PT-2010-3398 · Apple · Webkit

Julien Chaffraix · Publicado 2010-08-19 · Atualizado 2011-03-18 · CVE-2010-1760

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions WebKit before r58409

Description The issue is related to the XMLHttpRequest implementation in WebCore in WebKit, where the loader/DocumentThreadableLoader.cpp does not properly handle credentials during a cross-origin synchronous request. This has unspecified impact and remote attack vectors.

Recommendations For WebKit before r58409, update to a version after r58409 to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

CVE-2010-1760

Produtos afetados

Webkit

Referências · 13

• http://ubuntu.com/usn/USN-1006-1 · Aviso do Fabricante
• http://trac.webkit.org/changeset/58409 · Nota
• http://vupen.com/english/advisories/2011/0212 · Nota
• http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html · Aviso do Fabricante
• http://security-tracker.debian.org/tracker/CVE-2010-1760 · Nota
• http://securityfocus.com/bid/42494 · Nota
• http://secunia.com/advisories/41856 · Nota
• https://bugs.webkit.org/show_bug.cgi?id=37781 · Nota
• http://secunia.com/advisories/43068 · Nota
• http://mandriva.com/security/advisories?name=MDVSA-2011:039 · Aviso do Fabricante
• http://vupen.com/english/advisories/2010/2722 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-1760 · Nota de Segurança
• http://vupen.com/english/advisories/2011/0552 · Nota