WebKit Image Decoder Memory Allocation Remote Code Execution Vulnerability
BID:38374
Info
WebKit Image Decoder Memory Allocation Remote Code Execution Vulnerability
| Bugtraq ID: | 38374 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2010-0659 |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 25 2010 12:00AM |
| Updated: | Mar 19 2015 09:32AM |
| Credit: | Robert Swiecki |
| Vulnerable: |
WebKit Open Source Project WebKit r52401 WebKit Open Source Project WebKit r51295 WebKit Open Source Project WebKit r38566 WebKit Open Source Project WebKit 0 Google Chrome 3.0.195 .33 Google Chrome 3.0.195 .32 Google Chrome 3.0.195 .24 Google Chrome 3.0.195 .21 Google Chrome 2.0.172 .43 Google Chrome 2.0.172 .37 Google Chrome 2.0.172 .33 Google Chrome 2.0.172 .31 Google Chrome 2.0.172 .30 Google Chrome 1.0.154 .61 Google Chrome 0.3.154 9 Google Chrome 0.2.149 .30 Google Chrome 0.2.149 .29 Google Chrome 0.2.149 .27 Google Chrome 3.0 Beta Google Chrome 1.0.154.65 Google Chrome 1.0.154.64 Google Chrome 1.0.154.59 Google Chrome 1.0.154.55 Google Chrome 1.0.154.53 Google Chrome 1.0.154.48 Google Chrome 1.0.154.46 Google Chrome 1.0.154.36 |
| Not Vulnerable: |
WebKit Open Source Project WebKit r52833 Google Chrome 4.0.249 .78 |
Discussion
WebKit Image Decoder Memory Allocation Remote Code Execution Vulnerability
WebKit is prone to a remote code-execution vulnerability because it fails to properly handle a failure of memory allocation when decoding images.
Attackers may be able to leverage this issue to run arbitrary code or to crash the browser. Failed exploit attempts will likely result in denial-of-service conditions.
NOTE: This BID was previously documented in BID 37948 (Google Chrome prior to 4.0.249.78 Multiple Security Vulnerabilities) but has been given its own record to better document it.
WebKit is prone to a remote code-execution vulnerability because it fails to properly handle a failure of memory allocation when decoding images.
Attackers may be able to leverage this issue to run arbitrary code or to crash the browser. Failed exploit attempts will likely result in denial-of-service conditions.
NOTE: This BID was previously documented in BID 37948 (Google Chrome prior to 4.0.249.78 Multiple Security Vulnerabilities) but has been given its own record to better document it.
Exploit / POC
WebKit Image Decoder Memory Allocation Remote Code Execution Vulnerability
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
WebKit Image Decoder Memory Allocation Remote Code Execution Vulnerability
Solution:
The vendor has released an advisory and updates. Please see the references for details.
Solution:
The vendor has released an advisory and updates. Please see the references for details.
References
WebKit Image Decoder Memory Allocation Remote Code Execution Vulnerability
References:
References:
- Google Chrome Homepage (Google)
- WebKit Changeset 52833 (WebKit)
- Stable Channel Update 4.0.249.78 (Google)