NVD Vulnerability Detail

CVE-2010-1119

Summary	Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, Safari before 4.1 on Mac OS X 10.4, and Safari on Apple iPhone OS allows remote attackers to execute arbitrary code or cause a denial of service (application crash), or read the SMS database or other data, via vectors related to "attribute manipulation," as demonstrated by Vincenzo Iozzo and Ralf Philipp Weinmann during a Pwn2Own competition at CanSecWest 2010.
Publication Date	March 26, 2010, 6 a.m.
Registration Date	Jan. 29, 2021, 10:58 a.m.
Last Update	Sept. 19, 2017, 10:30 a.m.

CVSS2.0 : HIGH
Score	10.0
Vector	AV:N/AC:L/Au:N/C:C/I:C/A:C
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	低
攻撃前の認証要否(Au)	不要
機密性への影響(C)	高
完全性への影響(I)	高
可用性への影響(A)	高
Get all privileges.	いいえ
Get user privileges	いいえ
Get other privileges	いいえ
User operation required	いいえ

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:apple:safari:1.0:::::::*
cpe:2.3:a:apple:safari:1.0:beta::::::
cpe:2.3:a:apple:safari:1.0:beta2::::::
cpe:2.3:a:apple:safari:1.0.0:::::::*
cpe:2.3:a:apple:safari:1.0.0b1:::::::*
cpe:2.3:a:apple:safari:1.0.0b2:::::::*
cpe:2.3:a:apple:safari:1.0.1:::::::*
cpe:2.3:a:apple:safari:1.0.2:::::::*
cpe:2.3:a:apple:safari:1.0.3:::::::*
cpe:2.3:a:apple:safari:1.0.3:85.8::::::
cpe:2.3:a:apple:safari:1.0.3:85.8.1::::::
cpe:2.3:a:apple:safari:1.1:::::::*
cpe:2.3:a:apple:safari:1.1.0:::::::*
cpe:2.3:a:apple:safari:1.1.1:::::::*
cpe:2.3:a:apple:safari:1.2:::::::*
cpe:2.3:a:apple:safari:1.2.0:::::::*
cpe:2.3:a:apple:safari:1.2.1:::::::*
cpe:2.3:a:apple:safari:1.2.2:::::::*
cpe:2.3:a:apple:safari:1.2.3:::::::*
cpe:2.3:a:apple:safari:1.2.4:::::::*
cpe:2.3:a:apple:safari:1.2.5:::::::*
cpe:2.3:a:apple:safari:1.3:::::::*
cpe:2.3:a:apple:safari:1.3.0:::::::*
cpe:2.3:a:apple:safari:1.3.1:::::::*
cpe:2.3:a:apple:safari:1.3.2:::::::*
cpe:2.3:a:apple:safari:1.3.2:312.5::::::
cpe:2.3:a:apple:safari:1.3.2:312.6::::::
cpe:2.3:a:apple:safari:2:::::::*
cpe:2.3:a:apple:safari:2.0:::::::*
cpe:2.3:a:apple:safari:2.0.0:::::::*
cpe:2.3:a:apple:safari:2.0.1:::::::*
cpe:2.3:a:apple:safari:2.0.2:::::::*
cpe:2.3:a:apple:safari:2.0.3:::::::*
cpe:2.3:a:apple:safari:2.0.3:417.8::::::
cpe:2.3:a:apple:safari:2.0.3:417.9::::::
cpe:2.3:a:apple:safari:2.0.3:417.9.2::::::
cpe:2.3:a:apple:safari:2.0.3:417.9.3::::::
cpe:2.3:a:apple:safari:2.0.4:::::::*
cpe:2.3:a:apple:safari:3:::::::*
cpe:2.3:a:apple:safari:3.0:::::::*
cpe:2.3:a:apple:safari:3.0.0:::::::*
cpe:2.3:a:apple:safari:3.0.0b:::::::*
cpe:2.3:a:apple:safari:3.0.1:::::::*
cpe:2.3:a:apple:safari:3.0.1:beta::::::
cpe:2.3:a:apple:safari:3.0.1b:::::::*
cpe:2.3:a:apple:safari:3.0.2:::::::*
cpe:2.3:a:apple:safari:3.0.2b:::::::*
cpe:2.3:a:apple:safari:3.0.3:::::::*
cpe:2.3:a:apple:safari:3.0.3b:::::::*
cpe:2.3:a:apple:safari:3.0.4:::::::*
cpe:2.3:a:apple:safari:3.0.4b:::::::*
cpe:2.3:a:apple:safari:3.1:::::::*
cpe:2.3:a:apple:safari:3.1.0:::::::*
cpe:2.3:a:apple:safari:3.1.0b:::::::*
cpe:2.3:a:apple:safari:3.1.1:::::::*
cpe:2.3:a:apple:safari:3.1.2:::::::*
cpe:2.3:a:apple:safari:3.2.0:::::::*
cpe:2.3:a:apple:safari:3.2.1:::::::*
cpe:2.3:a:apple:safari:3.2.2:::::::*
cpe:2.3:a:apple:safari:3.2.3:::::::*
cpe:2.3:a:apple:safari:4.0:::::::*
cpe:2.3:a:apple:safari:4.0:beta::::::
cpe:2.3:a:apple:safari:4.0.0b:::::::*
cpe:2.3:a:apple:safari:4.0.1:::::::*
cpe:2.3:a:apple:safari:4.0.2:::::::*
cpe:2.3:a:apple:safari:4.0.3:::::::*
cpe:2.3:a:apple:safari:4.0.4:::::::*
cpe:2.3:a:apple:safari::::::::			4.0.5
cpe:2.3:a:apple:safari:4.1:::::::*
cpe:2.3:o:apple:mac_os_x:10.5:::::::*
cpe:2.3:o:apple:mac_os_x:10.5.0:::::::*
cpe:2.3:o:apple:mac_os_x:10.5.1:::::::*
cpe:2.3:o:apple:mac_os_x:10.5.2:::::::*
cpe:2.3:o:apple:mac_os_x:10.5.3:::::::*
cpe:2.3:o:apple:mac_os_x:10.5.4:::::::*
cpe:2.3:o:apple:mac_os_x:10.5.5:::::::*
cpe:2.3:o:apple:mac_os_x:10.5.6:::::::*
cpe:2.3:o:apple:mac_os_x:10.5.7:::::::*
cpe:2.3:o:apple:mac_os_x:10.5.8:::::::*
cpe:2.3:o:apple:mac_os_x:10.6.0:::::::*
cpe:2.3:o:apple:mac_os_x_server:10.5.0:::::::*
cpe:2.3:o:apple:mac_os_x_server:10.5.1:::::::*
cpe:2.3:o:apple:mac_os_x_server:10.5.2:::::::*
cpe:2.3:o:apple:mac_os_x_server:10.5.3:::::::*
cpe:2.3:o:apple:mac_os_x_server:10.5.4:::::::*
cpe:2.3:o:apple:mac_os_x_server:10.5.5:::::::*
cpe:2.3:o:apple:mac_os_x_server:10.5.6:::::::*
cpe:2.3:o:apple:mac_os_x_server:10.5.7:::::::*
cpe:2.3:o:apple:mac_os_x_server:10.5.8:::::::*
cpe:2.3:o:apple:mac_os_x_server:10.6.0:::::::*
cpe:2.3:o:apple:mac_os_x_server:10.6.1:::::::*
cpe:2.3:o:apple:mac_os_x_server:10.6.2:::::::*
cpe:2.3:o:apple:mac_os_x_server:10.6.3:::::::*
cpe:2.3:o:apple:mac_os_x_server:10.6.4:::::::*
execution environment
1	cpe:2.3:o:microsoft:windows::::::::

Configuration2	or higher	or less	more than	less than
cpe:2.3:o:apple:iphone_os:2.0:::::::*
cpe:2.3:o:apple:iphone_os:2.0.0:::::::*
cpe:2.3:o:apple:iphone_os:2.0.1:::::::*
cpe:2.3:o:apple:iphone_os:2.0.2:::::::*
cpe:2.3:o:apple:iphone_os:2.1:::::::*
cpe:2.3:o:apple:iphone_os:2.1.1:::::::*
cpe:2.3:o:apple:iphone_os:2.2:::::::*
cpe:2.3:o:apple:iphone_os:2.2.1:::::::*
cpe:2.3:o:apple:iphone_os:3.0:::::::*
cpe:2.3:o:apple:iphone_os:3.0.1:::::::*
cpe:2.3:o:apple:iphone_os:3.1:::::::*
cpe:2.3:o:apple:iphone_os:3.1.2:::::::*
cpe:2.3:o:apple:iphone_os:3.1.3:::::::*

Related information, measures and tools

No	URL	refsource	タグ
1	http://dvlabs.tippingpoint.com/blog/2010/02/15/pwn2own-2010	MISC
2	http://lists.apple.com/archives/security-announce/2010//Jun/msg00002.html	APPLE	Vendor Advisory
3	http://lists.apple.com/archives/security-announce/2010/Jun/msg00000.html	APPLE	Patch Vendor Advisory
4	http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html	APPLE	Vendor Advisory
5	http://news.cnet.com/8301-27080_3-20001126-245.html	MISC
6	http://secunia.com/advisories/40105	SECUNIA	Vendor Advisory
7	http://secunia.com/advisories/40196	SECUNIA	Vendor Advisory
8	http://securityreason.com/securityalert/8128	SREASON
9	http://securitytracker.com/id?1024067	SECTRACK
10	http://support.apple.com/kb/HT4196	CONFIRM	Vendor Advisory
11	http://support.apple.com/kb/HT4220	CONFIRM	Vendor Advisory
12	http://support.apple.com/kb/HT4225	CONFIRM	Vendor Advisory
13	http://twitter.com/thezdi/statuses/11001080021	MISC
14	http://www.securityfocus.com/bid/40620	BID
15	http://www.vupen.com/english/advisories/2010/1373	VUPEN	Vendor Advisory
16	http://www.vupen.com/english/advisories/2010/1512	VUPEN	Vendor Advisory
17	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7037	OVAL

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-399	リソース管理の問題	https://cwe.mitre.org/data/definitions/399.html

JVN Vulnerability Information

Apple Safari の WebKit における任意のコードを実行される脆弱性

Title	Apple Safari の WebKit における任意のコードを実行される脆弱性
Summary	Apple Safari の WebKit には、属性操作の処理に関する不備があるため、任意のコードを実行される、またはサービス運用妨害 (DoS) 状態となる、あるいは SMS のデータベースや、その他のデータを読まれる脆弱性が存在します。
Possible impacts	第三者により、任意のコードを実行される、またはサービス運用妨害 (DoS) 状態にされる、あるいは SMS のデータベースや、その他のデータを読まれる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	June 10, 2010, midnight
Registration Date	June 22, 2010, 5:31 p.m.
Last Update	July 13, 2010, 4:39 p.m.

Affected System

アップル

Apple Mac OS X v10.4.11

Apple Mac OS X v10.5.8

Apple Mac OS X v10.6.2 以降

Apple Mac OS X Server v10.4.11

Apple Mac OS X Server v10.5.8

Apple Mac OS X Server v10.6.2 以降

iOS 2.0 から 3.1.3

iOS for iPod touch 2.1 から 3.1.3

iPhone

iPod touch

iTunes 9

Safari 4

Safari 5

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2010-1119	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1119
National Vulnerability Database (NVD)
2	CVE-2010-1119	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-1119

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-noinfo	https://www.ipa.go.jp/security/vuln/CWE.html#CWEnoinfo

ベンダー情報

No	Name	URL
Apple Security Updates
1	HT4196	http://support.apple.com/kb/HT4196
2	HT4220	http://support.apple.com/kb/HT4220
3	HT4225	http://support.apple.com/kb/HT4225
Apple セキュリティアップデート
4	HT4196	http://support.apple.com/kb/HT4196?viewlocale=ja_JP
5	HT4220	http://support.apple.com/kb/HT4220?viewlocale=ja_JP
6	HT4225	http://support.apple.com/kb/HT4225?viewlocale=ja_JP

その他

No	Name	URL
Secunia Advisory
1	SA40105	http://secunia.com/advisories/40105
SecurityTracker
2	1024067	http://securitytracker.com/id?1024067
VUPEN Security
3	VUPEN/ADV-2010-1373	http://www.vupen.com/english/advisories/2010/1373
4	VUPEN/ADV-2010-1512	http://www.vupen.com/english/advisories/2010/1512

Change Log

No	Changed Details	Date of change
0	[2010年06月22日] 掲載 [2010年07月13日] 影響を受けるシステム：アップル (HT4225) の情報を追加ベンダ情報：アップル (HT4225) を追加	Feb. 17, 2018, 10:37 a.m.

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:apple:safari:1.0:::::::*
cpe:2.3:a:apple:safari:1.0:beta::::::
cpe:2.3:a:apple:safari:1.0:beta2::::::
cpe:2.3:a:apple:safari:1.0.0:::::::*
cpe:2.3:a:apple:safari:1.0.0b1:::::::*
cpe:2.3:a:apple:safari:1.0.0b2:::::::*
cpe:2.3:a:apple:safari:1.0.1:::::::*
cpe:2.3:a:apple:safari:1.0.2:::::::*
cpe:2.3:a:apple:safari:1.0.3:::::::*
cpe:2.3:a:apple:safari:1.0.3:85.8::::::
cpe:2.3:a:apple:safari:1.0.3:85.8.1::::::
cpe:2.3:a:apple:safari:1.1:::::::*
cpe:2.3:a:apple:safari:1.1.0:::::::*
cpe:2.3:a:apple:safari:1.1.1:::::::*
cpe:2.3:a:apple:safari:1.2:::::::*
cpe:2.3:a:apple:safari:1.2.0:::::::*
cpe:2.3:a:apple:safari:1.2.1:::::::*
cpe:2.3:a:apple:safari:1.2.2:::::::*
cpe:2.3:a:apple:safari:1.2.3:::::::*
cpe:2.3:a:apple:safari:1.2.4:::::::*
cpe:2.3:a:apple:safari:1.2.5:::::::*
cpe:2.3:a:apple:safari:1.3:::::::*
cpe:2.3:a:apple:safari:1.3.0:::::::*
cpe:2.3:a:apple:safari:1.3.1:::::::*
cpe:2.3:a:apple:safari:1.3.2:::::::*
cpe:2.3:a:apple:safari:1.3.2:312.5::::::
cpe:2.3:a:apple:safari:1.3.2:312.6::::::
cpe:2.3:a:apple:safari:2:::::::*
cpe:2.3:a:apple:safari:2.0:::::::*
cpe:2.3:a:apple:safari:2.0.0:::::::*
cpe:2.3:a:apple:safari:2.0.1:::::::*
cpe:2.3:a:apple:safari:2.0.2:::::::*
cpe:2.3:a:apple:safari:2.0.3:::::::*
cpe:2.3:a:apple:safari:2.0.3:417.8::::::
cpe:2.3:a:apple:safari:2.0.3:417.9::::::
cpe:2.3:a:apple:safari:2.0.3:417.9.2::::::
cpe:2.3:a:apple:safari:2.0.3:417.9.3::::::
cpe:2.3:a:apple:safari:2.0.4:::::::*
cpe:2.3:a:apple:safari:3:::::::*
cpe:2.3:a:apple:safari:3.0:::::::*
cpe:2.3:a:apple:safari:3.0.0:::::::*
cpe:2.3:a:apple:safari:3.0.0b:::::::*
cpe:2.3:a:apple:safari:3.0.1:::::::*
cpe:2.3:a:apple:safari:3.0.1:beta::::::
cpe:2.3:a:apple:safari:3.0.1b:::::::*
cpe:2.3:a:apple:safari:3.0.2:::::::*
cpe:2.3:a:apple:safari:3.0.2b:::::::*
cpe:2.3:a:apple:safari:3.0.3:::::::*
cpe:2.3:a:apple:safari:3.0.3b:::::::*
cpe:2.3:a:apple:safari:3.0.4:::::::*
cpe:2.3:a:apple:safari:3.0.4b:::::::*
cpe:2.3:a:apple:safari:3.1:::::::*
cpe:2.3:a:apple:safari:3.1.0:::::::*
cpe:2.3:a:apple:safari:3.1.0b:::::::*
cpe:2.3:a:apple:safari:3.1.1:::::::*
cpe:2.3:a:apple:safari:3.1.2:::::::*
cpe:2.3:a:apple:safari:3.2.0:::::::*
cpe:2.3:a:apple:safari:3.2.1:::::::*
cpe:2.3:a:apple:safari:3.2.2:::::::*
cpe:2.3:a:apple:safari:3.2.3:::::::*
cpe:2.3:a:apple:safari:4.0:::::::*
cpe:2.3:a:apple:safari:4.0:beta::::::
cpe:2.3:a:apple:safari:4.0.0b:::::::*
cpe:2.3:a:apple:safari:4.0.1:::::::*
cpe:2.3:a:apple:safari:4.0.2:::::::*
cpe:2.3:a:apple:safari:4.0.3:::::::*
cpe:2.3:a:apple:safari:4.0.4:::::::*
cpe:2.3:a:apple:safari::::::::			4.0.5
cpe:2.3:a:apple:safari:4.1:::::::*
cpe:2.3:o:apple:mac_os_x:10.5:::::::*
cpe:2.3:o:apple:mac_os_x:10.5.0:::::::*
cpe:2.3:o:apple:mac_os_x:10.5.1:::::::*
cpe:2.3:o:apple:mac_os_x:10.5.2:::::::*
cpe:2.3:o:apple:mac_os_x:10.5.3:::::::*
cpe:2.3:o:apple:mac_os_x:10.5.4:::::::*
cpe:2.3:o:apple:mac_os_x:10.5.5:::::::*
cpe:2.3:o:apple:mac_os_x:10.5.6:::::::*
cpe:2.3:o:apple:mac_os_x:10.5.7:::::::*
cpe:2.3:o:apple:mac_os_x:10.5.8:::::::*
cpe:2.3:o:apple:mac_os_x:10.6.0:::::::*
cpe:2.3:o:apple:mac_os_x_server:10.5.0:::::::*
cpe:2.3:o:apple:mac_os_x_server:10.5.1:::::::*
cpe:2.3:o:apple:mac_os_x_server:10.5.2:::::::*
cpe:2.3:o:apple:mac_os_x_server:10.5.3:::::::*
cpe:2.3:o:apple:mac_os_x_server:10.5.4:::::::*
cpe:2.3:o:apple:mac_os_x_server:10.5.5:::::::*
cpe:2.3:o:apple:mac_os_x_server:10.5.6:::::::*
cpe:2.3:o:apple:mac_os_x_server:10.5.7:::::::*
cpe:2.3:o:apple:mac_os_x_server:10.5.8:::::::*
cpe:2.3:o:apple:mac_os_x_server:10.6.0:::::::*
cpe:2.3:o:apple:mac_os_x_server:10.6.1:::::::*
cpe:2.3:o:apple:mac_os_x_server:10.6.2:::::::*
cpe:2.3:o:apple:mac_os_x_server:10.6.3:::::::*
cpe:2.3:o:apple:mac_os_x_server:10.6.4:::::::*
execution environment
1	cpe:2.3:o:microsoft:windows::::::::

Configuration2	or higher	or less	more than	less than
cpe:2.3:o:apple:iphone_os:2.0:::::::*
cpe:2.3:o:apple:iphone_os:2.0.0:::::::*
cpe:2.3:o:apple:iphone_os:2.0.1:::::::*
cpe:2.3:o:apple:iphone_os:2.0.2:::::::*
cpe:2.3:o:apple:iphone_os:2.1:::::::*
cpe:2.3:o:apple:iphone_os:2.1.1:::::::*
cpe:2.3:o:apple:iphone_os:2.2:::::::*
cpe:2.3:o:apple:iphone_os:2.2.1:::::::*
cpe:2.3:o:apple:iphone_os:3.0:::::::*
cpe:2.3:o:apple:iphone_os:3.0.1:::::::*
cpe:2.3:o:apple:iphone_os:3.1:::::::*
cpe:2.3:o:apple:iphone_os:3.1.2:::::::*
cpe:2.3:o:apple:iphone_os:3.1.3:::::::*