NVD Vulnerability Detail

CVE-2010-0651

Summary	WebKit before r52784, as used in Google Chrome before 4.0.249.78 and Apple Safari before 4.0.5, permits cross-origin loading of CSS stylesheets even when the stylesheet download has an incorrect MIME type and the stylesheet document is malformed, which allows remote attackers to obtain sensitive information via a crafted document.
Publication Date	Feb. 19, 2010, 3 a.m.
Registration Date	Jan. 29, 2021, 10:57 a.m.
Last Update	Sept. 19, 2017, 10:30 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:apple:webkit::::::::			r53524

Configuration2		or higher	or less	more than	less than
cpe:2.3:a:google:chrome::::::::			4.0.249.78

Configuration3		or higher	or less	more than	less than
cpe:2.3:a:apple:safari::::::::			4.0.4

Related information, measures and tools

No	URL	refsource	タグ
1	http://code.google.com/p/chromium/issues/detail?id=9877	CONFIRM	Third Party Advisory
2	http://googlechromereleases.blogspot.com/2010/01/stable-channel-update_25.html	CONFIRM	Patch Third Party Advisory
3	http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html	SUSE	Third Party Advisory
4	http://scarybeastsecurity.blogspot.com/2009/12/generic-cross-browser-cross-domain.html	MISC	Third Party Advisory
5	http://secunia.com/advisories/41856	SECUNIA	Permissions Required
6	http://secunia.com/advisories/43068	SECUNIA	Permissions Required
7	http://securitytracker.com/id?1023506	SECTRACK	Third Party Advisory VDB Entry
8	http://sites.google.com/a/chromium.org/dev/Home/chromium-security/chromium-security-bugs	CONFIRM	Third Party Advisory
9	http://trac.webkit.org/changeset/52784	CONFIRM	Vendor Advisory
10	http://websec.sv.cmu.edu/css/css.pdf	MISC	Third Party Advisory
11	http://www.mandriva.com/security/advisories?name=MDVSA-2011:039	MANDRIVA	Third Party Advisory
12	http://www.ubuntu.com/usn/USN-1006-1	UBUNTU	Third Party Advisory
13	http://www.vupen.com/english/advisories/2010/2722	VUPEN	Third Party Advisory
14	http://www.vupen.com/english/advisories/2011/0212	VUPEN	Third Party Advisory
15	http://www.vupen.com/english/advisories/2011/0552	VUPEN	Third Party Advisory
16	https://bugs.webkit.org/show_bug.cgi?id=29820	CONFIRM	Vendor Advisory
17	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13653	OVAL

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-200	情報漏えい	https://cwe.mitre.org/data/definitions/200.html

JVN Vulnerability Information

Google Chrome および Apple Safari における重要な情報を取得される脆弱性

Title	Google Chrome および Apple Safari における重要な情報を取得される脆弱性
Summary	Google Chrome および Apple Safari で使用される WebKit は、スタイルシートダウンロードが誤った MIME タイプを保持し、スタイルシート文書が不正な形式の際、スタイルシートドキュメントがクロスオリジンの読み込みを許可するため、重要な情報を取得される脆弱性が存在します。
Possible impacts	第三者により、巧妙に細工されたドキュメントを介して、重要な情報を取得される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	April 8, 2009, midnight
Registration Date	June 26, 2012, 4:19 p.m.
Last Update	June 26, 2012, 4:19 p.m.

Affected System

アップル

Safari 4.0.5 未満

WebKit r52784

Google

Google Chrome 4.0.249.78 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2010-0651	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0651
National Vulnerability Database (NVD)
2	CVE-2010-0651	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-0651

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-200	https://jvndb.jvn.jp/ja/cwe/CWE-200.html

ベンダー情報

No	Name	URL
Apple
1	Top Page	http://www.apple.com/
Google
2	Issue 9877	http://code.google.com/p/chromium/issues/detail?id=9877

Change Log

No	Changed Details	Date of change
0	[2012年06月26日] 掲載	Feb. 17, 2018, 10:37 a.m.