PT-2010-1866 · Microsoft+1 · Windows+3

Published 2010-03-12 · Updated 2017-09-19 · CVE-2010-0041

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apple Safari versions prior to 4.0.5 Apple iTunes versions prior to 9.1 on Windows

Description The issue allows remote attackers to obtain potentially sensitive information from process memory via a crafted BMP image, due to the failure of ImageIO to ensure that memory access is associated with initialized memory.

Recommendations For Apple Safari versions prior to 4.0.5, update to version 4.0.5 or later to resolve the issue. For Apple iTunes versions prior to 9.1 on Windows, update to version 9.1 or later to resolve the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2010-0041

Affected Products

Imageio

Safari

Windows

Itunes

References · 14

• http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html · Vendor Advisory
• http://securityfocus.com/bid/38676 · Patch
• http://lists.apple.com/archives/security-announce/2010/Mar/msg00000.html · Vendor Advisory
• http://securityfocus.com/bid/38671 · Patch
• http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html · Vendor Advisory
• http://support.apple.com/kb/HT4070 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2010//Mar/msg00003.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-0041 · Security Note
• http://securitytracker.com/id?1023706 · Note
• http://secunia.com/advisories/39135 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6885 · Note
• http://support.apple.com/kb/HT4077 · Note
• http://support.apple.com/kb/HT4225 · Note
• http://support.apple.com/kb/HT4105 · Note