CVE-2009-2191

Format string vulnerability in Login Window in Apple Mac OS X 10.4.11 and 10.5 before 10.5.8 allows attackers to execute arbitrary code or cause a denial of service (application crash) via format string specifiers in an application name.

• CWE-134

• http://lists.apple.com/archives/security-announce/2009/Aug/msg00001.htmlPatch, Vendor Advisory
• http://osvdb.org/56840
• http://secunia.com/advisories/36096Vendor Advisory
• http://support.apple.com/kb/HT3757Patch, Vendor Advisory
• http://www.securityfocus.com/bid/35954Patch
• http://www.us-cert.gov/cas/techalerts/TA09-218A.htmlUS Government Resource
• http://www.vupen.com/english/advisories/2009/2172Patch, Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/52428
• http://lists.apple.com/archives/security-announce/2009/Aug/msg00001.htmlPatch, Vendor Advisory
• http://osvdb.org/56840
• http://secunia.com/advisories/36096Vendor Advisory
• http://support.apple.com/kb/HT3757Patch, Vendor Advisory
• http://www.securityfocus.com/bid/35954Patch
• http://www.us-cert.gov/cas/techalerts/TA09-218A.htmlUS Government Resource
• http://www.vupen.com/english/advisories/2009/2172Patch, Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/52428

Published

Aug 6, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-2185The ASN.1 parser (pluto/asn1.c, libstrongswan/asn1/asn1.c, l…
• CVE-2009-2186Unspecified vulnerability in Adobe Shockwave Player before 1…
• CVE-2009-2187Multiple memory leaks in the (1) IP and (2) IPv6 multicast i…
• CVE-2009-2188Buffer overflow in ImageIO in Apple Mac OS X 10.5 before 10.…
• CVE-2009-2189The ICMPv6 implementation on the Apple Time Capsule, AirPort…
• CVE-2009-2190launchd in Apple Mac OS X 10.5 before 10.5.8 allows remote a…
• CVE-2009-2192MobileMe in Apple Mac OS X 10.5 before 10.5.8 does not prope…
• CVE-2009-2193Buffer overflow in the kernel in Apple Mac OS X 10.5 before …
• CVE-2009-2194Apple Mac OS X 10.5 before 10.5.8 does not properly share fi…
• CVE-2009-2195Buffer overflow in WebKit in Apple Safari before 4.0.3 allow…
• CVE-2009-2196Unspecified vulnerability in Apple Safari 4 before 4.0.3 all…
• CVE-2009-2197Apple Safari before 9.1 allows remote attackers to spoof the…