PT-2010-3453 · Google+1 · Google Chrome+3

Chasen Le Hara · Published 2010-09-24 · Updated 2020-07-31 · CVE-2010-1823

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions WebKit versions before r65958 Google Chrome versions before 6.0.472.59

Description A use-after-free issue allows remote attackers to cause a denial of service or possibly have other unspecified impacts via vectors that trigger the use of document APIs, such as document.close(), during parsing. This can be demonstrated by a Cascading Style Sheets (CSS) file referencing an invalid SVG font.

Recommendations For WebKit versions before r65958, update to version r65958 or later. For Google Chrome versions before 6.0.472.59, update to version 6.0.472.59 or later.

Fix

DoS

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2010-1823

Affected Products

Google Chrome

Safari

Webkit

Itunes

References · 13

• https://bugs.webkit.org/show_bug.cgi?id=44533 · Patch
• http://lists.apple.com/archives/security-announce/2011//Jul/msg00002.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-1823 · Security Note
• http://code.google.com/p/chromium/issues/detail?id=50250 · Vendor Advisory
• http://lists.apple.com/archives/Security-announce/2011//Oct/msg00000.html · Vendor Advisory
• http://googlechromereleases.blogspot.com/2010/09/stable-beta-channel-updates_14.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html · Vendor Advisory
• http://support.apple.com/kb/HT4808 · Note
• http://secunia.com/advisories/43068 · Note
• http://support.apple.com/kb/HT4981 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7405 · Note
• https://bugs.webkit.org/show_bug.cgi?id=43055 · Note
• http://vupen.com/english/advisories/2011/0212 · Note