CVE-2010-1759

HIGH

Description

Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to the Node.normalize method.

References

http://lists.apple.com/archives/security-announce/2010//Jun/msg00002.html

http://lists.apple.com/archives/security-announce/2010/Jun/msg00000.html

http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html

http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html

http://secunia.com/advisories/40105

http://secunia.com/advisories/40196

http://secunia.com/advisories/41856

http://secunia.com/advisories/43068

http://securitytracker.com/id?1024067

http://support.apple.com/kb/HT4196

http://support.apple.com/kb/HT4220

http://support.apple.com/kb/HT4225

http://www.mandriva.com/security/advisories?name=MDVSA-2011:039

http://www.securityfocus.com/bid/40620

http://www.ubuntu.com/usn/USN-1006-1

http://www.vupen.com/english/advisories/2010/1373

http://www.vupen.com/english/advisories/2010/1512

http://www.vupen.com/english/advisories/2010/2722

http://www.vupen.com/english/advisories/2011/0212

http://www.vupen.com/english/advisories/2011/0552

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7005

Details

Source: MITRE

Published: 2010-06-11

Updated: 2017-09-19

Type: CWE-399

Risk Information

CVSS v2.0

Base Score: 9.3

Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C

Impact Score: 10

Exploitability Score: 8.6

Severity: HIGH

Vulnerable Software

Configuration 1

AND

OR

cpe:2.3:a:apple:safari:4.0:*:*:*:*:*:*:*

cpe:2.3:a:apple:safari:4.0.0b:*:*:*:*:*:*:*

cpe:2.3:a:apple:safari:4.0.1:*:*:*:*:*:*:*

cpe:2.3:a:apple:safari:4.0.2:*:*:*:*:*:*:*

cpe:2.3:a:apple:safari:4.0.3:*:*:*:*:*:*:*

cpe:2.3:a:apple:safari:4.0.4:*:*:*:*:*:*:*

cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*

cpe:2.3:a:apple:webkit:*:*:*:*:*:*:*:*

OR

cpe:2.3:o:apple:mac_os_x:10.5:*:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x:10.5.0:*:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x:10.5.1:*:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x:10.5.2:*:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x:10.5.3:*:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x:10.5.4:*:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x:10.5.5:*:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x:10.5.6:*:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x:10.5.7:*:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x:10.5.8:*:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x:10.6.0:*:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x:10.6.1:*:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x:10.6.2:*:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x:10.6.3:*:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x_server:10.5:*:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x_server:10.5.0:*:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x_server:10.5.1:*:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x_server:10.5.2:*:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x_server:10.5.3:*:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x_server:10.5.4:*:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x_server:10.5.5:*:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x_server:10.5.6:*:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x_server:10.5.7:*:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x_server:10.5.8:*:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x_server:10.6.0:*:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x_server:10.6.1:*:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x_server:10.6.2:*:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x_server:10.6.3:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_7:*:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_vista:*:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*

Configuration 2

AND

OR

cpe:2.3:a:apple:safari:4.0:*:*:*:*:*:*:*

cpe:2.3:a:apple:safari:4.0.0b:*:*:*:*:*:*:*

cpe:2.3:a:apple:safari:4.0.1:*:*:*:*:*:*:*

cpe:2.3:a:apple:safari:4.0.2:*:*:*:*:*:*:*

cpe:2.3:a:apple:safari:4.0.3:*:*:*:*:*:*:*

cpe:2.3:a:apple:safari:4.0.4:*:*:*:*:*:*:*

cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*

cpe:2.3:a:apple:webkit:*:*:*:*:*:*:*:*

OR

cpe:2.3:o:apple:mac_os_x:10.4:*:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x:10.4.0:*:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x:10.4.1:*:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x:10.4.2:*:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x:10.4.3:*:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x:10.4.4:*:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x:10.4.5:*:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x:10.4.6:*:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x:10.4.7:*:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x:10.4.8:*:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x:10.4.9:*:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x:10.4.10:*:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x:10.4.11:*:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x_server:10.4:*:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x_server:10.4.0:*:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x_server:10.4.1:*:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x_server:10.4.2:*:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x_server:10.4.3:*:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x_server:10.4.4:*:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x_server:10.4.5:*:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x_server:10.4.6:*:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x_server:10.4.7:*:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x_server:10.4.8:*:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x_server:10.4.9:*:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x_server:10.4.10:*:*:*:*:*:*:*

cpe:2.3:o:apple:mac_os_x_server:10.4.11:*:*:*:*:*:*:*

Tenable Plugins

View all (14 total)

IDNameProductFamilySeverity
75629openSUSE Security Update : libwebkit (openSUSE-SU-2011:0024-1)NessusSuSE Local Security Checks
critical
75627openSUSE Security Update : libwebkit (openSUSE-SU-2010:0458-1)NessusSuSE Local Security Checks
critical
53764openSUSE Security Update : libwebkit (openSUSE-SU-2011:0024-1)NessusSuSE Local Security Checks
critical
52523Mandriva Linux Security Advisory : webkit (MDVSA-2011:039)NessusMandriva Local Security Checks
critical
50046Ubuntu 9.10 / 10.04 LTS / 10.10 : webkit vulnerabilities (USN-1006-1)NessusUbuntu Local Security Checks
critical
47751FreeBSD : webkit-gtk2 -- Multiple vulnerabilities (19419b3b-92bd-11df-b140-0015f2db7bde)NessusFreeBSD Local Security Checks
critical
5578Apple iOS < 4.0 Multiple VulnerabilitiesNessus Network MonitorMobile Devices
critical
5573iTunes < 9.2 Multiple VulnerabilitiesNessus Network MonitorWeb Clients
medium
47038Apple iTunes < 9.2 Multiple Vulnerabilities (uncredentialed check)NessusPeer-To-Peer File Sharing
high
47037Apple iTunes < 9.2 Multiple Vulnerabilities (credentialed check)NessusWindows
high
801012Safari < 4.1 / 5.0 Multiple VulnerabilitiesLog Correlation EngineWeb Clients
high
5566Safari < 4.1 / 5.0 Multiple VulnerabilitiesNessus Network MonitorWeb Clients
critical
46838Safari < 5.0 Multiple VulnerabilitiesNessusWindows
high
46837Mac OS X : Apple Safari < 5.0 / 4.1NessusMacOS X Local Security Checks
high