CVE-2009-2841
EPSS 3.9%
Description
The HTMLMediaElement::loadResource function in html/HTMLMediaElement.cpp in WebCore in WebKit before r49480, as used in Apple Safari before 4.0.4 on Mac OS X, does not perform the expected callbacks for HTML 5 media elements that have external URLs for media resources, which allows remote attackers to trigger sub-resource requests to arbitrary web sites via a crafted HTML document, as demonstrated by an HTML e-mail message that uses a media element for X-Confirm-Reading-To functionality, aka rdar problem 7271202.
How to fix CVE-2009-2841
To remediate CVE-2009-2841, upgrade the affected package to a fixed version below.
- Debian/qt4-x11—upgrade to 4:4.6.2-4 or later
Is CVE-2009-2841 being exploited?
Low — EPSS is 3.9%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- from 0, < 4:4.6.2-4