NVD Vulnerability Detail

CVE-2010-0042

Summary	ImageIO in Apple Safari before 4.0.5 and iTunes before 9.1 on Windows does not ensure that memory access is associated with initialized memory, which allows remote attackers to obtain potentially sensitive information from process memory via a crafted TIFF image.
Summary	Per: http://lists.apple.com/archives/security-announce/2010/Mar/msg00000.html 'ImageIO CVE-ID: CVE-2010-0042 Available for: Windows 7, Vista, XP Impact: Visiting a maliciously crafted website may result in sending data from Safari's memory to the website Description: An uninitialized memory access issue exists in ImageIO's handling of TIFF images. Visiting a maliciously crafted website may result in sending data from Safari's memory to the website. This issue is addressed through improved memory handling and additional validation of TIFF images. Credit to Matthew 'j00ru' Jurczyk of Hispasec for reporting this issue.'
Summary	Per: http://lists.apple.com/archives/security-announce/2010/Mar/msg00000.html 'Safari 4.0.5 is available via the Apple Software Update application, or Apple's Safari download site at: http://www.apple.com/safari/download/'
Publication Date	March 15, 2010, 10:28 p.m.
Registration Date	Jan. 29, 2021, 10:55 a.m.
Last Update	Sept. 19, 2017, 10:30 a.m.

Affected software configurations

Related information, measures and tools

No	URL	refsource	タグ
1	http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html	APPLE
2	http://lists.apple.com/archives/security-announce/2010//Mar/msg00003.html	APPLE
3	http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html	APPLE
4	http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html	APPLE
5	http://lists.apple.com/archives/security-announce/2010/Mar/msg00000.html	APPLE	Vendor Advisory
6	http://secunia.com/advisories/39135	SECUNIA
7	http://secunia.com/advisories/42314	SECUNIA
8	http://support.apple.com/kb/HT4070	CONFIRM	Vendor Advisory
9	http://support.apple.com/kb/HT4077	CONFIRM
10	http://support.apple.com/kb/HT4105	CONFIRM
11	http://support.apple.com/kb/HT4225	CONFIRM
12	http://support.apple.com/kb/HT4456	CONFIRM
13	http://www.securityfocus.com/bid/38671	BID	Patch
14	http://www.securityfocus.com/bid/38677	BID	Patch
15	http://www.securitytracker.com/id?1023706	SECTRACK
16	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7561	OVAL

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-200	情報漏えい	https://cwe.mitre.org/data/definitions/200.html

JVN Vulnerability Information

Apple Safari の ImageIO における重要な情報を取得される脆弱性

Title	Apple Safari の ImageIO における重要な情報を取得される脆弱性
Summary	Windows 上の Apple Safari の ImageIO には、初期化メモリに関連する処理に不備があるため、プロセスメモリから重要な情報を取得される脆弱性が存在します。
Possible impacts	巧妙に細工された TIFF 画像を介して、プロセスメモリから重要な情報を取得される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	March 15, 2010, midnight
Registration Date	March 25, 2010, 11:48 a.m.
Last Update	Dec. 10, 2010, 2:26 p.m.

Affected System

アップル

Apple Mac OS X v10.5.8

Apple Mac OS X v10.6 から v10.6.2

Apple Mac OS X Server v10.5.8

Apple Mac OS X Server v10.6 から v10.6.2

iOS 2.0 から 3.1.3

iOS 3.2 から 3.2.2 (iPad 用)

iOS for iPod touch 2.1 から 3.1.3

iPad

iPhone

iPod touch

iTunes 9.1 未満

Safari 4.0.5 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2010-0042	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0042
National Vulnerability Database (NVD)
2	CVE-2010-0042	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-0042

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-200	https://jvndb.jvn.jp/ja/cwe/CWE-200.html

ベンダー情報

No	Name	URL
Apple Security Updates
1	HT4070	http://support.apple.com/kb/HT4070
2	HT4077	http://support.apple.com/kb/HT4077
3	HT4105	http://support.apple.com/kb/HT4105
4	HT4225	http://support.apple.com/kb/HT4225
5	HT4456	http://support.apple.com/kb/HT4456
Apple セキュリティアップデート
6	HT4070	http://support.apple.com/kb/HT4070?viewlocale=ja_JP
7	HT4077	http://support.apple.com/kb/HT4077?viewlocale=ja_JP
8	HT4105	http://support.apple.com/kb/HT4105?viewlocale=ja_JP
9	HT4225	http://support.apple.com/kb/HT4225?viewlocale=ja_JP

その他

No	Name	URL
SecurityFocus
1	38677	http://www.securityfocus.com/bid/38677

Change Log

No	Changed Details	Date of change
0	[2010年03月25日] 掲載 [2010年04月13日] 影響を受けるシステム：アップル (HT4077) の情報を追加影響を受けるシステム：アップル (HT4105) の情報を追加ベンダ情報：アップル (HT4077) を追加ベンダ情報：アップル (HT4105) を追加 [2010年07月13日] 影響を受けるシステム：アップル (HT4225) の情報を追加ベンダ情報：アップル (HT4225) を追加 [2010年12月10日] 影響を受けるシステム：アップル (HT4456) の情報を追加ベンダ情報：アップル (HT4456) を追加	Feb. 17, 2018, 10:37 a.m.