CVE-2009-2204

Unspecified vulnerability in the CoreTelephony component in Apple iPhone OS before 3.0.1 allows remote attackers to execute arbitrary code, obtain GPS coordinates, or enable the microphone via an SMS message that triggers memory corruption, as demonstrated by Charlie Miller at SyScan '09 Singapore.

• http://lists.apple.com/archives/security-announce/2009/Jul/msg00001.html
• http://news.cnet.com/8301-1009_3-10278472-83.html
• http://secunia.com/advisories/36070Vendor Advisory
• http://securitytracker.com/id?1022626Patch
• http://support.apple.com/kb/HT3754Vendor Advisory
• http://www.blackhat.com/presentations/bh-usa-09/MILLER/BHUSA09-Miller-FuzzingPhone-PAPER.pdfExploit
• http://www.osvdb.org/55687
• http://www.securityfocus.com/bid/35569
• http://www.syscan.org/Sg/program.html
• http://www.vupen.com/english/advisories/2009/2105Patch, Vendor Advisory
• http://lists.apple.com/archives/security-announce/2009/Jul/msg00001.html
• http://news.cnet.com/8301-1009_3-10278472-83.html
• http://secunia.com/advisories/36070Vendor Advisory
• http://securitytracker.com/id?1022626Patch
• http://support.apple.com/kb/HT3754Vendor Advisory
• http://www.blackhat.com/presentations/bh-usa-09/MILLER/BHUSA09-Miller-FuzzingPhone-PAPER.pdfExploit
• http://www.osvdb.org/55687
• http://www.securityfocus.com/bid/35569
• http://www.syscan.org/Sg/program.html
• http://www.vupen.com/english/advisories/2009/2105Patch, Vendor Advisory

Published

Aug 3, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-2198Apple GarageBand before 5.1 reconfigures Safari to accept al…
• CVE-2009-2199Incomplete blacklist vulnerability in WebKit in Apple Safari…
• CVE-2009-2200WebKit in Apple Safari before 4.0.3 does not properly restri…
• CVE-2009-2201The screensharing feature in the Admin application in Apple …
• CVE-2009-2202Apple QuickTime before 7.6.4 allows remote attackers to exec…
• CVE-2009-2203Buffer overflow in Apple QuickTime before 7.6.4 allows remot…
• CVE-2009-2205Stack-based buffer overflow in the Java Web Start command la…
• CVE-2009-2206Multiple heap-based buffer overflows in the AudioCodecs libr…
• CVE-2009-2207The MobileMail component in Apple iPhone OS 3.0 and 3.0.1, a…
• CVE-2009-2208FreeBSD 6.3, 6.4, 7.1, and 7.2 does not enforce permissions …
• CVE-2009-2209SQL injection vulnerability in rscms_mod_newsview.php in RS-…
• CVE-2009-2210Mozilla Thunderbird before 2.0.0.22 and SeaMonkey before 1.1…