CVE-2009-0945

Array index error in the insertItemBefore method in WebKit, as used in Apple Safari before 3.2.3 and 4 Public Beta, iPhone OS 1.0 through 2.2.1, iPhone OS for iPod touch 1.1 through 2.2.1, Google Chrome Stable before 1.0.154.65, and possibly other products allows remote attackers to execute arbitrary code via a document with a SVGPathList data structure containing a negative index in the (1) SVGTransformList, (2) SVGStringList, (3) SVGNumberList, (4) SVGPathSegList, (5) SVGPointList, or (6) SVGLengthList SVGList object, which triggers memory corruption.

• CWE-94

• http://code.google.com/p/chromium/issues/detail?id=9019
• http://googlechromereleases.blogspot.com/2009/05/stable-update-bug-fix.html
• http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html
• http://lists.apple.com/archives/security-announce/2009/May/msg00000.htmlPatch, Vendor Advisory
• http://lists.apple.com/archives/security-announce/2009/May/msg00001.htmlPatch, Vendor Advisory
• http://lists.apple.com/archives/security-announce/2009/May/msg00002.htmlPatch, Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
• http://secunia.com/advisories/35056
• http://secunia.com/advisories/35074
• http://secunia.com/advisories/35095
• http://secunia.com/advisories/35576
• http://secunia.com/advisories/35805
• http://secunia.com/advisories/36062
• http://secunia.com/advisories/36461
• http://secunia.com/advisories/36790
• http://secunia.com/advisories/37746
• http://secunia.com/advisories/43068
• http://support.apple.com/kb/HT3549Patch, Vendor Advisory
• http://support.apple.com/kb/HT3550
• http://support.apple.com/kb/HT3639
• http://www.debian.org/security/2009/dsa-1950
• http://www.redhat.com/support/errata/RHSA-2009-1130.html
• http://www.securityfocus.com/archive/1/503594/100/0/threaded
• http://www.securityfocus.com/bid/34924
• http://www.securitytracker.com/id?1022207
• http://www.ubuntu.com/usn/USN-822-1
• http://www.ubuntu.com/usn/USN-836-1
• http://www.ubuntu.com/usn/USN-857-1
• http://www.us-cert.gov/cas/techalerts/TA09-133A.htmlUS Government Resource
• http://www.vupen.com/english/advisories/2009/1297
• http://www.vupen.com/english/advisories/2009/1298
• http://www.vupen.com/english/advisories/2009/1321
• http://www.vupen.com/english/advisories/2009/1621
• http://www.vupen.com/english/advisories/2011/0212
• http://www.zerodayinitiative.com/advisories/ZDI-09-022
• https://exchange.xforce.ibmcloud.com/vulnerabilities/50477
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11584
• https://usn.ubuntu.com/823-1/
• https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00303.html
• https://www.redhat.com/archives/fedora-package-announce/2009-July/msg01177.html
• https://www.redhat.com/archives/fedora-package-announce/2009-July/msg01196.html
• http://code.google.com/p/chromium/issues/detail?id=9019
• http://googlechromereleases.blogspot.com/2009/05/stable-update-bug-fix.html
• http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html
• http://lists.apple.com/archives/security-announce/2009/May/msg00000.htmlPatch, Vendor Advisory
• http://lists.apple.com/archives/security-announce/2009/May/msg00001.htmlPatch, Vendor Advisory
• http://lists.apple.com/archives/security-announce/2009/May/msg00002.htmlPatch, Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
• http://secunia.com/advisories/35056
• http://secunia.com/advisories/35074
• http://secunia.com/advisories/35095
• http://secunia.com/advisories/35576
• http://secunia.com/advisories/35805
• http://secunia.com/advisories/36062
• http://secunia.com/advisories/36461
• http://secunia.com/advisories/36790
• http://secunia.com/advisories/37746
• http://secunia.com/advisories/43068
• http://support.apple.com/kb/HT3549Patch, Vendor Advisory
• http://support.apple.com/kb/HT3550
• http://support.apple.com/kb/HT3639
• http://www.debian.org/security/2009/dsa-1950
• http://www.redhat.com/support/errata/RHSA-2009-1130.html
• http://www.securityfocus.com/archive/1/503594/100/0/threaded
• http://www.securityfocus.com/bid/34924
• http://www.securitytracker.com/id?1022207
• http://www.ubuntu.com/usn/USN-822-1
• http://www.ubuntu.com/usn/USN-836-1
• http://www.ubuntu.com/usn/USN-857-1
• http://www.us-cert.gov/cas/techalerts/TA09-133A.htmlUS Government Resource
• http://www.vupen.com/english/advisories/2009/1297
• http://www.vupen.com/english/advisories/2009/1298
• http://www.vupen.com/english/advisories/2009/1321
• http://www.vupen.com/english/advisories/2009/1621
• http://www.vupen.com/english/advisories/2011/0212
• http://www.zerodayinitiative.com/advisories/ZDI-09-022
• https://exchange.xforce.ibmcloud.com/vulnerabilities/50477
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11584
• https://usn.ubuntu.com/823-1/
• https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00303.html
• https://www.redhat.com/archives/fedora-package-announce/2009-July/msg01177.html
• https://www.redhat.com/archives/fedora-package-announce/2009-July/msg01196.html

Published

May 13, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-0939Tor before 0.2.0.34 treats incomplete IPv4 addresses as vali…
• CVE-2009-0940Multiple cross-site request forgery (CSRF) vulnerabilities i…
• CVE-2009-0941The HP Embedded Web Server (EWS) on HP LaserJet Printers, Ed…
• CVE-2009-0942Help Viewer in Apple Mac OS X 10.4.11 and 10.5 before 10.5.7…
• CVE-2009-0943Help Viewer in Apple Mac OS X 10.4.11 and 10.5 before 10.5.7…
• CVE-2009-0944The Microsoft Office Spotlight Importer in Spotlight in Appl…
• CVE-2009-0946Multiple integer overflows in FreeType 2.3.9 and earlier all…
• CVE-2009-0947Multiple integer overflows in the (1) cdf_read_property_info…9.8
• CVE-2009-0948Multiple buffer overflows in the (1) cdf_read_sat, (2) cdf_r…9.8
• CVE-2009-0949The ippReadIO function in cups/ipp.c in cupsd in CUPS before…7.5
• CVE-2009-0950Stack-based buffer overflow in Apple iTunes before 8.2 allow…
• CVE-2009-0951Heap-based buffer overflow in Apple QuickTime before 7.6.2 a…