PT-2010-3886 · Google+1 · Google Chrome+1

Publicado 2010-06-15 · Atualizado 2020-08-05 · CVE-2010-2300

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 5.0.375.70

Description A use-after-free issue in the Element::normalizeAttributes function in dom/Element.cpp in WebCore in WebKit allows remote attackers to execute arbitrary code or cause a denial of service due to memory corruption. This issue is related to handlers for DOM mutation events.

Recommendations For versions prior to 5.0.375.70, update to version 5.0.375.70 or later to resolve the issue. As a temporary workaround, consider restricting access to DOM mutation event handlers until a patch is available.

Exploit

Correção

Use After Free

Enumeração de Fraquezas

CWE-416

Identificadores relacionados

CVE-2010-2300

Produtos afetados

Google Chrome

Webkit

Referências · 9

• 🔥 https://exploit-db.com/exploits/18446 · Exploit
• http://code.google.com/p/chromium/issues/detail?id=43315 · Nota
• http://secunia.com/advisories/40072 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-2300 · Nota de Segurança
• http://googlechromereleases.blogspot.com/2010/06/stable-channel-update.html · Aviso do Fabricante
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11357 · Nota
• http://secunia.com/advisories/43068 · Nota
• http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html · Aviso do Fabricante
• http://vupen.com/english/advisories/2011/0212 · Nota