{"schemaVersion":3,"id":"CVE-2009-1699","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"The XSL stylesheet implementation in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not properly handle XML external entities, which allows remote attackers to read arbitrary files via a crafted DTD, as demonstrated by a file:///etc/passwd URL in an entity declaration, related to an \"XXE attack.\"","dates":{"published":"2009-06-10T17:37:00.000Z","modified":"2024-08-07T05:20:35.119Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.5,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":7.1,"severity":"high","vector":"AV:N/AC:M/Au:N/C:C/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.29098,"percentile":0.98163,"severity":"high","asOf":"2026-10-21T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-21T00:00:00.000Z","baselineScore":0.29098},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.29098,"percentile":0.98163}],"last30":[{"date":"2026-09-21T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.29098,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.29098,"percentile":0.98163}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"8907","name":"Apple Safari 3.2.x - XML External Entity Local File Theft","source":"exploit-database","url":"https://www.exploit-db.com/exploits/8907","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"remote","platforms":["multiple"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"remote","platform":"multiple","file":"exploits/multiple/remote/8907.txt","codes":[]},"metasploit":null},{"id":"REF_9B1E2C0EB98BCA0F","name":"Exploit Reference (scary.beasts.org)","source":"reference","url":"http://scary.beasts.org/security/CESA-2009-006.html","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"REF_9D90891AD7AC5ABE","name":"Exploit Reference (securityfocus.com)","source":"reference","url":"http://www.securityfocus.com/bid/35260","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"REF_3615B00919FCDE69","name":"Exploit Reference (scarybeastsecurity.blogspot.com)","source":"reference","url":"http://scarybeastsecurity.blogspot.com/2009/06/apples-safari-4-fixes-local-file-theft.html","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"33034","name":"WebKit - XML External Entity Information Disclosure","source":"exploit-database","url":"https://www.exploit-db.com/exploits/33034","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"remote","platforms":["linux"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"remote","platform":"linux","file":"exploits/linux/remote/33034.txt","codes":["CVE-2009-1699","OSVDB-54972"]},"metasploit":null}],"exploitCount":5,"weaknesses":[{"id":"CWE-611","name":"Improper Restriction of XML External Entity Reference","description":"The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/611.html"}],"affected":[{"vendor":"apple","product":"iphone_os","name":"iphone os","label":"iphone_os","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 1.0.0, ≤ 2.2.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 1.0.0, ≤ 2.2.1","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"ios","label":"Apple iOS","category":"os"}},"hubHref":"/vendor/apple/iphone_os"},{"vendor":"apple","product":"safari","name":"Safari","label":"safari","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 4.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.0","eol":null,"hubHref":"/vendor/apple/safari"},{"vendor":"canonical","product":"ubuntu_linux","name":"ubuntu linux","label":"ubuntu_linux","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"8.10","noFixRecorded":false,"fixedIn":null},{"text":"9.04","noFixRecorded":false,"fixedIn":null}],"versionsText":"8.10 | 9.04","eol":{"isEol":true,"eolDate":"2010-04-30T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"8.10","label":"8.10 'Intrepid Ibex'","eolFrom":"2010-04-30T00:00:00.000Z","isLts":false,"isMaintained":false,"latestVersion":"8.10"},"product":{"name":"ubuntu","label":"Ubuntu","category":"os"}},"hubHref":"/vendor/canonical/ubuntu_linux"},{"vendor":"opensuse","product":"opensuse","name":"opensuse","label":"opensuse","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"11.2","noFixRecorded":false,"fixedIn":null},{"text":"11.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"11.2 | 11.3","eol":{"isEol":true,"eolDate":"2011-05-12T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"11.2","label":"11.2","eolFrom":"2011-05-12T00:00:00.000Z","isLts":false,"isMaintained":false,"latestVersion":null},"product":{"name":"opensuse","label":"openSUSE","category":"os"}},"hubHref":"/vendor/opensuse/opensuse"}],"affectedCount":4,"eol":{"hasEol":true,"count":2},"references":[{"url":"http://support.apple.com/kb/HT3639","label":"support.apple.com/kb/HT3639","hostname":"support.apple.com","tags":["X Refsource CONFIRM","Vendor Advisory"]},{"url":"http://secunia.com/advisories/43068","label":"secunia.com/advisories/43068","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Broken Link"]},{"url":"http://www.vupen.com/english/advisories/2009/1621","label":"www.vupen.com/english/advisories/2009/1621","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN","Broken Link"]},{"url":"https://www.exploit-db.com/exploits/8907","label":"www.exploit-db.com/exploits/8907","hostname":"www.exploit-db.com","tags":["Exploit","X Refsource EXPLOIT DB","Third Party Advisory","VDB Entry"]},{"url":"http://www.vupen.com/english/advisories/2011/0212","label":"www.vupen.com/english/advisories/2011/0212","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN","Broken Link"]},{"url":"http://scary.beasts.org/security/CESA-2009-006.html","label":"scary.beasts.org/security/CESA-2009-006.html","hostname":"scary.beasts.org","tags":["X Refsource MISC","Exploit"]},{"url":"http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html","label":"lists.apple.com/archives/security-announce/2009/jun/msg00002.html","hostname":"lists.apple.com","tags":["Vendor Advisory","X Refsource APPLE","Broken Link","Mailing List","Patch"]},{"url":"http://osvdb.org/54972","label":"osvdb.org/54972","hostname":"osvdb.org","tags":["VDB Entry","X Refsource OSVDB","Broken Link"]},{"url":"http://www.securityfocus.com/bid/35260","label":"www.securityfocus.com/bid/35260","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Broken Link","Exploit","Third Party Advisory"]},{"url":"http://www.vupen.com/english/advisories/2009/1522","label":"www.vupen.com/english/advisories/2009/1522","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN","Broken Link","Patch","Vendor Advisory"]},{"url":"http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html","label":"lists.apple.com/archives/security-announce/2009/Jun/msg00005.html","hostname":"lists.apple.com","tags":["Vendor Advisory","X Refsource APPLE","Mailing List"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html","label":"lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html","hostname":"lists.opensuse.org","tags":["Vendor Advisory","X Refsource SUSE","Mailing List"]},{"url":"http://secunia.com/advisories/35379","label":"secunia.com/advisories/35379","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Broken Link","Vendor Advisory"]},{"url":"http://www.ubuntu.com/usn/USN-857-1","label":"www.ubuntu.com/usn/USN-857-1","hostname":"www.ubuntu.com","tags":["Vendor Advisory","X Refsource UBUNTU","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/35321","label":"www.securityfocus.com/bid/35321","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Broken Link","Third Party Advisory"]},{"url":"http://scarybeastsecurity.blogspot.com/2009/06/apples-safari-4-fixes-local-file-theft.html","label":"scarybeastsecurity.blogspot.com/2009/06/apples-safari-4-fixes-local-file-theft.html","hostname":"scarybeastsecurity.blogspot.com","tags":["X Refsource MISC","Exploit"]},{"url":"http://support.apple.com/kb/HT3613","label":"support.apple.com/kb/HT3613","hostname":"support.apple.com","tags":["X Refsource CONFIRM","Patch","Vendor Advisory"]}],"lineage":{"upstream":[],"downstream":["DSA-1988-1"],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2009-06-10T17:37:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-07T05:20:35.119Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":46,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T15:36:52.655Z","stale":false,"partial":false}}