CVEs / CVE-2009-1699

CVE-2009-1699: n/a n/a vulnerability

high 7.5 CVSS 3.1 (NVD)
EPSS 32.7% chance of exploitation in the next 30 days, higher than 98% of CVEs (11 Nov 2026)
Last changed at its sources 16 Jun 2026

Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.

Check your servers with Stackurity Already using Stackurity? Search for CVE-2009-1699

Description

The XSL stylesheet implementation in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not properly handle XML external entities, which allows remote attackers to read arbitrary files via a crafted DTD, as demonstrated by a file:///etc/passwd URL in an entity declaration, related to an "XXE attack."
The CVE record, via NVD · published 10 Jun 2009 · NVD status: Modified

Affected and fixed versions

As stated by the CVE record (from the CNA)
Product	Affected	Fixed in
n/a n/a	n/a	—

Exploitation

Not in the CISA Known Exploited Vulnerabilities catalog as of 10 Nov 2026.

Severity

CVSS 3.1	7.5 high `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N` Scored by NVD
Weakness	CWE-611

References

CVE-2009-1699 on NVD
http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html Mailing List
http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html Broken Link, Mailing List, Patch, Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html Mailing List
http://osvdb.org/54972 Broken Link
http://scary.beasts.org/security/CESA-2009-006.html Exploit
http://scarybeastsecurity.blogspot.com/2009/06/apples-safari-4-fixes-local-file-theft.html Exploit
http://secunia.com/advisories/35379 Broken Link, Vendor Advisory
http://secunia.com/advisories/43068 Broken Link
http://support.apple.com/kb/HT3613 Patch, Vendor Advisory
http://support.apple.com/kb/HT3639 Vendor Advisory
http://www.securityfocus.com/bid/35260 Broken Link, Exploit, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/35321 Broken Link, Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-857-1 Third Party Advisory
http://www.vupen.com/english/advisories/2009/1522 Broken Link, Patch, Vendor Advisory
http://www.vupen.com/english/advisories/2009/1621 Broken Link
http://www.vupen.com/english/advisories/2011/0212 Broken Link
https://www.exploit-db.com/exploits/8907 Exploit, Third Party Advisory, VDB Entry

Sources

Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.

This product uses data from the NVD API but is not endorsed or certified by the NVD.