CVE-2009-0070 Integer overflow in n/a

Critical 9.3 Published 8 Jan 2009 Updated 7 Aug 2024

Remote attackers can read arbitrary memory and crash Apple Safari via a JavaScript integer signedness error, requiring user interaction.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2009-0070?

CVE-2009-0070 is a critical vulnerability in Apple Safari, published on 8 Jan 2009. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Integer signedness error in Apple Safari allows remote attackers to read the contents of arbitrary memory locations, cause a denial of service (application crash), and probably have unspecified other impact via the array index of the arguments array in a JavaScript function, possibly a related issue to CVE-2008-2307.

Weakness: CWE-189

Which versions are affected by CVE-2009-0070?

It affects 1 product.

Products include Apple Safari.

How do I fix CVE-2009-0070?

No fix has been published for CVE-2009-0070 yet. Limit exposure of the affected software until one is available.

Is CVE-2009-0070 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2009-0070 exists.

Public exploit code: 1 Exploit-DB entry.

All Apple Safari vulnerabilities

Sources

Also known as GHSA-4m5c-wmrf-g2j6.