PT-2010-2411 · Google+1 · Google Chrome+1

Published 2010-02-18 · Updated 2017-09-19 · CVE-2010-0659

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions WebKit versions before r52833 Google Chrome versions before 4.0.249.78

Description The issue arises from the image decoder in WebKit not properly handling a failure of memory allocation. This can be exploited by remote attackers using a malformed GIF file that specifies a large size, allowing them to execute arbitrary code within the Chrome sandbox.

Recommendations For WebKit versions before r52833, update to version r52833 or later. For Google Chrome versions before 4.0.249.78, update to version 4.0.249.78 or later.

Fix

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2010-0659

Affected Products

Google Chrome

Webkit

References · 11

• http://googlechromereleases.blogspot.com/2010/01/stable-channel-update_25.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2010-0659 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html · Vendor Advisory
• http://sites.google.com/a/chromium.org/dev/Home/chromium-security/chromium-security-bugs · Vendor Advisory
• https://bugs.webkit.org/show_bug.cgi?id=33231 · Note
• http://vupen.com/english/advisories/2011/0212 · Note
• http://securitytracker.com/id?1023506 · Note
• http://trac.webkit.org/changeset/52833 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14079 · Note
• http://secunia.com/advisories/43068 · Note
• http://code.google.com/p/chromium/issues/detail?id=28566 · Note