PT-2010-3398 · Apple · Webkit

Julien Chaffraix · Published 2010-08-19 · Updated 2011-03-18 · CVE-2010-1760

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions WebKit before r58409

Description The issue is related to the XMLHttpRequest implementation in WebCore in WebKit, where the loader/DocumentThreadableLoader.cpp does not properly handle credentials during a cross-origin synchronous request. This has unspecified impact and remote attack vectors.

Recommendations For WebKit before r58409, update to a version after r58409 to resolve the issue.

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2010-1760

Affected Products

Webkit

References · 13

• http://ubuntu.com/usn/USN-1006-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2011:039 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-1760 · Security Note
• http://trac.webkit.org/changeset/58409 · Note
• http://vupen.com/english/advisories/2011/0212 · Note
• http://security-tracker.debian.org/tracker/CVE-2010-1760 · Note
• http://securityfocus.com/bid/42494 · Note
• http://secunia.com/advisories/41856 · Note
• https://bugs.webkit.org/show_bug.cgi?id=37781 · Note
• http://secunia.com/advisories/43068 · Note
• http://vupen.com/english/advisories/2010/2722 · Note
• http://vupen.com/english/advisories/2011/0552 · Note