PT-2010-3100 · Microsoft+1 · Windows+2

Wushi · Published 2010-06-08 · Updated 2018-10-10 · CVE-2010-1404

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apple Safari versions prior to 5.0 on Mac OS X 10.5 through 10.6 and Windows Apple Safari versions prior to 4.1 on Mac OS X 10.4

Description The issue allows remote attackers to execute arbitrary code or cause a denial of service via an SVG document that contains recursive Use elements, which are not properly handled during page deconstruction. This can lead to an application crash.

Recommendations For Apple Safari versions prior to 5.0 on Mac OS X 10.5 through 10.6 and Windows, update to version 5.0 or later. For Apple Safari versions prior to 4.1 on Mac OS X 10.4, update to version 4.1 or later.

Fix

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2010-1404

ZDI-10-096

Affected Products

Macos X

Safari

Windows

References · 25

• http://vupen.com/english/advisories/2011/0552 · Vendor Advisory
• http://support.apple.com/kb/HT4196 · Vendor Advisory
• http://secunia.com/advisories/40105 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html · Vendor Advisory
• http://secunia.com/advisories/41856 · Vendor Advisory
• http://support.apple.com/kb/HT4220 · Vendor Advisory
• http://support.apple.com/kb/HT4225 · Vendor Advisory
• http://secunia.com/advisories/43068 · Vendor Advisory
• http://secunia.com/advisories/40196 · Vendor Advisory
• http://ubuntu.com/usn/USN-1006-1 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2010/Jun/msg00000.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html · Vendor Advisory
• http://vupen.com/english/advisories/2010/1373 · Vendor Advisory
• http://vupen.com/english/advisories/2010/1512 · Vendor Advisory
• http://vupen.com/english/advisories/2010/2722 · Vendor Advisory