PT-2010-2399 · Google+1 · Google Chrome+1

Berend-Jan Wever · Publicado 2010-02-18 · Atualizado 2017-09-19 · CVE-2010-0647

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions WebKit versions before r53525 Google Chrome versions before 4.0.249.89

Description The issue allows remote attackers to execute arbitrary code in the Chrome sandbox via a malformed RUBY element. This can be demonstrated by a specific sequence, such as a <ruby>><table><rt> sequence.

Recommendations For WebKit versions before r53525, update to version r53525 or later. For Google Chrome versions before 4.0.249.89, update to version 4.0.249.89 or later.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2010-0647

Produtos afetados

Google Chrome

Webkit

Referências · 21

• http://trac.webkit.org/changeset/53525 · Nota
• http://vupen.com/english/advisories/2011/0212 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14094 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/56214 · Nota
• http://securitytracker.com/id?1023583 · Nota
• http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html · Aviso do Fabricante
• http://osvdb.org/62317 · Nota
• http://mandriva.com/security/advisories?name=MDVSA-2011:039 · Aviso do Fabricante
• http://sites.google.com/a/chromium.org/dev/Home/chromium-security/chromium-security-bugs · Aviso do Fabricante
• http://securityfocus.com/bid/38177 · Nota
• http://ubuntu.com/usn/USN-1006-1 · Aviso do Fabricante
• https://bugs.webkit.org/show_bug.cgi?id=33266 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-0647 · Nota de Segurança
• http://code.google.com/p/chromium/issues/detail?id=31692 · Nota
• http://vupen.com/english/advisories/2010/2722 · Nota