CVE-2009-1705

CoreGraphics in Apple Safari before 4.0 on Windows does not properly use arithmetic during automatic hinting of TrueType fonts, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via crafted font data.

Affected products

Coregraphics, Safari

Apple Safari

≤ 3.2.3, 3.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.1, 3.1.1, 3.1.2, 3.2, 3.2.1, 3.2.2

Fix

Available

CVSS 2.0

9.3 HIGH

EPSS

5.3% (92th percentile)

Weakness

CWE-189

NVD status

Modified

Published

2009-06-10