CVE-2009-2206

Multiple heap-based buffer overflows in the AudioCodecs library in the CoreAudio component in Apple iPhone OS before 3.1, and iPhone OS before 3.1.1 for iPod touch, allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted (1) AAC or (2) MP3 file, as demonstrated by a ringtone with malformed entries in the sample size table.

• CWE-119

• http://lists.apple.com/archives/security-announce/2009/Sep/msg00001.htmlPatch, Vendor Advisory
• http://secunia.com/advisories/36677Vendor Advisory
• http://support.apple.com/kb/HT3860Patch, Vendor Advisory
• http://www.securityfocus.com/archive/1/506464/100/0/threaded
• http://www.securityfocus.com/bid/36338
• http://www.securitytracker.com/id?1022869
• http://www.trapkit.de/advisories/TKADV2009-007.txtExploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/53180
• http://lists.apple.com/archives/security-announce/2009/Sep/msg00001.htmlPatch, Vendor Advisory
• http://secunia.com/advisories/36677Vendor Advisory
• http://support.apple.com/kb/HT3860Patch, Vendor Advisory
• http://www.securityfocus.com/archive/1/506464/100/0/threaded
• http://www.securityfocus.com/bid/36338
• http://www.securitytracker.com/id?1022869
• http://www.trapkit.de/advisories/TKADV2009-007.txtExploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/53180

Published

Sep 10, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-2200WebKit in Apple Safari before 4.0.3 does not properly restri…
• CVE-2009-2201The screensharing feature in the Admin application in Apple …
• CVE-2009-2202Apple QuickTime before 7.6.4 allows remote attackers to exec…
• CVE-2009-2203Buffer overflow in Apple QuickTime before 7.6.4 allows remot…
• CVE-2009-2204Unspecified vulnerability in the CoreTelephony component in …
• CVE-2009-2205Stack-based buffer overflow in the Java Web Start command la…
• CVE-2009-2207The MobileMail component in Apple iPhone OS 3.0 and 3.0.1, a…
• CVE-2009-2208FreeBSD 6.3, 6.4, 7.1, and 7.2 does not enforce permissions …
• CVE-2009-2209SQL injection vulnerability in rscms_mod_newsview.php in RS-…
• CVE-2009-2210Mozilla Thunderbird before 2.0.0.22 and SeaMonkey before 1.1…
• CVE-2009-2211Cross-site scripting (XSS) vulnerability in the CQWeb server…
• CVE-2009-2212The CQWeb server in IBM Rational ClearQuest 7.0.0 before 7.0…