PT-2010-3440 · Webkit+3 · Webkitgtk+3

Luke Wagner · Published 2010-09-10 · Updated 2017-09-19 · CVE-2010-1807

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apple Safari versions 4.x through 4.1.1 Apple Safari versions 5.x through 5.0.1 Android versions prior to 2.2 webkitgtk versions prior to 1.2.6

Description The issue allows remote attackers to execute arbitrary code or cause a denial of service via a crafted HTML document, related to improper validation of floating-point data and non-standard NaN representation.

Recommendations For Apple Safari versions 4.x through 4.1.1, update to version 4.1.2 or later. For Apple Safari versions 5.x through 5.0.1, update to version 5.0.2 or later. For Android versions prior to 2.2, update to version 2.2 or later. For webkitgtk versions prior to 1.2.6, update to version 1.2.6 or later.

Exploit

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2010-1807

RHSA-2011:0177

RHSA-2011_0177

Affected Products

Android

Red Hat

Safari

Webkitgtk

References · 62

• 🔥 https://exploit-db.com/exploits/15423 · Exploit
• 🔥 https://exploit-db.com/exploits/15548 · Exploit
• http://vupen.com/english/advisories/2010/3046 · Vendor Advisory
• http://secunia.com/advisories/41856 · Vendor Advisory
• http://secunia.com/advisories/43068 · Vendor Advisory
• http://vupen.com/english/advisories/2010/2722 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2011-0177.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-1807 · Security Note
• http://redhat.com/support/errata/RHSA-2011-0177.html · Vendor Advisory
• http://vupen.com/english/advisories/2011/0212 · Vendor Advisory
• http://ubuntu.com/usn/USN-1006-1 · Vendor Advisory
• http://vupen.com/english/advisories/2011/0216 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2010//Sep/msg00001.html · Vendor Advisory
• http://secunia.com/advisories/43086 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html · Vendor Advisory