CVE-2009-1681

描述

WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not prevent web sites from loading third-party content into a subframe, which allows remote attackers to bypass the Same Origin Policy and conduct "clickjacking" attacks via a crafted HTML document.

如何修補 CVE-2009-1681

要修補 CVE-2009-1681,請將受影響套件升級到下列已修補版本。

• Debian/qt4-x11—升級至 4:4.6.2-4 或更新版本

CVE-2009-1681 正在被利用嗎?

低 — EPSS 為 3.0%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, < 4:4.6.2-4

參考連結(15)

• ADVISORYsecunia.com/advisories/35379
• ADVISORYsecunia.com/advisories/37746
• ADVISORYsecunia.com/advisories/43068
• ADVISORYwww.debian.org/security/2009/dsa-1950
• ADVISORYwww.vupen.com/english/advisories/2009/1621