CVE-2010-1119: Apple iPhone OS

High severity, CVSS 10.0. EPSS: 19.4% chance of exploitation in the next 30 days.

Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, Safari before 4.1 on Mac OS X 10.4, and Safari on Apple iPhone OS allows remote attackers to execute arbitrary code or cause a denial of service (application crash), or read the SMS database or other data, via vectors related to "attribute manipulation," as demonstrated by Vincenzo Iozzo and Ralf Philipp Weinmann during a Pwn2Own competition at CanSecWest 2010.

Affected products

• Apple iPhone OS: version 2.0 only; version 2.0.0 only; version 2.0.1 only; version 2.0.2 only; version 2.1 only; version 2.1.1 only; …
• Apple Mac OS X: version 10.5 only; version 10.5.0 only; version 10.5.1 only; version 10.5.2 only; version 10.5.3 only; version 10.5.4 only; …
• Apple Mac OS X Server: version 10.5.0 only; version 10.5.1 only; version 10.5.2 only; version 10.5.3 only; version 10.5.4 only; version 10.5.5 only; …
• Apple Safari: up to and including 4.0.5; version 1.0 only; version 1.0.0 only; version 1.0.0b1 only; version 1.0.0b2 only; version 1.0.1 only; …

Published 2010-03-25. Last modified 2026-06-16.