CVE-2009-2816

TRUNG BÌNH 6.8CVE-2009-2816 · Công bố 13/11/2009 · cập nhật 16/06/2026

Tóm tắt nhanh

CVE-2009-2816 là lỗ hổng mức TRUNG BÌNH (CVSS 6.8) ảnh hưởng safari (apple), chrome (google).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 1.6%, cao hơn 75.2% các lỗ hổng khác.
Cách xử lý: cập nhật lên 4.0.4, 3.0.195.33 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
safari apple	`< 4.0.4`	`4.0.4`
chrome google	`< 3.0.195.33`	`3.0.195.33`

Mô tả

The implementation of Cross-Origin Resource Sharing (CORS) in WebKit, as used in Apple Safari before 4.0.4 and Google Chrome before 3.0.195.33, includes certain custom HTTP headers in the OPTIONS request during cross-origin operations with preflight, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via a crafted web page.

Tham khảo

lists.apple.com/archives/security-announce/2009/Nov/msg00001.html · Mailing List
lists.apple.com/archives/security-announce/2010/Jun/msg00003.html · Mailing List
lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html · Third Party Advisory
osvdb.org/59940 · Broken Link
osvdb.org/59967 · Broken Link
secunia.com/advisories/37346 · Third Party Advisory
secunia.com/advisories/37358 · Third Party Advisory
secunia.com/advisories/37393 · Third Party Advisory
secunia.com/advisories/37397 · Third Party Advisory
secunia.com/advisories/43068 · Third Party Advisory
support.apple.com/kb/HT3949 · Patch
support.apple.com/kb/HT4225 · Vendor Advisory
securityfocus.com/bid/36997 · Third Party Advisory
securitytracker.com/id · Third Party Advisory
vupen.com/english/advisories/2009/3217 · Vendor Advisory
vupen.com/english/advisories/2009/3233 · Vendor Advisory
vupen.com/english/advisories/2011/0212 · Vendor Advisory
bugzilla.redhat.com/show_bug.cgi · Issue Tracking
exchange.xforce.ibmcloud.com/vulnerabilities/54239 · Third Party Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6516 · Third Party Advisory
redhat.com/archives/fedora-package-announce/2009-November/msg00545.html · Third Party Advisory
redhat.com/archives/fedora-package-announce/2009-November/msg00549.html · Third Party Advisory

Lỗ hổng khác của safari

Xem tất cả →

Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.

Quét site miễn phí