advisory"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2009-July/msg01177.html","label":"www.redhat.com/archives/fedora-package-announce/2009-July/msg01177.html","hostname":"www.redhat.com","tags":["Vendor Advisory","X Refsource FEDORA","WEB"]},{"url":"http://www.vupen.com/english/advisories/2009/1621","label":"www.vupen.com/english/advisories/2009/1621","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN","Advisory"]},{"url":"http://support.apple.com/kb/HT3549","label":"support.apple.com/kb/HT3549","hostname":"support.apple.com","tags":["X Refsource CONFIRM","Patch","Vendor Advisory","FIX"]},{"url":"http://googlechromereleases.blogspot.com/2009/05/stable-update-bug-fix.html","label":"googlechromereleases.blogspot.com/2009/05/stable-update-bug-fix.html","hostname":"googlechromereleases.blogspot.com","tags":["X Refsource CONFIRM","ARTICLE"]},{"url":"http://www.vupen.com/english/advisories/2011/0212","label":"www.vupen.com/english/advisories/2011/0212","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN","Advisory"]},{"url":"http://www.securitytracker.com/id?1022207","label":"www.securitytracker.com/id?1022207","hostname":"www.securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK","WEB"]},{"url":"http://www.securityfocus.com/archive/1/503594/100/0/threaded","label":"www.securityfocus.com/archive/1/503594/100/0/threaded","hostname":"www.securityfocus.com","tags":["Mailing List","X Refsource BUGTRAQ","WEB"]},{"url":"http://www.redhat.com/support/errata/RHSA-2009-1130.html","label":"www.redhat.com/support/errata/RHSA-2009-1130.html","hostname":"www.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","WEB"]},{"url":"http://www.vupen.com/english/advisories/2009/1298","label":"www.vupen.com/english/advisories/2009/1298","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN","Advisory"]},{"url":"http://secunia.com/advisories/35576","label":"secunia.com/advisories/35576","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Advisory"]},{"url":"http://secunia.com/advisories/35074","label":"secunia.com/advisories/35074","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Advisory"]},{"url":"http://secunia.com/advisories/37746","label":"secunia.com/advisories/37746","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Advisory"]},{"url":"http://secunia.com/advisories/36790","label":"secunia.com/advisories/36790","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Advisory"]},{"url":"http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html","label":"lists.apple.com/archives/security-announce/2009/Jun/msg00005.html","hostname":"lists.apple.com","tags":["Vendor Advisory","X Refsource APPLE","WEB"]},{"url":"http://lists.apple.com/archives/security-announce/2009/May/msg00002.html","label":"lists.apple.com/archives/security-announce/2009/May/msg00002.html","hostname":"lists.apple.com","tags":["Vendor Advisory","X Refsource APPLE","Patch","FIX"]},{"url":"http://secunia.com/advisories/35056","label":"secunia.com/advisories/35056","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Advisory"]},{"url":"http://www.zerodayinitiative.com/advisories/ZDI-09-022","label":"www.zerodayinitiative.com/advisories/ZDI-09-022","hostname":"www.zerodayinitiative.com","tags":["X Refsource MISC","Advisory"]},{"url":"http://www.securityfocus.com/bid/34924","label":"www.securityfocus.com/bid/34924","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","WEB"]},{"url":"http://secunia.com/advisories/36461","label":"secunia.com/advisories/36461","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/50477","label":"exchange.xforce.ibmcloud.com/vulnerabilities/50477","hostname":"exchange.xforce.ibmcloud.com","tags":["VDB Entry","X Refsource XF","WEB"]},{"url":"http://lists.apple.com/archives/security-announce/2009/May/msg00000.html","label":"lists.apple.com/archives/security-announce/2009/May/msg00000.html","hostname":"lists.apple.com","tags":["Vendor Advisory","X Refsource APPLE","Patch","FIX"]},{"url":"https://usn.ubuntu.com/823-1/","label":"usn.ubuntu.com/823-1/","hostname":"usn.ubuntu.com","tags":["Vendor Advisory","X Refsource UBUNTU","WEB"]},{"url":"http://www.debian.org/security/2009/dsa-1950","label":"www.debian.org/security/2009/dsa-1950","hostname":"www.debian.org","tags":["Vendor Advisory","X Refsource DEBIAN","Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html","label":"lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html","hostname":"lists.opensuse.org","tags":["Vendor Advisory","X Refsource SUSE","WEB"]},{"url":"http://secunia.com/advisories/36062","label":"secunia.com/advisories/36062","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Advisory"]},{"url":"http://www.ubuntu.com/usn/USN-857-1","label":"www.ubuntu.com/usn/USN-857-1","hostname":"www.ubuntu.com","tags":["Vendor Advisory","X Refsource UBUNTU","Advisory"]},{"url":"http://lists.apple.com/archives/security-announce/2009/May/msg00001.html","label":"lists.apple.com/archives/security-announce/2009/May/msg00001.html","hostname":"lists.apple.com","tags":["Vendor Advisory","X Refsource APPLE","Patch","FIX"]},{"url":"http://www.us-cert.gov/cas/techalerts/TA09-133A.html","label":"www.us-cert.gov/cas/techalerts/TA09-133A.html","hostname":"www.us-cert.gov","tags":["Third Party Advisory","X Refsource CERT","US Government Resource","WEB"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11584","label":"oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11584","hostname":"oval.cisecurity.org","tags":["VDB Entry","Signature","X Refsource OVAL","WEB"]},{"url":"http://www.vupen.com/english/advisories/2009/1297","label":"www.vupen.com/english/advisories/2009/1297","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN","Advisory"]},{"url":"http://secunia.com/advisories/35095","label":"secunia.com/advisories/35095","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Advisory"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2009-July/msg01196.html","label":"www.redhat.com/archives/fedora-package-announce/2009-July/msg01196.html","hostname":"www.redhat.com","tags":["Vendor Advisory","X Refsource FEDORA","WEB"]},{"url":"http://support.apple.com/kb/HT3550","label":"support.apple.com/kb/HT3550","hostname":"support.apple.com","tags":["X Refsource CONFIRM","WEB"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00303.html","label":"www.redhat.com/archives/fedora-package-announce/2009-July/msg00303.html","hostname":"www.redhat.com","tags":["Vendor Advisory","X Refsource FEDORA","WEB"]},{"url":"http://www.ubuntu.com/usn/USN-836-1","label":"www.ubuntu.com/usn/USN-836-1","hostname":"www.ubuntu.com","tags":["Vendor Advisory","X Refsource UBUNTU","Advisory"]},{"url":"http://www.vupen.com/english/advisories/2009/1321","label":"www.vupen.com/english/advisories/2009/1321","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN","Advisory"]},{"url":"http://code.google.com/p/chromium/issues/detail?id=9019","label":"code.google.com/p/chromium/issues/detail?id=9019","hostname":"code.google.com","tags":["X Refsource CONFIRM","WEB"]}],"lineage":{"upstream":[],"downstream":["DSA-1866-1","DSA-1950-1","DSA-1988-1","RHSA-2009:1130"],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2009-05-13T17:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-07T04:57:17.523Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":70,"level":"high","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T15:58:12.498Z","stale":false,"partial":false}}