WebKit Element Focus Use-After-Free Remote Code Execution Vulnerability
BID:42044
Info
WebKit Element Focus Use-After-Free Remote Code Execution Vulnerability
| Bugtraq ID: | 42044 |
| Class: | Unknown |
| CVE: |
CVE-2010-1780 |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 28 2010 12:00AM |
| Updated: | Apr 13 2015 09:21PM |
| Credit: | Tony Chang of Google, Inc. |
| Vulnerable: |
WebKit Open Source Project WebKit 1.2.3 WebKit Open Source Project WebKit 1.2.2 WebKit Open Source Project WebKit r52833 WebKit Open Source Project WebKit r52401 WebKit Open Source Project WebKit r51295 WebKit Open Source Project WebKit r38566 WebKit Open Source Project WebKit 1.2.2-1 WebKit Open Source Project WebKit 0 Ubuntu Ubuntu Linux 9.10 sparc Ubuntu Ubuntu Linux 9.10 powerpc Ubuntu Ubuntu Linux 9.10 lpia Ubuntu Ubuntu Linux 9.10 i386 Ubuntu Ubuntu Linux 9.10 amd64 Ubuntu Ubuntu Linux 10.10 powerpc Ubuntu Ubuntu Linux 10.10 i386 Ubuntu Ubuntu Linux 10.10 amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 amd64 S.u.S.E. openSUSE 11.3 S.u.S.E. openSUSE 11.2 Redhat Enterprise Linux Workstation Optional 6 Redhat Enterprise Linux Workstation 6 Redhat Enterprise Linux Server Optional 6 Redhat Enterprise Linux Server 6 Redhat Enterprise Linux HPC Node Optional 6 Redhat Enterprise Linux Desktop Optional 6 Redhat Enterprise Linux Desktop 6 Mandriva Linux Mandrake 2010.1 x86_64 Mandriva Linux Mandrake 2010.1 Google Chrome 5.0.375 .70 Google Chrome 5.0.375 .55 Google Chrome 5.0.375.85 Google Chrome 5.0.375.84 Google Chrome 5.0.375.83 Google Chrome 5.0.375.82 Google Chrome 5.0.375.81 Google Chrome 5.0.375.80 Google Chrome 5.0.375.8 Google Chrome 5.0.375.79 Google Chrome 5.0.375.78 Google Chrome 5.0.375.77 Google Chrome 5.0.375.76 Google Chrome 5.0.375.75 Google Chrome 5.0.375.74 Google Chrome 5.0.375.73 Google Chrome 5.0.375.72 Google Chrome 5.0.375.71 Google Chrome 5.0.375.7 Google Chrome 5.0.375.69 Google Chrome 5.0.375.68 Google Chrome 5.0.375.67 Google Chrome 5.0.375.66 Google Chrome 5.0.375.65 Google Chrome 5.0.375.64 Google Chrome 5.0.375.63 Google Chrome 5.0.375.62 Google Chrome 5.0.375.61 Google Chrome 5.0.375.60 Google Chrome 5.0.375.6 Google Chrome 5.0.375.59 Google Chrome 5.0.375.58 Google Chrome 5.0.375.57 Google Chrome 5.0.375.56 Google Chrome 5.0.375.54 Google Chrome 5.0.375.53 Google Chrome 5.0.375.52 Google Chrome 5.0.375.51 Google Chrome 5.0.375.50 Google Chrome 5.0.375.5 Google Chrome 5.0.375.49 Google Chrome 5.0.375.48 Google Chrome 5.0.375.47 Google Chrome 5.0.375.46 Google Chrome 5.0.375.45 Google Chrome 5.0.375.44 Google Chrome 5.0.375.43 Google Chrome 5.0.375.42 Google Chrome 5.0.375.41 Google Chrome 5.0.375.40 Google Chrome 5.0.375.4 Google Chrome 5.0.375.39 Google Chrome 5.0.375.38 Google Chrome 5.0.375.37 Google Chrome 5.0.375.36 Google Chrome 5.0.375.35 Google Chrome 5.0.375.34 Google Chrome 5.0.375.33 Google Chrome 5.0.375.32 Google Chrome 5.0.375.31 Google Chrome 5.0.375.30 Google Chrome 5.0.375.3 Google Chrome 5.0.375.29 Google Chrome 5.0.375.28 Google Chrome 5.0.375.27 Google Chrome 5.0.375.26 Google Chrome 5.0.375.25 Google Chrome 5.0.375.23 Google Chrome 5.0.375.22 Google Chrome 5.0.375.21 Google Chrome 5.0.375.20 Google Chrome 5.0.375.2 Google Chrome 5.0.375.19 Google Chrome 5.0.375.18 Google Chrome 5.0.375.17 Google Chrome 5.0.375.16 Google Chrome 5.0.375.15 Google Chrome 5.0.375.14 Google Chrome 5.0.375.13 Google Chrome 5.0.375.12 Google Chrome 5.0.375.11 Google Chrome 5.0.375.10 Google Chrome 5.0.375.1 Google Chrome 5.0.375.0 Gentoo Linux Apple Safari 4.0.5 for Windows Apple Safari 4.0.5 Apple Safari 4.0.4 for Windows Apple Safari 4.0.4 Apple Safari 4.0.3 for Windows Apple Safari 4.0.3 Apple Safari 4.0.2 for Windows Apple Safari 4.0.2 Apple Safari 4.0.1 Apple Safari 5.0 for Windows Apple Safari 5.0 Apple Safari 4.1 Apple Safari 4 for Windows Apple Safari 4 Beta Apple Safari 4 Apple iTunes 9.0.2 Apple iTunes 9.0.1 .8 Apple iTunes 9.0.1 Apple iTunes 9.0 Apple iTunes 9.2 Apple iTunes 9.1 Apple iPod Touch 3.1.3 Apple iPod Touch 3.1.2 Apple iPod Touch 3.1.1 Apple iPod Touch 2.2.1 Apple iPod Touch 2.0.2 Apple iPod Touch 2.0.1 Apple iPod Touch 3.0 Apple iPod Touch 2.2 Apple iPod Touch 2.1 Apple iPod Touch 2.0 Apple iPhone 4.0.1 Apple iPhone 3.2.1 Apple iPhone 3.1.3 Apple iPhone 3.1.2 Apple iPhone 3.0.1 Apple iPhone 2.2.1 Apple iPhone 2.0.2 Apple iPhone 2.0.1 Apple iPhone 4.0 Apple iPhone 3.2 Apple iPhone 3.1 Apple iPhone 3.0 Apple iPhone 2.2 Apple iPhone 2.1 Apple iPhone 2.0 Apple iPad 3.2.1 Apple iPad 3.2.2 Apple iPad 3.2 Apple iPad 0 Apple iOS 4.0.2 Apple iOS 4.0.1 Apple iOS 3.2.2 Apple iOS 3.2.1 Apple iOS 4.2 beta Apple iOS 4.1 Apple iOS 4 Apple iOS 3.2 Apple iOS 2.0 |
| Not Vulnerable: |
WebKit Open Source Project WebKit 1.2.5 Apple Safari 5.0.1 Apple Safari 4.1.1 Apple iTunes 10 Apple iOS 4.2 Apple iOS 4.1 |
Discussion
WebKit Element Focus Use-After-Free Remote Code Execution Vulnerability
WebKit is prone to a remote code-execution vulnerability.
An attacker can exploit this issue by tricking an unsuspecting victim into viewing a web page containing malicious content. A successful exploit will result in the execution of arbitrary attacker-supplied code in the context of the user running the affected application.
This issue has been addressed in Apple Safari 5.0.1 and 4.1.1.
NOTE: This issue was previously covered in BID 42020 (Apple Safari Prior to 5.0.1 and 4.1.1 Multiple Security Vulnerabilities) but has been given its own record to better document it.
WebKit is prone to a remote code-execution vulnerability.
An attacker can exploit this issue by tricking an unsuspecting victim into viewing a web page containing malicious content. A successful exploit will result in the execution of arbitrary attacker-supplied code in the context of the user running the affected application.
This issue has been addressed in Apple Safari 5.0.1 and 4.1.1.
NOTE: This issue was previously covered in BID 42020 (Apple Safari Prior to 5.0.1 and 4.1.1 Multiple Security Vulnerabilities) but has been given its own record to better document it.
Exploit / POC
WebKit Element Focus Use-After-Free Remote Code Execution Vulnerability
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
WebKit Element Focus Use-After-Free Remote Code Execution Vulnerability
Solution:
Updates are available. Please see the references for more information.
Ubuntu Ubuntu Linux 9.10 powerpc
Ubuntu Ubuntu Linux 9.10 lpia
Ubuntu Ubuntu Linux 10.04 powerpc
Apple Safari 5.0 for Windows
Ubuntu Ubuntu Linux 9.10 amd64
Ubuntu Ubuntu Linux 10.10 powerpc
Apple iTunes 9.0
Apple iTunes 9.0.1 .8
Solution:
Updates are available. Please see the references for more information.
Ubuntu Ubuntu Linux 9.10 powerpc
-
Ubuntu libwebkit-1.0-2-dbg_1.2.5-0ubuntu0.9.10.1_powerpc.deb
http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-1.0-2-dbg_1.2.5-0 ubuntu0.9.10.1_powerpc.deb -
Ubuntu libwebkit-1.0-2_1.2.5-0ubuntu0.9.10.1_powerpc.deb
http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-1.0-2_1.2.5-0ubun tu0.9.10.1_powerpc.deb -
Ubuntu libwebkit-1.0-common_1.2.5-0ubuntu0.9.10.1_all.deb
http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-com mon_1.2.5-0ubuntu0.9.10.1_all.deb -
Ubuntu libwebkit-dev_1.2.5-0ubuntu0.9.10.1_powerpc.deb
http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-dev_1.2.5-0ubuntu 0.9.10.1_powerpc.deb
Ubuntu Ubuntu Linux 9.10 lpia
-
Ubuntu libwebkit-1.0-2-dbg_1.2.5-0ubuntu0.9.10.1_lpia.deb
http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-1.0-2-dbg_1.2.5-0 ubuntu0.9.10.1_lpia.deb -
Ubuntu libwebkit-1.0-2_1.2.5-0ubuntu0.9.10.1_lpia.deb
http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-1.0-2_1.2.5-0ubun tu0.9.10.1_lpia.deb -
Ubuntu libwebkit-1.0-common_1.2.5-0ubuntu0.9.10.1_all.deb
http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-com mon_1.2.5-0ubuntu0.9.10.1_all.deb -
Ubuntu libwebkit-dev_1.2.5-0ubuntu0.9.10.1_lpia.deb
http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-dev_1.2.5-0ubuntu 0.9.10.1_lpia.deb
Ubuntu Ubuntu Linux 10.04 powerpc
-
Ubuntu gir1.0-webkit-1.0_1.2.5-0ubuntu0.10.04.1_powerpc.deb
http://ports.ubuntu.com/pool/universe/w/webkit/gir1.0-webkit-1.0_1.2.5 -0ubuntu0.10.04.1_powerpc.deb -
Ubuntu libwebkit-1.0-2-dbg_1.2.5-0ubuntu0.10.04.1_powerpc.deb
http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-1.0-2-dbg_1.2.5-0 ubuntu0.10.04.1_powerpc.deb -
Ubuntu libwebkit-1.0-2_1.2.5-0ubuntu0.10.04.1_powerpc.deb
http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-1.0-2_1.2.5-0ubun tu0.10.04.1_powerpc.deb -
Ubuntu libwebkit-1.0-common_1.2.5-0ubuntu0.10.04.1_all.deb
http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-com mon_1.2.5-0ubuntu0.10.04.1_all.deb -
Ubuntu libwebkit-dev_1.2.5-0ubuntu0.10.04.1_powerpc.deb
http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-dev_1.2.5-0ubuntu 0.10.04.1_powerpc.deb
Apple Safari 5.0 for Windows
-
Apple APPLE-SA-2010-07-28-1
Safari for Windows 7, Vista or XP
http://www.apple.com/safari/download/ -
Apple APPLE-SA-2010-07-28-1 Safari_Setup.exe
Safari for Windows 7, Vista or XP from the Microsoft Choice Screen
http://www.apple.com/safari/download/ -
Apple APPLE-SA-2010-07-28-1 SafariQuickTimeSetup.exe
Safari+QuickTime for Windows 7, Vista or XP
http://www.apple.com/safari/download/
Ubuntu Ubuntu Linux 9.10 amd64
-
Ubuntu libwebkit-1.0-2-dbg_1.2.5-0ubuntu0.9.10.1_amd64.deb
http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-2-d bg_1.2.5-0ubuntu0.9.10.1_amd64.deb -
Ubuntu libwebkit-1.0-2_1.2.5-0ubuntu0.9.10.1_amd64.deb
http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-2_1 .2.5-0ubuntu0.9.10.1_amd64.deb -
Ubuntu libwebkit-1.0-common_1.2.5-0ubuntu0.9.10.1_all.deb
http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-com mon_1.2.5-0ubuntu0.9.10.1_all.deb -
Ubuntu libwebkit-dev_1.2.5-0ubuntu0.9.10.1_amd64.deb
http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-dev_1.2 .5-0ubuntu0.9.10.1_amd64.deb
Ubuntu Ubuntu Linux 10.10 powerpc
-
Ubuntu gir1.0-webkit-1.0_1.2.5-0ubuntu0.10.10.1_powerpc.deb
http://ports.ubuntu.com/pool/universe/w/webkit/gir1.0-webkit-1.0_1.2.5 -0ubuntu0.10.10.1_powerpc.deb -
Ubuntu libwebkit-1.0-2-dbg_1.2.5-0ubuntu0.10.10.1_powerpc.deb
http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-1.0-2-dbg_1.2.5-0 ubuntu0.10.10.1_powerpc.deb -
Ubuntu libwebkit-1.0-2_1.2.5-0ubuntu0.10.10.1_powerpc.deb
http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-1.0-2_1.2.5-0ubun tu0.10.10.1_powerpc.deb -
Ubuntu libwebkit-1.0-common_1.2.5-0ubuntu0.10.10.1_all.deb
http://security.ubuntu.com/ubuntu/pool/main/w/webkit/libwebkit-1.0-com mon_1.2.5-0ubuntu0.10.10.1_all.deb -
Ubuntu libwebkit-dev_1.2.5-0ubuntu0.10.10.1_powerpc.deb
http://ports.ubuntu.com/pool/main/w/webkit/libwebkit-dev_1.2.5-0ubuntu 0.10.10.1_powerpc.deb
Apple iTunes 9.0
-
Apple iTunes10-iTunes64Setup.exe
http://www.apple.com/itunes/download/ -
Apple iTunes10-iTunesSetup.exe
http://www.apple.com/itunes/download/ -
Apple iTunes10.dmg
os x
http://www.apple.com/itunes/download/
Apple iTunes 9.0.1 .8
-
Apple iTunes10-iTunes64Setup.exe
http://www.apple.com/itunes/download/ -
Apple iTunes10-iTunesSetup.exe
http://www.apple.com/itunes/download/ -
Apple iTunes10.dmg
os x
http://www.apple.com/itunes/download/
References
WebKit Element Focus Use-After-Free Remote Code Execution Vulnerability
References:
References:
- Apple Safari Homepage (Apple)
- Merge webkit bug https://bugs.webkit.org/show_bug.cgi?id=40407 (Google)
- webkit 1.2.5 security update tracking bug (Ubuntu)
- Webkit Homepage (WebKit)