Multiple use-after-free vulnerabilities in WebKit, as used in Apple Safari before 4.1.3 and 5.0.x before 5.0.3, Google Chrome before 5.0.375.127, and webkitgtk before 1.2.6, allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to improper handling of MIME types by plug-ins.

The remote MiracleLinux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2011-34:01 advisory.

    WebKitGTK+ is the port of the portable web rendering engine WebKit to the     GTK+ platform.
    Security issues fixed with this release:
    CVE-2010-1780     Use-after-free vulnerability in WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and     Windows, and before 4.1.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a     denial of service (application crash) via vectors related to element focus.
    CVE-2010-1782     WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.1 on Mac OS     X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption     and application crash) via vectors related to the rendering of an inline element.
    CVE-2010-1783     WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.1 on Mac OS     X 10.4, does not properly handle dynamic modification of a text node, which allows remote attackers to     execute arbitrary code or cause a denial of service (memory corruption and application crash) via a     crafted HTML document.
    CVE-2010-1784     The counters functionality in the Cascading Style Sheets (CSS) implementation in WebKit in Apple Safari     before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.1 on Mac OS X 10.4, allows remote     attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash)     via a crafted HTML document.
    CVE-2010-1785     WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.1 on Mac OS     X 10.4, accesses uninitialized memory during processing of the (1) :first-letter and (2) :first-line     pseudo-elements in an SVG text element, which allows remote attackers to execute arbitrary code or cause a     denial of service (application crash) via a crafted document.
    CVE-2010-1786     Use-after-free vulnerability in WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and     Windows, and before 4.1.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a     denial of service (application crash) via a foreignObject element in an SVG document.
    CVE-2010-1787     WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.1 on Mac OS     X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption     and application crash) via a floating element in an SVG document.
    CVE-2010-1788     WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.1 on Mac OS     X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption     and application crash) via a use element in an SVG document.
    CVE-2010-1790     WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.1 on Mac OS     X 10.4, does not properly handle just-in-time (JIT) compiled JavaScript stubs, which allows remote     attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted HTML     document, related to a 'reentrancy issue.'     CVE-2010-1792     WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.1 on Mac OS     X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption     and application crash) via a crafted regular expression.
    CVE-2010-1793     Multiple use-after-free vulnerabilities in WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through     10.6 and Windows, and before 4.1.1 on Mac OS X 10.4, allow remote attackers to execute arbitrary code or     cause a denial of service (application crash) via a (1) font-face or (2) use element in an SVG document.
    CVE-2010-1807     WebKit in Apple Safari 4.x before 4.1.2 and 5.x before 5.0.2, and Android before 2.2, does not properly     validate floating-point data, which allows remote attackers to execute arbitrary code or cause a denial of     service (application crash) via a crafted HTML document.
    CVE-2010-1812     Use-after-free vulnerability in WebKit in Apple iOS before 4.1 on the iPhone and iPod touch allows remote     attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving     selections.
    CVE-2010-1814     WebKit in Apple iOS before 4.1 on the iPhone and iPod touch allows remote attackers to execute arbitrary     code or cause a denial of service (memory corruption and application crash) via vectors involving form     menus.
    CVE-2010-1815     CVE-2010-3113     Use-after-free vulnerability in WebKit in Apple iOS before 4.1 on the iPhone and iPod touch allows remote     attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving     scrollbars.
    CVE-2010-3114     Google Chrome before 5.0.375.127 does not properly handle SVG documents, which allows remote attackers to     cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown     vectors.
    CVE-2010-3115     The text-editing implementation in Google Chrome before 5.0.375.127 does not properly perform casts, which     has unspecified impact and attack vectors.
    CVE-2010-3116     Multiple use-after-free vulnerabilities in WebKit, as used in Apple Safari before 4.1.3 and 5.0.x before     5.0.3 and Google Chrome before 5.0.375.127, allow remote attackers to execute arbitrary code or cause a     denial of service (application crash) via vectors related to improper handling of MIME types by plug-ins.
    CVE-2010-3119     Google Chrome before 5.0.375.127 does not properly support the Ruby language, which allows attackers to     cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown     vectors.
    CVE-2010-3255     Google Chrome before 6.0.472.53 does not properly handle counter nodes, which allows remote attackers to     cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown     vectors.
    CVE-2010-3257     Use-after-free vulnerability in WebKit, as used in Apple Safari before 4.1.3 and 5.0.x before 5.0.3 and     Google Chrome before 6.0.472.53, allows remote attackers to execute arbitrary code or cause a denial of     service (application crash) via vectors involving element focus.
    CVE-2010-3259     WebKit, as used in Apple Safari before 4.1.3 and 5.0.x before 5.0.3 and Google Chrome before 6.0.472.53,     does not properly restrict read access to images derived from CANVAS elements, which allows remote     attackers to bypass the Same Origin Policy and obtain potentially sensitive image data via a crafted web     site.
    CVE-2010-3812     Integer overflow in the Text::wholeText method in dom/Text.cpp in WebKit, as used in Apple Safari before     5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on Mac OS X 10.4; webkitgtk before     1.2.6; and possibly other products allows remote attackers to execute arbitrary code or cause a denial of     service (application crash) via vectors involving Text objects.
    CVE-2010-3813     The WebCore::HTMLLinkElement::process function in WebCore/html/HTMLLinkElement.cpp in WebKit, as used in     Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on Mac OS X 10.4;
    webkitgtk before 1.2.6; and possibly other products does not verify whether DNS prefetching is enabled     when processing an HTML LINK element, which allows remote attackers to bypass intended access     restrictions, as demonstrated by an HTML e-mail message that uses a LINK element for X-Confirm-Reading-To     functionality.
    CVE-2010-4197     Use-after-free vulnerability in WebKit, as used in Google Chrome before 7.0.517.44, webkitgtk before     1.2.6, and other products, allows remote attackers to cause a denial of service or possibly have     unspecified other impact via vectors involving text editing.
    CVE-2010-4198     WebKit, as used in Google Chrome before 7.0.517.44, webkitgtk before 1.2.6, and other products, does not     properly handle large text areas, which allows remote attackers to cause a denial of service (memory     corruption) or possibly have unspecified other impact via a crafted HTML document.
    CVE-2010-4204     WebKit, as used in Google Chrome before 7.0.517.44, webkitgtk before 1.2.6, and other products, accesses a     frame object after this object has been destroyed, which allows remote attackers to cause a denial of     service or possibly have unspecified other impact via unknown vectors.
    CVE-2010-4206     Array index error in the FEBlend::apply function in WebCore/platform/graphics/filters/FEBlend.cpp in     WebKit, as used in Google Chrome before 7.0.517.44, webkitgtk before 1.2.6, and other products, allows     remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted SVG     document, related to effects in the application of filters.
    CVE-2010-4577     The CSSParser::parseFontFaceSrc function in WebCore/css/CSSParser.cpp in WebKit, as used in Google Chrome     before 8.0.552.224, Chrome OS before 8.0.552.343, webkitgtk before 1.2.6, and other products does not     properly parse Cascading Style Sheets (CSS) token sequences, which allows remote attackers to cause a     denial of service (out-of-bounds read) via a crafted local font, related to 'Type Confusion.'

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Various bugs in webkit have been fixed. The CVE id's are :

CVE-2009-0945, CVE-2009-1681, CVE-2009-1684, CVE-2009-1685, CVE-2009-1686, CVE-2009-1687, CVE-2009-1688, CVE-2009-1689, CVE-2009-1691, CVE-2009-1690, CVE-2009-1692, CVE-2009-1693, CVE-2009-1694, CVE-2009-1695, CVE-2009-1696, CVE-2009-1697, CVE-2009-1698, CVE-2009-1699, CVE-2009-1700, CVE-2009-1701, CVE-2009-1702, CVE-2009-1703, CVE-2009-1709, CVE-2009-1710, CVE-2009-1711, CVE-2009-1712, CVE-2009-1713, CVE-2009-1714, CVE-2009-1715, CVE-2009-1718, CVE-2009-1724, CVE-2009-1725, CVE-2009-2195, CVE-2009-2199, CVE-2009-2200, CVE-2009-2419, CVE-2009-2797, CVE-2009-2816, CVE-2009-2841, CVE-2009-3272, CVE-2009-3384, CVE-2009-3933, CVE-2009-3934, CVE-2010-0046, CVE-2010-0047, CVE-2010-0048, CVE-2010-0049, CVE-2010-0050, CVE-2010-0052, CVE-2010-0053, CVE-2010-0054, CVE-2010-0315, CVE-2010-0647, CVE-2010-0051, CVE-2010-0650, CVE-2010-0651, CVE-2010-0656, CVE-2010-0659, CVE-2010-0661, CVE-2010-1029, CVE-2010-1126, CVE-2010-1233, CVE-2010-1236, CVE-2010-1386, CVE-2010-1387, CVE-2010-1388, CVE-2010-1389, CVE-2010-1390, CVE-2010-1391, CVE-2010-1392, CVE-2010-1393, CVE-2010-1394, CVE-2010-1395, CVE-2010-1396, CVE-2010-1397, CVE-2010-1398, CVE-2010-1399, CVE-2010-1400, CVE-2010-1401, CVE-2010-1402, CVE-2010-1403, CVE-2010-1404, CVE-2010-1405, CVE-2010-1406, CVE-2010-1407, CVE-2010-1408, CVE-2010-1409, CVE-2010-1410, CVE-2010-1412, CVE-2010-1413, CVE-2010-1414, CVE-2010-1415, CVE-2010-1416, CVE-2010-1417, CVE-2010-1418, CVE-2010-1419, CVE-2010-1421, CVE-2010-1422, CVE-2010-1729, CVE-2010-1749, CVE-2010-1757, CVE-2010-1758, CVE-2010-1759, CVE-2010-1760, CVE-2010-1761, CVE-2010-1762, CVE-2010-1763, CVE-2010-1764, CVE-2010-1766, CVE-2010-1767, CVE-2010-1769, CVE-2010-1770, CVE-2010-1771, CVE-2010-1772, CVE-2010-1773, CVE-2010-1774, CVE-2010-1780, CVE-2010-1781, CVE-2010-1782, CVE-2010-1783, CVE-2010-1784, CVE-2010-1785, CVE-2010-1786, CVE-2010-1787, CVE-2010-1788, CVE-2010-1789, CVE-2010-1790, CVE-2010-1791, CVE-2010-1792, CVE-2010-1793, CVE-2010-1807, CVE-2010-1812, CVE-2010-1813, CVE-2010-1814, CVE-2010-1815, CVE-2010-1822, CVE-2010-1823, CVE-2010-1824, CVE-2010-1825, CVE-2010-2264, CVE-2010-2295, CVE-2010-2297, CVE-2010-2300, CVE-2010-2301, CVE-2010-2302, CVE-2010-2441, CVE-2010-3116, CVE-2010-3257, CVE-2010-3259, CVE-2010-3312, CVE-2010-3803, CVE-2010-3804, CVE-2010-3805, CVE-2010-3808, CVE-2010-3809, CVE-2010-3810, CVE-2010-3811, CVE-2010-3812, CVE-2010-3813, CVE-2010-3816, CVE-2010-3817, CVE-2010-3818, CVE-2010-3819, CVE-2010-3820, CVE-2010-3821, CVE-2010-3822, CVE-2010-3823, CVE-2010-3824, CVE-2010-3826, CVE-2010-3829, CVE-2010-3900, CVE-2010-4040

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-0177 advisory.

    [1.2.6-2]
    - Added fix for js regression

    [1.2.6-1]
    - Update to 1.2.6

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple memory corruption flaws were found in WebKit. Malicious web content could cause an application using WebKitGTK+ to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2010-1782, CVE-2010-1783, CVE-2010-1784, CVE-2010-1785, CVE-2010-1787, CVE-2010-1788, CVE-2010-1790, CVE-2010-1792, CVE-2010-1807, CVE-2010-1814, CVE-2010-3114, CVE-2010-3116, CVE-2010-3119, CVE-2010-3255, CVE-2010-3812, CVE-2010-4198)

Multiple use-after-free flaws were found in WebKit. Malicious web content could cause an application using WebKitGTK+ to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2010-1780, CVE-2010-1786, CVE-2010-1793, CVE-2010-1812, CVE-2010-1815, CVE-2010-3113, CVE-2010-3257, CVE-2010-4197, CVE-2010-4204)

Two array index errors, leading to out-of-bounds memory reads, were found in WebKit. Malicious web content could cause an application using WebKitGTK+ to crash. (CVE-2010-4206, CVE-2010-4577)

A flaw in WebKit could allow malicious web content to trick a user into thinking they are visiting the site reported by the location bar, when the page is actually content controlled by an attacker.
(CVE-2010-3115)

It was found that WebKit did not correctly restrict read access to images created from the 'canvas' element. Malicious web content could allow a remote attacker to bypass the same-origin policy and potentially access sensitive image data. (CVE-2010-3259)

A flaw was found in the way WebKit handled DNS prefetching. Even when it was disabled, web content containing certain 'link' elements could cause WebKitGTK+ to perform DNS prefetching. (CVE-2010-3813)

All running applications that use WebKitGTK+ must be restarted for this update to take effect.

Multiple cross-site scripting, denial of service and arbitrary code execution security flaws were discovered in webkit.

Please consult the CVE web links for further information.

The updated packages have been upgraded to the latest version (1.2.7) to correct these issues.

Updated webkitgtk packages that fix several security issues are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

WebKitGTK+ is the port of the portable web rendering engine WebKit to the GTK+ platform.

Multiple memory corruption flaws were found in WebKit. Malicious web content could cause an application using WebKitGTK+ to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2010-1782, CVE-2010-1783, CVE-2010-1784, CVE-2010-1785, CVE-2010-1787, CVE-2010-1788, CVE-2010-1790, CVE-2010-1792, CVE-2010-1807, CVE-2010-1814, CVE-2010-3114, CVE-2010-3116, CVE-2010-3119, CVE-2010-3255, CVE-2010-3812, CVE-2010-4198)

Multiple use-after-free flaws were found in WebKit. Malicious web content could cause an application using WebKitGTK+ to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2010-1780, CVE-2010-1786, CVE-2010-1793, CVE-2010-1812, CVE-2010-1815, CVE-2010-3113, CVE-2010-3257, CVE-2010-4197, CVE-2010-4204)

Two array index errors, leading to out-of-bounds memory reads, were found in WebKit. Malicious web content could cause an application using WebKitGTK+ to crash. (CVE-2010-4206, CVE-2010-4577)

A flaw in WebKit could allow malicious web content to trick a user into thinking they are visiting the site reported by the location bar, when the page is actually content controlled by an attacker.
(CVE-2010-3115)

It was found that WebKit did not correctly restrict read access to images created from the 'canvas' element. Malicious web content could allow a remote attacker to bypass the same-origin policy and potentially access sensitive image data. (CVE-2010-3259)

A flaw was found in the way WebKit handled DNS prefetching. Even when it was disabled, web content containing certain 'link' elements could cause WebKitGTK+ to perform DNS prefetching. (CVE-2010-3813)

Users of WebKitGTK+ should upgrade to these updated packages, which contain WebKitGTK+ version 1.2.6, and resolve these issues. All running applications that use WebKitGTK+ must be restarted for this update to take effect.

The remote mobile host is a using a version of Apple iOS earlier than 4.2. Such versions are potentially affected by multiple vulnerabilities. Apple iOS 4.2 contains security fixes for the following components :

  - Configuration Policies

  - CoreGraphics

  - FreeType

  - iAd Content Display

  - ImageIO

  - libxml

  - Mail

  - Networking

  - OfficeImport

  - Photos

  - Safari

  - Telephony

  - WebKit

  - Multiple components

The version of Safari installed on the remote Windows host is earlier than 5.0.3.  As such, it is potentially affected by numerous issues in its WebKit component that could allow arbitrary code execution, session tracking, address bar spoofing, and other sorts of attacks.

The version of Apple Safari installed on the remote Mac OS X host is earlier than 5.0.3 / 4.1.3.  As such, it is potentially affected by numerous issues in its WebKit component that could allow arbitrary code execution, session tracking, address bar spoofing, and other sorts of attacks.

Gustavo Noronha Silva reports :

The patches to fix the following CVEs are included with help from Vincent Danen and other members of the Red Hat security team:

A large number of security issues were discovered in the WebKit browser and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary code execution.

Please consult the bug listed at the top of this advisory to get the exact list of CVE numbers fixed for each release.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- New stable release, API and ABI compatible with previous     1.2.x versions.

  - The patches to fix the following CVEs are included with     help from Vincent Danen and other members of the Red Hat     security team :

CVE-2010-3113 CVE-2010-1814 CVE-2010-1812 CVE-2010-1815 CVE-2010-3115 CVE-2010-1807 CVE-2010-3114 CVE-2010-3116 CVE-2010-3257 CVE-2010-3259

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host has Safari installed.

Versions of Safari earlier than 4.1.3 / 5.0.3 are potentially affected by several issues in the following component :

  - Safari

  -  Webkit

The version of Google Chrome installed on the remote host is earlier than 5.0.375.127.  Such versions are reportedly affected by multiple vulnerabilities :

  - A memory corruption vulnerability exists with the file     dialog. (Issue #45400)

  - A memory corruption vulnerability exists when     processing SVG files. (Issue #49596)

  - A vulnerability exists due to a bad cast with text     editing. (Issue #49628)

  - A vulnerability exists that possibly allows address     bar spoofing via a history bug. (Issue #49964)

  - A memory corruption vulnerability exists in MIME type     handling. (Issue #50515, #51835)

  - A vulnerability exists due to a crash on shutdown via a     notifications bug. (Issue #50553)

  - A vulnerability can be triggered in omnibox autosuggest     if the user may be going to type a password.
    (Issue #51146)

  - A memory corruption vulnerability exists in ruby     support. (Issue #51654)

  - A memory corruption vulnerability exists in Geolocation     support. (Issue #51670)

ID	Name	Product	Family	Type	Severity
284347	MiracleLinux 4 : webkitgtk-1.2.6-2.AXS4 (AXSA:2011-34:01)	Nessus	Miracle Linux Local Security Checks	Local	high
75629	openSUSE Security Update : libwebkit (openSUSE-SU-2011:0024-1)	Nessus	SuSE Local Security Checks	Local	critical
68187	Oracle Linux 6 : webkitgtk (ELSA-2011-0177)	Nessus	Oracle Linux Local Security Checks	Local	critical
60943	Scientific Linux Security Update : webkitgtk on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	Local	critical
53764	openSUSE Security Update : libwebkit (openSUSE-SU-2011:0024-1)	Nessus	SuSE Local Security Checks	Local	critical
52523	Mandriva Linux Security Advisory : webkit (MDVSA-2011:039)	Nessus	Mandriva Local Security Checks	Local	critical
51672	RHEL 6 : webkitgtk (RHSA-2011:0177)	Nessus	Red Hat Local Security Checks	Local	critical
5715	Apple iOS < 4.2 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices		critical
50654	Safari < 5.0.3 Multiple Vulnerabilities	Nessus	Windows	Local	high
50653	Mac OS X : Apple Safari < 5.0.3 / 4.1.3	Nessus	MacOS X Local Security Checks	Local	high
50075	FreeBSD : Webkit-gtk2 -- Multiple Vulnabilities (e5090d2a-dbbe-11df-82f8-0015f2db7bde)	Nessus	FreeBSD Local Security Checks	Local	critical
50046	Ubuntu 9.10 / 10.04 LTS / 10.10 : webkit vulnerabilities (USN-1006-1)	Nessus	Ubuntu Local Security Checks	Local	critical
50034	Fedora 12 : webkitgtk-1.2.5-1.fc12 (2010-15982)	Nessus	Fedora Local Security Checks	Local	critical
50030	Fedora 13 : webkitgtk-1.2.5-1.fc13 (2010-15957)	Nessus	Fedora Local Security Checks	Local	critical
5711	Safari < 4.1.3 / 5.0.3 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients		high
48383	Google Chrome < 5.0.375.127 Multiple Vulnerabilities	Nessus	Windows	Local	high

Detections

Analytics

CVE-2010-3116

critical

Tenable Plugins

high

critical

critical

critical

critical

critical

critical

critical

high

high

critical

critical

critical

critical

high

high