CVE-2010-0047
Apple WebKit innerHTML element Substitution Remote Code Execution Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Use-after-free vulnerability in WebKit in Apple Safari before 4.0.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to "HTML object element fallback content."
Vulnerabilidad uso después de la liberación (use-after-free) en el WebKit en Apple Safari anterior v4.0.5 permite a atacantes remotos ejecutar código de su elección o causar una denegación de servicio (caída de aplicación) a través de vectores relacionados con "HTML object element fallback content."
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple WebKit. User interaction is required to exploit this vulnerability in that the target must visit a malicious page.
The specific flaw exists in the WebCore's HTMLObjectElement::renderFallBackContent() method. By rewriting an HTML element via the document's innerHTML() method a memory corruption occurs resulting from a call-after-free. This can be leveraged to execute arbitrary code under the context of the current user.
CVSS Scores
SSVC
- Decision:Track*
Timeline
- 2009-12-15 CVE Reserved
- 2010-03-12 CVE Published
- 2024-10-15 CVE Updated
- 2025-01-09 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-399: Resource Management Errors
CAPEC
References (18)
| URL | Tag | Source |
|---|---|---|
| http://secunia.com/advisories/41856 | Third Party Advisory | |
| http://secunia.com/advisories/43068 | Third Party Advisory | |
| http://support.apple.com/kb/HT4225 | X_refsource_confirm |
|
| http://www.securitytracker.com/id?1023708 | Vdb Entry | |
| http://www.vupen.com/english/advisories/2010/2722 | Vdb Entry | |
| http://www.vupen.com/english/advisories/2011/0212 | Vdb Entry | |
| http://www.vupen.com/english/advisories/2011/0552 | Vdb Entry | |
| https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6882 | Signature |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://www.securityfocus.com/bid/38671 | 2017-09-19 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Apple Search vendor "Apple" | Safari Search vendor "Apple" for product "Safari" | <= 4.0.4 Search vendor "Apple" for product "Safari" and version " <= 4.0.4" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Safari Search vendor "Apple" for product "Safari" | 4.0 Search vendor "Apple" for product "Safari" and version "4.0" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Safari Search vendor "Apple" for product "Safari" | 4.0.0b Search vendor "Apple" for product "Safari" and version "4.0.0b" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Safari Search vendor "Apple" for product "Safari" | 4.0.1 Search vendor "Apple" for product "Safari" and version "4.0.1" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Safari Search vendor "Apple" for product "Safari" | 4.0.2 Search vendor "Apple" for product "Safari" and version "4.0.2" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Safari Search vendor "Apple" for product "Safari" | 4.0.3 Search vendor "Apple" for product "Safari" and version "4.0.3" | - |
Affected
| ||||||