PT-2010-2413 · Google+1 · Google Chrome+1

Tokuji Akamine · Published 2010-02-18 · Updated 2017-09-19 · CVE-2010-0661

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WebKit versions before r52401 Google Chrome versions before 4.0.249.78

Description The issue allows remote attackers to bypass the Same Origin Policy. This is achieved via vectors involving the window.open method.

Recommendations For WebKit versions before r52401, update to version r52401 or later. For Google Chrome versions before 4.0.249.78, update to version 4.0.249.78 or later.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2010-0661

Affected Products

Google Chrome

Webkit

References · 12

• http://googlechromereleases.blogspot.com/2010/01/stable-channel-update_25.html · Patch
• http://trac.webkit.org/changeset/52401 · Patch
• http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html · Vendor Advisory
• http://sites.google.com/a/chromium.org/dev/Home/chromium-security/chromium-security-bugs · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-0661 · Security Note
• https://bugs.webkit.org/show_bug.cgi?id=32647 · Note
• http://vupen.com/english/advisories/2011/0212 · Note
• http://code.google.com/p/chromium/issues/detail?id=30660 · Note
• http://securitytracker.com/id?1023506 · Note
• http://secunia.com/advisories/43068 · Note
• http://flock.com/security · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14482 · Note