Executive Summary
| Informations | |||
|---|---|---|---|
| Name | CVE-2010-4577 | First vendor Publication | 2010-12-21 |
| Vendor | Cve | Last vendor Modification | 2024-02-02 |
Security-Database Scoring CVSS v3
| Cvss vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | |||
|---|---|---|---|
| Overall CVSS Score | 7.5 | ||
| Base Score | 7.5 | Environmental Score | 7.5 |
| impact SubScore | 3.6 | Temporal Score | 7.5 |
| Exploitabality Sub Score | 3.9 | ||
| Attack Vector | Network | Attack Complexity | Low |
| Privileges Required | None | User Interaction | None |
| Scope | Unchanged | Confidentiality Impact | None |
| Integrity Impact | None | Availability Impact | High |
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 5 | Attack Range | Network |
| Cvss Impact Score | 2.9 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| The CSSParser::parseFontFaceSrc function in WebCore/css/CSSParser.cpp in WebKit, as used in Google Chrome before 8.0.552.224, Chrome OS before 8.0.552.343, webkitgtk before 1.2.6, and other products does not properly parse Cascading Style Sheets (CSS) token sequences, which allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted local font, related to "Type Confusion." |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4577 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-125 | Out-of-bounds Read |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:13953 | |||
| Oval ID: | oval:org.mitre.oval:def:13953 | ||
| Title: | The CSSParser::parseFontFaceSrc function in WebCore/css/CSSParser.cpp in WebKit, as used in Google Chrome before 8.0.552.224, Chrome OS before 8.0.552.343, webkitgtk before 1.2.6, and other products does not properly parse Cascading Style Sheets (CSS) token sequences, which allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted local font, related to "Type Confusion." | ||
| Description: | The CSSParser::parseFontFaceSrc function in WebCore/css/CSSParser.cpp in WebKit, as used in Google Chrome before 8.0.552.224, Chrome OS before 8.0.552.343, webkitgtk before 1.2.6, and other products does not properly parse Cascading Style Sheets (CSS) token sequences, which allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted local font, related to "Type Confusion." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2010-4577 | Version: | 15 |
| Platform(s): | Microsoft Windows 7 Microsoft Windows Server 2008 Microsoft Windows Vista Microsoft Windows Server 2003 Microsoft Windows XP Microsoft Windows 2000 | Product(s): | Google Chrome |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:21433 | |||
| Oval ID: | oval:org.mitre.oval:def:21433 | ||
| Title: | RHSA-2011:0177: webkitgtk security update (Moderate) | ||
| Description: | The CSSParser::parseFontFaceSrc function in WebCore/css/CSSParser.cpp in WebKit, as used in Google Chrome before 8.0.552.224, Chrome OS before 8.0.552.343, webkitgtk before 1.2.6, and other products does not properly parse Cascading Style Sheets (CSS) token sequences, which allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted local font, related to "Type Confusion." | ||
| Family: | unix | Class: | patch |
| Reference(s): | RHSA-2011:0177-01 CVE-2010-1780 CVE-2010-1782 CVE-2010-1783 CVE-2010-1784 CVE-2010-1785 CVE-2010-1786 CVE-2010-1787 CVE-2010-1788 CVE-2010-1790 CVE-2010-1792 CVE-2010-1793 CVE-2010-1807 CVE-2010-1812 CVE-2010-1814 CVE-2010-1815 CVE-2010-3113 CVE-2010-3114 CVE-2010-3115 CVE-2010-3116 CVE-2010-3119 CVE-2010-3255 CVE-2010-3257 CVE-2010-3259 CVE-2010-3812 CVE-2010-3813 CVE-2010-4197 CVE-2010-4198 CVE-2010-4204 CVE-2010-4206 CVE-2010-4577 | Version: | 393 |
| Platform(s): | Red Hat Enterprise Linux 6 | Product(s): | webkitgtk |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:23285 | |||
| Oval ID: | oval:org.mitre.oval:def:23285 | ||
| Title: | ELSA-2011:0177: webkitgtk security update (Moderate) | ||
| Description: | The CSSParser::parseFontFaceSrc function in WebCore/css/CSSParser.cpp in WebKit, as used in Google Chrome before 8.0.552.224, Chrome OS before 8.0.552.343, webkitgtk before 1.2.6, and other products does not properly parse Cascading Style Sheets (CSS) token sequences, which allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted local font, related to "Type Confusion." | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2011:0177-01 CVE-2010-1780 CVE-2010-1782 CVE-2010-1783 CVE-2010-1784 CVE-2010-1785 CVE-2010-1786 CVE-2010-1787 CVE-2010-1788 CVE-2010-1790 CVE-2010-1792 CVE-2010-1793 CVE-2010-1807 CVE-2010-1812 CVE-2010-1814 CVE-2010-1815 CVE-2010-3113 CVE-2010-3114 CVE-2010-3115 CVE-2010-3116 CVE-2010-3119 CVE-2010-3255 CVE-2010-3257 CVE-2010-3259 CVE-2010-3812 CVE-2010-3813 CVE-2010-4197 CVE-2010-4198 CVE-2010-4204 CVE-2010-4206 CVE-2010-4577 | Version: | 125 |
| Platform(s): | Oracle Linux 6 | Product(s): | webkitgtk |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:27757 | |||
| Oval ID: | oval:org.mitre.oval:def:27757 | ||
| Title: | DEPRECATED: ELSA-2011-0177 -- webkitgtk security update (moderate) | ||
| Description: | [1.2.6-2] - Added fix for js regression [1.2.6-1] - Update to 1.2.6 | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2011-0177 CVE-2010-3255 CVE-2010-3257 CVE-2010-3259 CVE-2010-3812 CVE-2010-3813 CVE-2010-1780 CVE-2010-1782 CVE-2010-1783 CVE-2010-1784 CVE-2010-1785 CVE-2010-1786 CVE-2010-1787 CVE-2010-1788 CVE-2010-1790 CVE-2010-1792 CVE-2010-1793 CVE-2010-1807 CVE-2010-1812 CVE-2010-1814 CVE-2010-1815 CVE-2010-3113 CVE-2010-3114 CVE-2010-3115 CVE-2010-3116 CVE-2010-3119 CVE-2010-4197 CVE-2010-4198 CVE-2010-4204 CVE-2010-4206 CVE-2010-4577 | Version: | 4 |
| Platform(s): | Oracle Linux 6 | Product(s): | webkitgtk |
| Definition Synopsis: | |||
CPE : Common Platform Enumeration
ExploitDB Exploits
| id | Description |
|---|---|
| 2012-11-01 | Konqueror 4.7.3 Memory Corruption |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2012-06-05 | Name : RedHat Update for webkitgtk RHSA-2011:0177-01 File : nvt/gb_RHSA-2011_0177-01_webkitgtk.nasl |
| 2011-08-27 | Name : Ubuntu Update for webkit USN-1195-1 File : nvt/gb_ubuntu_USN_1195_1.nasl |
| 2011-05-12 | Name : Debian Security Advisory DSA 2188-1 (webkit) File : nvt/deb_2188_1.nasl |
| 2011-03-09 | Name : Gentoo Security Advisory GLSA 201012-01 (chromium) File : nvt/glsa_201012_01.nasl |
| 2011-01-24 | Name : FreeBSD Ports: webkit-gtk2 File : nvt/freebsd_webkit-gtk22.nasl |
| 2011-01-11 | Name : Fedora Update for webkitgtk FEDORA-2011-0121 File : nvt/gb_fedora_2011_0121_webkitgtk_fc13.nasl |
| 2010-12-27 | Name : Google Chrome multiple vulnerabilities - Dec 10(Linux) File : nvt/gb_google_chrome_mult_vuln_dec10_lin.nasl |
| 2010-12-27 | Name : Google Chrome multiple vulnerabilities - Dec 10(Windows) File : nvt/gb_google_chrome_mult_vuln_dec10_win.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 70105 | Google Chrome CSS Token Sequence Out-of-bounds Read Remote DoS Google Chrome contains a flaw that may allow a remote denial of service. The issue is triggered when the program fails to properly parse CSS token sequences, allowing a remote attacker to cause an out-of-bounds read denial of service via unspecified vectors. |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2014-12-15 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201412-09.nasl - Type : ACT_GATHER_INFO |
| 2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2011-0177.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20110125_webkitgtk_on_SL6_x.nasl - Type : ACT_GATHER_INFO |
| 2011-08-24 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-1195-1.nasl - Type : ACT_GATHER_INFO |
| 2011-03-11 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2188.nasl - Type : ACT_GATHER_INFO |
| 2011-01-26 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2011-0177.nasl - Type : ACT_GATHER_INFO |
| 2011-01-10 | Name : The remote Fedora host is missing a security update. File : fedora_2011-0121.nasl - Type : ACT_GATHER_INFO |
| 2011-01-03 | Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_06a12e26142e11e0bea20015f2db7bde.nasl - Type : ACT_GATHER_INFO |
| 2010-12-20 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201012-01.nasl - Type : ACT_GATHER_INFO |
| 2010-12-14 | Name : The remote host contains a web browser that is affected by multiple vulnerabi... File : google_chrome_8_0_552_224.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2024-02-02 09:28:17 |
|
| 2021-05-05 01:07:55 |
|
| 2021-05-04 12:13:34 |
|
| 2021-04-22 01:14:08 |
|
| 2020-09-29 01:06:05 |
|
| 2020-08-01 00:22:41 |
|
| 2020-05-23 01:43:12 |
|
| 2020-05-23 00:27:05 |
|
| 2017-11-15 12:01:14 |
|
| 2017-09-19 09:24:07 |
|
| 2016-11-09 12:02:54 |
|
| 2016-04-26 20:17:57 |
|
| 2014-12-16 13:24:45 |
|
| 2014-10-28 13:25:24 |
|
| 2014-02-17 10:59:01 |
|
| 2013-05-10 23:38:45 |
|
