NVD Vulnerability Detail

CVE-2010-0046

Summary	The Cascading Style Sheets (CSS) implementation in WebKit in Apple Safari before 4.0.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via crafted format arguments.
Summary	Per: http://lists.apple.com/archives/security-announce/2010/Mar/msg00000.html 'WebKit CVE-ID: CVE-2010-0046 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5.8, Mac OS X Server v10.5.8, Mac OS X v10.6.1 or later, Mac OS X Server v10.6.1 or later, Windows 7, Vista, XP Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution Description: A memory corruption issue exists in WebKit's handling of CSS format() arguments. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. This issue is addressed through improved handling of CSS format() arguments. Credit to Robert Swiecki of Google Inc. for reporting this issue.'
Summary	Per: http://lists.apple.com/archives/security-announce/2010/Mar/msg00000.html 'Safari 4.0.5 is available via the Apple Software Update application, or Apple's Safari download site at: http://www.apple.com/safari/download/'
Publication Date	March 15, 2010, 10:28 p.m.
Registration Date	Jan. 29, 2021, 10:55 a.m.
Last Update	Sept. 19, 2017, 10:30 a.m.

Affected software configurations

Related information, measures and tools

No	URL	refsource	タグ
1	http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html	APPLE
2	http://lists.apple.com/archives/security-announce/2010/Mar/msg00000.html	APPLE	Vendor Advisory
3	http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041383.html	FEDORA
4	http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041432.html	FEDORA
5	http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041436.html	FEDORA
6	http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html	SUSE
7	http://secunia.com/advisories/41856	SECUNIA
8	http://secunia.com/advisories/43068	SECUNIA
9	http://support.apple.com/kb/HT4070	CONFIRM	Vendor Advisory
10	http://support.apple.com/kb/HT4225	CONFIRM
11	http://www.mandriva.com/security/advisories?name=MDVSA-2011:039	MANDRIVA
12	http://www.securityfocus.com/bid/38671	BID	Patch
13	http://www.securitytracker.com/id?1023708	SECTRACK
14	http://www.ubuntu.com/usn/USN-1006-1	UBUNTU
15	http://www.vupen.com/english/advisories/2010/2722	VUPEN
16	http://www.vupen.com/english/advisories/2011/0212	VUPEN
17	http://www.vupen.com/english/advisories/2011/0552	VUPEN
18	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7053	OVAL

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-94	コード・インジェクション	https://cwe.mitre.org/data/definitions/94.html

JVN Vulnerability Information

Apple Safari の Cascading Style Sheet 実装における任意のコードを実行される脆弱性

Title	Apple Safari の Cascading Style Sheet 実装における任意のコードを実行される脆弱性
Summary	Apple Safari の WebKit の Cascading Style Sheet 実装には、サービス運用妨害 (DoS) 状態となる、または任意のコードを実行される脆弱性が存在します。
Possible impacts	巧妙に細工されたフォーマットの引数を介して、サービス運用妨害 (DoS) 状態にされる、または任意のコードを実行される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	March 15, 2010, midnight
Registration Date	March 25, 2010, 11:49 a.m.
Last Update	July 13, 2010, 4:30 p.m.

Affected System

アップル

Apple Mac OS X v10.4.11

Apple Mac OS X v10.5.8

Apple Mac OS X v10.6.1 以降

Apple Mac OS X Server v10.4.11

Apple Mac OS X Server v10.5.8

Apple Mac OS X Server v10.6.1 以降

iOS 2.0 から 3.1.3

iOS for iPod touch 2.1 から 3.1.3

iPhone

iPod touch

Safari 4.0.5 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2010-0046	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0046
National Vulnerability Database (NVD)
2	CVE-2010-0046	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-0046

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-94	https://jvndb.jvn.jp/ja/cwe/CWE-94.html

ベンダー情報

No	Name	URL
Apple Security Updates
1	HT4070	http://support.apple.com/kb/HT4070
2	HT4225	http://support.apple.com/kb/HT4225
Apple セキュリティアップデート
3	HT4070	http://support.apple.com/kb/HT4070?viewlocale=ja_JP
4	HT4225	http://support.apple.com/kb/HT4225?viewlocale=ja_JP

Change Log

No	Changed Details	Date of change
0	[2010年03月25日] 掲載 [2010年07月13日] 影響を受けるシステム：アップル (HT4225) の情報を追加ベンダ情報：アップル (HT4225) を追加	Feb. 17, 2018, 10:37 a.m.