CVE-2009-1700: Apple iPhone OS

Medium severity, CVSS 4.3. EPSS: 2.6% chance of exploitation in the next 30 days.

The XSLT implementation in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not properly handle redirects, which allows remote attackers to read XML content from arbitrary web pages via a crafted document.

Affected products

• Apple iPhone OS: version 1.0.0 only; version 1.0.1 only; version 1.0.2 only; version 1.1.0 only; version 1.1.1 only; version 1.1.2 only; …
• Apple Ipod Touch: any version
• Apple Safari: up to and including 3.2.2; version 2.0 only; version 2.0.0 only; version 2.0.1 only; version 2.0.2 only; version 2.0.3 only; …

Published 2009-06-10. Last modified 2026-06-16.