CVSS: 10.0EPSS: 29%CPEs: 78EXPL: 0CVE-2010-1786 – Apple Webkit SVG ForeignObject Rendering Layout Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2010-1786
Use-after-free vulnerability in WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.1 on Mac OS X 10.4; and webkitgtk before 1.2.6; allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a foreignObject element in an SVG document. Vulnerabilidad de usar después de liberar en WebKit de Apple Safari en versiones anteriores a la v5.0.1 en Mac OS X v10.5 hasta v10.6 y Windows, y anteriores a la v4.1.1 en Mac OS X v10.4, permite a atacantes remotos ejecutar código de su elección o provocar una denegación de servicio (corrupción de memoria y caída de la aplicación) a través de elemento foreignObject en un documento SVG. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple Safari's Webkit. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within Webkit's layout implementation of an particular tag used for embedding a foreign document into the SVG namespace. Later when the application attempts to calculate layout information for rendering the contents of the tag, the application will attempt to access a linebox that was previously destroyed. • http://lists.apple.com/archives/security-announce/2010//Jul/msg00001.html http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html http://lists.apple.com/archives/security-announce/2010//Sep/msg00002.html http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00000.html http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html http://secunia.com/advisories/41856 http://secunia.com/advisories/42314 http://secunia.com/advisories/43068 http:/&#x • CWE-399: Resource Management Errors •
CVSS: 9.3EPSS: 6%CPEs: 78EXPL: 0CVE-2010-1789
https://notcve.org/view.php?id=CVE-2010-1789
Heap-based buffer overflow in WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a JavaScript string object. Desbordamiento de búfer de memoria dinámica en WebKit de Apple Safari en versiones anteriores a la v5.0.1 en Mac OS X v10.5 hasta v10.6 y Windows, y anteriores a la v4.1.1 en Mac OS X v10.4, permite a atacantes remotos ejecutar código de su elección o provocar una denegación de servicio (caída de la aplicación) a través de un objeto cada de JavaScript. • http://lists.apple.com/archives/security-announce/2010//Jul/msg00001.html http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html http://secunia.com/advisories/42314 http://secunia.com/advisories/43068 http://support.apple.com/kb/HT4276 http://support.apple.com/kb/HT4456 http://www.securityfocus.com/bid/42020 http://www.vupen.com/english/advisories/2010/3046 http://www.vupen.com& • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.8EPSS: 1%CPEs: 8EXPL: 0CVE-2010-2500 – freetype: integer overflow vulnerability in smooth/ftgrays.c
https://notcve.org/view.php?id=CVE-2010-2500
Integer overflow in the gray_render_span function in smooth/ftgrays.c in FreeType before 2.4.0 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file. Desbordamiento de entero en la función gray_render_span en smooth/ftgrays.c en FreeType anterior a v2.4.0 permite a atacantes remotos provocar una denegación de servicio (caída de aplicación) o posiblemente ejecutar código de su elección a través de un fichero fuente manipulado. • http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=6305b869d86ff415a33576df6d43729673c66eee http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html http://lists.nongnu.org/archive/html/freetype/2010-07/msg00001.html http://marc.info/?l=oss-security&m=127905701201340&w=2 http://marc.info/?l=oss-security&m=127909326909362&w=2 http://secunia.com/advisories/48951 http://securitytracker.com/id?1024266 http://support.apple.com/kb/HT4435 http://www.deb • CWE-190: Integer Overflow or Wraparound •
CVSS: 5.1EPSS: 0%CPEs: 8EXPL: 1CVE-2010-2520
https://notcve.org/view.php?id=CVE-2010-2520
Heap-based buffer overflow in the Ins_IUP function in truetype/ttinterp.c in FreeType before 2.4.0, when TrueType bytecode support is enabled, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file. Desbordamiento de búfer basado en la memoria dinámica en la función Ins_IUP en truetype/ttinterp.c en FreeType anterior a v2.4.0, cuando TrueType bytecode support está habilitado, permite a a atacantes remotos provocar una denegación de servicio (caída de aplicación) o posiblemente ejecutar código de su elección a través de ficheros fuente manipulados. • http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=888cd1843e935fe675cf2ac303116d4ed5b9d54b http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html http://lists.nongnu.org/archive/html/freetype/2010-07/msg00001.html http://marc.info/?l=oss-security&m=127905701201340&w=2 http://marc.info/?l=oss-security&m=127909326909362&w=2 http://secunia.com/advisories/48951 http://support.apple.com/kb/HT4435 http://www.debian.org/security/2010/dsa-2070 http:&# • CWE-787: Out-of-bounds Write •
CVSS: 6.8EPSS: 0%CPEs: 8EXPL: 1CVE-2010-2498 – freetype: invalid free vulnerability with possible heap corruption
https://notcve.org/view.php?id=CVE-2010-2498
The psh_glyph_find_strong_points function in pshinter/pshalgo.c in FreeType before 2.4.0 does not properly implement hinting masks, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) or possibly execute arbitrary code via a crafted font file that triggers an invalid free operation. La función psh_glyph_find_strong_points en pshinter/pshalgo.c de FreeType anterior a v2.4.0 no implementa adecuadamente mascaras sugeridas, lo cual permite a atacantes remotos causar una denegación de servicio (corrupción en la pila de memoria y fallo de la aplicación) o posiblemente ejecutar código a su elección a través de ficheros de fuentes manipulados que provocan una operación libre no válida. • http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=8d22746c9e5af80ff4304aef440986403a5072e2 http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html http://lists.nongnu.org/archive/html/freetype/2010-07/msg00001.html http://marc.info/?l=oss-security&m=127905701201340&w=2 http://marc.info/?l=oss-security&m=127909326909362&w=2 http://secunia.com/advisories/48951 http://securitytracker.com/id?1024266 http://support.apple.com/kb/HT4435 http://www.deb • CWE-787: Out-of-bounds Write •