CVE 설명

The HTMLMediaElement::loadResource function in html/HTMLMediaElement.cpp in WebCore in WebKit before r49480, as used in Apple Safari before 4.0.4 on Mac OS X, does not perform the expected callbacks for HTML 5 media elements that have external URLs for media resources, which allows remote attackers to trigger sub-resource requests to arbitrary web sites via a crafted HTML document, as demonstrated by an HTML e-mail message that uses a media element for X-Confirm-Reading-To functionality, aka rdar problem 7271202.

CVE 정보

메트릭

메트릭	점수	심각도	CVSS 벡터	출처
V2	5		AV:N/AC:L/Au:N/C:P/I:N/A:N	nvd@nist.gov

EPSS

EPSS는 취약점이 악용될 가능성을 예측하는 점수 모델입니다.

EPSS 점수

EPSS 모델은 0과 1(0~100%) 사이의 확률 점수를 생성합니다. 점수가 높을수록 취약점이 악용될 가능성이 높습니다.

EPSS 백분위수

백분위수는 EPSS 점수에 따라 CVE의 순위를 매기는 데 사용됩니다. 예를 들어 EPSS 점수 기준 95번째 백분위수의 CVE는 다른 CVE의 95%보다 악용될 가능성이 높습니다.

EPSS First.org

언급된 제품

구성 0

Apple>>Safari >> Version 까지 (포함) 4.0.3

Apple>>Safari >> Version 0.8

Apple>>Safari >> Version 0.9

Apple>>Safari >> Version 1.0

Apple>>Safari >> Version 1.0.0

Apple>>Safari >> Version 1.0.0b1

Apple>>Safari >> Version 1.0.0b2

Apple>>Safari >> Version 1.0.1

Apple>>Safari >> Version 1.0.2

Apple>>Safari >> Version 1.0.3

Apple>>Safari >> Version 1.1.0

Apple>>Safari >> Version 1.1.1

Apple>>Safari >> Version 1.2

Apple>>Safari >> Version 1.2.0

Apple>>Safari >> Version 1.2.1

Apple>>Safari >> Version 1.2.2

Apple>>Safari >> Version 1.2.3

Apple>>Safari >> Version 1.2.4

Apple>>Safari >> Version 1.2.5

Apple>>Safari >> Version 1.3

Apple>>Safari >> Version 1.3.0

Apple>>Safari >> Version 1.3.1

Apple>>Safari >> Version 1.3.2

Apple>>Safari >> Version 2

Apple>>Safari >> Version 2.0

Apple>>Safari >> Version 2.0.0

Apple>>Safari >> Version 2.0.1

Apple>>Safari >> Version 2.0.2

Apple>>Safari >> Version 2.0.3

Apple>>Safari >> Version 2.0.3_417.9.3

Apple>>Safari >> Version 2.0.4

Apple>>Safari >> Version 2.0.4_419.3

Apple>>Safari >> Version 2.0_pre

Apple>>Safari >> Version 3

Apple>>Safari >> Version 3.0

Apple>>Safari >> Version 3.0.0

Apple>>Safari >> Version 3.0.0b

Apple>>Safari >> Version 3.0.1

Apple>>Safari >> Version 3.0.1b

Apple>>Safari >> Version 3.0.2

Apple>>Safari >> Version 3.0.2b

Apple>>Safari >> Version 3.0.3

Apple>>Safari >> Version 3.0.3b

Apple>>Safari >> Version 3.0.4

Apple>>Safari >> Version 3.0.4_beta

Apple>>Safari >> Version 3.0.4b

Apple>>Safari >> Version 3.1

Apple>>Safari >> Version 3.1.0

Apple>>Safari >> Version 3.1.0b

Apple>>Safari >> Version 3.1.1

Apple>>Safari >> Version 3.1.2

Apple>>Safari >> Version 3.2

Apple>>Safari >> Version 3.2.0

Apple>>Safari >> Version 3.2.1

Apple>>Safari >> Version 3.2.2

Apple>>Safari >> Version 3.2.3

Apple>>Safari >> Version 4.0

Apple>>Safari >> Version 4.0.0b

Apple>>Safari >> Version 4.0.1

Apple>>Safari >> Version 4.0.2

Apple>>Mac_os_x >> Version *

참고 자료

http://www.mandriva.com/security/advisories?name=MDVSA-2011:039
Tags : vendor-advisory, x_refsource_MANDRIVA

http://www.vupen.com/english/advisories/2010/2722
Tags : vdb-entry, x_refsource_VUPEN

http://lists.fedoraproject.org/pipermail/package-announce/2010-July/044031.html
Tags : vendor-advisory, x_refsource_FEDORA

http://secunia.com/advisories/43068
Tags : third-party-advisory, x_refsource_SECUNIA

http://www.vupen.com/english/advisories/2010/1801
Tags : vdb-entry, x_refsource_VUPEN

http://www.ubuntu.com/usn/USN-1006-1
Tags : vendor-advisory, x_refsource_UBUNTU

http://lists.apple.com/archives/security-announce/2009/Nov/msg00001.html
Tags : vendor-advisory, x_refsource_APPLE

http://www.vupen.com/english/advisories/2009/3217
Tags : vdb-entry, x_refsource_VUPEN

http://secunia.com/advisories/41856
Tags : third-party-advisory, x_refsource_SECUNIA

http://www.vupen.com/english/advisories/2011/0212
Tags : vdb-entry, x_refsource_VUPEN

http://support.apple.com/kb/HT3949
Tags : x_refsource_CONFIRM

https://bugzilla.redhat.com/show_bug.cgi?id=525791
Tags : x_refsource_CONFIRM

http://secunia.com/advisories/40557
Tags : third-party-advisory, x_refsource_SECUNIA

http://www.securitytracker.com/id?1023167
Tags : vdb-entry, x_refsource_SECTRACK

http://lists.apple.com/archives/security-announce/2010/Feb/msg00000.html
Tags : vendor-advisory, x_refsource_APPLE

http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
Tags : vendor-advisory, x_refsource_SUSE

http://www.securityfocus.com/bid/36996
Tags : vdb-entry, x_refsource_BID

http://lists.fedoraproject.org/pipermail/package-announce/2010-July/044023.html
Tags : vendor-advisory, x_refsource_FEDORA

http://trac.webkit.org/changeset/49480
Tags : x_refsource_CONFIRM

http://threatpost.com/en_us/blogs/apple-patches-critical-safari-vulnerabilities-111109
Tags : x_refsource_MISC

http://osvdb.org/59941
Tags : vdb-entry, x_refsource_OSVDB

http://www.vupen.com/english/advisories/2011/0552
Tags : vdb-entry, x_refsource_VUPEN

https://exchange.xforce.ibmcloud.com/vulnerabilities/54242
Tags : vdb-entry, x_refsource_XF

http://support.apple.com/kb/HT4013
Tags : x_refsource_CONFIRM

http://secunia.com/advisories/37346
Tags : third-party-advisory, x_refsource_SECUNIA

날짜	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2022-02-06	–	–	4.36%	–	–
2022-04-03	–	–	4.36%	–	–
2022-09-25	–	–	4.36%	–	–
2023-03-12	–	–	–	0.6%	–
2023-07-16	–	–	–	0.6%	–
2024-02-11	–	–	–	0.6%	–
2024-06-02	–	–	–	0.6%	–
2024-07-14	–	–	–	0.6%	–
2024-08-04	–	–	–	0.6%	–
2024-08-11	–	–	–	0.6%	–
2024-12-22	–	–	–	0.6%	–
2025-01-19	–	–	–	0.6%	–
2025-02-16	–	–	–	0.6%	–
2025-02-16	–	–	–	0.6%	–
2025-03-18	–	–	–	–	3.88%
2025-03-30	–	–	–	–	3.88%
2025-04-15	–	–	–	–	3.88%
2025-11-18	–	–	–	–	3.88%
2025-11-21	–	–	–	–	3.88%
2026-06-14	–	–	–	–	3.88%

날짜	백분위수
2022-02-06	71%
2022-04-03	87%
2022-09-25	88%
2023-03-12	75%
2023-07-16	76%
2024-02-11	78%
2024-06-02	78%
2024-07-14	79%
2024-08-04	78%
2024-08-11	79%
2024-12-22	78%
2025-01-19	78%
2025-02-16	79%
2025-02-16	79%
2025-03-18	88%
2025-03-30	87%
2025-04-15	88%
2025-11-18	87%
2025-11-21	88%
2026-06-14	89%

CVE-2009-2841 : 상세 정보

CVE-2009-2841