9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
10 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
0.922 High
EPSS
Percentile
98.7%
WebKitGTK+ is the port of the portable web rendering engine WebKit to the
GTK+ platform.
Multiple memory corruption flaws were found in WebKit. Malicious web
content could cause an application using WebKitGTK+ to crash or,
potentially, execute arbitrary code with the privileges of the user running
the application. (CVE-2010-1782, CVE-2010-1783, CVE-2010-1784,
CVE-2010-1785, CVE-2010-1787, CVE-2010-1788, CVE-2010-1790, CVE-2010-1792,
CVE-2010-1807, CVE-2010-1814, CVE-2010-3114, CVE-2010-3116, CVE-2010-3119,
CVE-2010-3255, CVE-2010-3812, CVE-2010-4198)
Multiple use-after-free flaws were found in WebKit. Malicious web content
could cause an application using WebKitGTK+ to crash or, potentially,
execute arbitrary code with the privileges of the user running the
application. (CVE-2010-1780, CVE-2010-1786, CVE-2010-1793, CVE-2010-1812,
CVE-2010-1815, CVE-2010-3113, CVE-2010-3257, CVE-2010-4197, CVE-2010-4204)
Two array index errors, leading to out-of-bounds memory reads, were found
in WebKit. Malicious web content could cause an application using
WebKitGTK+ to crash. (CVE-2010-4206, CVE-2010-4577)
A flaw in WebKit could allow malicious web content to trick a user into
thinking they are visiting the site reported by the location bar, when the
page is actually content controlled by an attacker. (CVE-2010-3115)
It was found that WebKit did not correctly restrict read access to images
created from the โcanvasโ element. Malicious web content could allow a
remote attacker to bypass the same-origin policy and potentially access
sensitive image data. (CVE-2010-3259)
A flaw was found in the way WebKit handled DNS prefetching. Even when it
was disabled, web content containing certain โlinkโ elements could cause
WebKitGTK+ to perform DNS prefetching. (CVE-2010-3813)
Users of WebKitGTK+ should upgrade to these updated packages, which contain
WebKitGTK+ version 1.2.6, and resolve these issues. All running
applications that use WebKitGTK+ must be restarted for this update to take
effect.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
RedHat | 6 | i686 | webkitgtk | <ย 1.2.6-2.el6_0 | webkitgtk-1.2.6-2.el6_0.i686.rpm |
RedHat | 6 | ppc64 | webkitgtk-debuginfo | <ย 1.2.6-2.el6_0 | webkitgtk-debuginfo-1.2.6-2.el6_0.ppc64.rpm |
RedHat | 6 | x86_64 | webkitgtk-devel | <ย 1.2.6-2.el6_0 | webkitgtk-devel-1.2.6-2.el6_0.x86_64.rpm |
RedHat | 6 | x86_64 | webkitgtk | <ย 1.2.6-2.el6_0 | webkitgtk-1.2.6-2.el6_0.x86_64.rpm |
RedHat | 6 | s390 | webkitgtk | <ย 1.2.6-2.el6_0 | webkitgtk-1.2.6-2.el6_0.s390.rpm |
RedHat | 6 | x86_64 | webkitgtk-doc | <ย 1.2.6-2.el6_0 | webkitgtk-doc-1.2.6-2.el6_0.x86_64.rpm |
RedHat | 6 | i686 | webkitgtk-devel | <ย 1.2.6-2.el6_0 | webkitgtk-devel-1.2.6-2.el6_0.i686.rpm |
RedHat | 6 | s390 | webkitgtk-devel | <ย 1.2.6-2.el6_0 | webkitgtk-devel-1.2.6-2.el6_0.s390.rpm |
RedHat | 6 | s390 | webkitgtk-debuginfo | <ย 1.2.6-2.el6_0 | webkitgtk-debuginfo-1.2.6-2.el6_0.s390.rpm |
RedHat | 6 | i686 | webkitgtk-doc | <ย 1.2.6-2.el6_0 | webkitgtk-doc-1.2.6-2.el6_0.i686.rpm |
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
10 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
0.922 High
EPSS
Percentile
98.7%