PT-2010-3404 · Google+1 · Google Chrome+1

Published 2010-09-24 · Updated 2017-09-19 · CVE-2010-1767

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WebKit versions before r57041 Google Chrome versions before 4.1.249.1059

Description A cross-site request forgery (CSRF) issue exists, allowing remote attackers to hijack the authentication of victims via a crafted synchronous preflight XMLHttpRequest operation.

Recommendations For WebKit versions before r57041, update to version r57041 or later. For Google Chrome versions before 4.1.249.1059, update to version 4.1.249.1059 or later.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2010-1767

Affected Products

Google Chrome

Webkit

References · 18

• http://secunia.com/advisories/39544 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-1767 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2011:039 · Vendor Advisory
• http://ubuntu.com/usn/USN-1006-1 · Vendor Advisory
• http://securityfocus.com/bid/39603 · Note
• http://vupen.com/english/advisories/2011/0212 · Note
• http://code.google.com/p/chromium/issues/detail?id=39698 · Note
• http://osvdb.org/64002 · Note
• http://security-tracker.debian.org/tracker/CVE-2010-1767 · Note
• http://trac.webkit.org/changeset/57041 · Note
• https://bugs.webkit.org/show_bug.cgi?id=36843 · Note
• http://googlechromereleases.blogspot.com/2010/04/stable-update-security-fixes.html · Note
• http://vupen.com/english/advisories/2010/2722 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11140 · Note