CVE-2009-2188

Buffer overflow in ImageIO in Apple Mac OS X 10.5 before 10.5.8, and Safari before 4.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via an image with crafted EXIF metadata.

• CWE-119

• http://lists.apple.com/archives/security-announce/2009/Aug/msg00001.htmlPatch, Vendor Advisory
• http://lists.apple.com/archives/security-announce/2009/Aug/msg00002.html
• http://osvdb.org/56842
• http://secunia.com/advisories/36096Vendor Advisory
• http://support.apple.com/kb/HT3733
• http://support.apple.com/kb/HT3757Patch, Vendor Advisory
• http://www.securityfocus.com/bid/35954Patch
• http://www.securitytracker.com/id?1022674
• http://www.us-cert.gov/cas/techalerts/TA09-218A.htmlUS Government Resource
• http://www.vupen.com/english/advisories/2009/2172Patch, Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/52386
• http://lists.apple.com/archives/security-announce/2009/Aug/msg00001.htmlPatch, Vendor Advisory
• http://lists.apple.com/archives/security-announce/2009/Aug/msg00002.html
• http://osvdb.org/56842
• http://secunia.com/advisories/36096Vendor Advisory
• http://support.apple.com/kb/HT3733
• http://support.apple.com/kb/HT3757Patch, Vendor Advisory
• http://www.securityfocus.com/bid/35954Patch
• http://www.securitytracker.com/id?1022674
• http://www.us-cert.gov/cas/techalerts/TA09-218A.htmlUS Government Resource
• http://www.vupen.com/english/advisories/2009/2172Patch, Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/52386

Published

Aug 6, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-2182Multiple PHP remote file inclusion vulnerabilities in Campsi…
• CVE-2009-2183Directory traversal vulnerability in admin-files/ad.php in C…
• CVE-2009-2184Absolute path traversal vulnerability in forcedownload.php i…
• CVE-2009-2185The ASN.1 parser (pluto/asn1.c, libstrongswan/asn1/asn1.c, l…
• CVE-2009-2186Unspecified vulnerability in Adobe Shockwave Player before 1…
• CVE-2009-2187Multiple memory leaks in the (1) IP and (2) IPv6 multicast i…
• CVE-2009-2189The ICMPv6 implementation on the Apple Time Capsule, AirPort…
• CVE-2009-2190launchd in Apple Mac OS X 10.5 before 10.5.8 allows remote a…
• CVE-2009-2191Format string vulnerability in Login Window in Apple Mac OS …
• CVE-2009-2192MobileMe in Apple Mac OS X 10.5 before 10.5.8 does not prope…
• CVE-2009-2193Buffer overflow in the kernel in Apple Mac OS X 10.5 before …
• CVE-2009-2194Apple Mac OS X 10.5 before 10.5.8 does not properly share fi…