WebKit SVG styles Use-after-free Memory Corruption Vulnerability

Bugtraq ID:	46677
Class:	Design Error
CVE:	CVE-2010-1824
Remote:	Yes
Local:	No
Published:	Sep 14 2010 12:00AM
Updated:	Mar 19 2015 09:40AM
Credit:	wushi of team509
Vulnerable:	WebKit Open Source Project WebKit 1.2.5 WebKit Open Source Project WebKit 1.2.3 WebKit Open Source Project WebKit 1.2.2 WebKit Open Source Project WebKit r77705 WebKit Open Source Project WebKit r52833 WebKit Open Source Project WebKit r52401 WebKit Open Source Project WebKit r51295 WebKit Open Source Project WebKit r38566 WebKit Open Source Project WebKit 1.2.X WebKit Open Source Project WebKit 1.2.2-1 WebKit Open Source Project WebKit 0 Ubuntu Ubuntu Linux 10.10 powerpc Ubuntu Ubuntu Linux 10.10 i386 Ubuntu Ubuntu Linux 10.10 ARM Ubuntu Ubuntu Linux 10.10 amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 ARM Ubuntu Ubuntu Linux 10.04 amd64 Google Chrome 6.0.472 55 Google Chrome 5.0.375 .55 Google Chrome 4.1.249 1064 Google Chrome 4.1.249 1059 Google Chrome 4.1.249 1036 Google Chrome 4.1.249 .1045 Google Chrome 4.1.249 .1042 Google Chrome 4.0.249 .89 Google Chrome 4.0.249 .78 Google Chrome 6.0.472.53 Google Chrome 4.1.249.1044 Apple Safari 4.1.2 for Windows Apple Safari 4.0.5 for Windows Apple Safari 4.0.5 Apple Safari 4.0.4 for Windows Apple Safari 4.0.4 Apple Safari 4.0.3 for Windows Apple Safari 4.0.3 Apple Safari 4.0.2 for Windows Apple Safari 4.0.2 Apple Safari 4.0.1 Apple Safari 5.0.3 for Windows Apple Safari 5.0.3 Apple Safari 5.0.2 for Windows Apple Safari 5.0.2 Apple Safari 5.0.1 for Windows Apple Safari 5.0.1 Apple Safari 5.0 for Windows Apple Safari 5.0 Apple Safari 4.1.3 for Windows Apple Safari 4.1.3 Apple Safari 4.1.2 Apple Safari 4.1.1 Apple Safari 4.1 Apple Safari 4.0 Beta Apple Safari 4.0 Apple Safari 4 for Windows Apple Safari 4 Beta Apple Safari 4 Apple Mobile Safari 0 + Apple Mac OS X 10.4.2 + Apple Mac OS X 10.4.2 + Apple Mac OS X 10.4.1 + Apple Mac OS X 10.4.1 + Apple Mac OS X 10.4 + Apple Mac OS X 10.4 + Apple Mac OS X Server 10.4.2 + Apple Mac OS X Server 10.4.1 + Apple Mac OS X Server 10.4.1 + Apple Mac OS X Server 10.4 + Apple Mac OS X Server 10.4 Apple iTunes 9.2.1 Apple iTunes 9.0.2 Apple iTunes 9.0.1 .8 Apple iTunes 9.0.1 Apple iTunes 9.0 Apple iTunes 9.2 Apple iTunes 9.1 Apple iTunes 10.1 Apple iTunes 10 Apple iPod Touch 0 Apple iPhone 0 Apple iPad 0 Apple iOS 4.2.1 Apple iOS 4.0.2 Apple iOS 4.0.1 Apple iOS 3.2.2 Apple iOS 3.2.1 Apple iOS 4.2 beta Apple iOS 4.2 Apple iOS 4.1 Apple iOS 4 Apple iOS 3.2 Apple iOS 2.1 Apple iOS 2.0
Not Vulnerable:	Google Chrome 6.0.472.59 Apple Safari 5.0.4 for Windows Apple Safari 5.0.4 Apple iTunes 10.2 Apple iOS 4.3

WebKit SVG styles Use-after-free Memory Corruption Vulnerability

Webkit is prone to a memory-corruption vulnerability.

An attacker can exploit this issue by tricking an unsuspecting victim into viewing a webpage containing malicious content. Successfully exploiting this issue may allow attackers to crash the affected application or execute arbitrary code.

NOTE: This issue was previously discussed in BID 43228 (Google Chrome prior to 6.0.472.59 Multiple Security Vulnerabilities) but has been given its own record to better document it.

WebKit SVG styles Use-after-free Memory Corruption Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

NOTE: To exploit these issues through iTunes, and attacker would need to perform a man-in-the-middle attack first.

WebKit SVG styles Use-after-free Memory Corruption Vulnerability

Solution:
Update are available. Please see the references for more information.


Apple iTunes 10

• Apple APPLE-SA-2011-03-02-1 iTunes64Setup.exe
  For 64-bit Windows XP / Vista / Windows 7
  http://www.apple.com/itunes/download/


• Apple APPLE-SA-2011-03-02-1 iTunesSetup.exe
  For Windows XP / Vista / Windows 7
  http://www.apple.com/itunes/download/


• Apple iTunes10.2.dmg
  for Mac OS X
  http://www.apple.com/itunes/download/

Apple Safari 5.0.3 for Windows

• Apple APPLE-SA-2011-03-09-2 Safari_Setup.exe
  Safari for Windows 7, Vista or XP from the Microsoft Choice Screen
  http://www.apple.com/safari/download/


• Apple APPLE-SA-2011-03-09-2 SafariQuickTimeSetup.exe
  Safari+QuickTime for Windows 7, Vista or XP
  http://www.apple.com/safari/download/


• Apple APPLE-SA-2011-03-09-2 SafariSetup.exe
  Safari for Windows 7, Vista or XP
  http://www.apple.com/safari/download/

Apple iTunes 10.1

• Apple APPLE-SA-2011-03-02-1 iTunes64Setup.exe
  For 64-bit Windows XP / Vista / Windows 7
  http://www.apple.com/itunes/download/


• Apple APPLE-SA-2011-03-02-1 iTunesSetup.exe
  For Windows XP / Vista / Windows 7
  http://www.apple.com/itunes/download/


• Apple iTunes10.2.dmg
  for Mac OS X
  http://www.apple.com/itunes/download/

Apple Safari 5.0.3

• Apple Safari5.0.4Leopard.dmg
  Safari for Mac OS X v10.5.8
  http://www.apple.com/safari/download/


• Apple Safari5.0.4SnowLeopard.dmg
  Safari for Mac OS X v10.6.5 and later
  http://www.apple.com/safari/download/

WebKit SVG styles Use-after-free Memory Corruption Vulnerability

References:

• About the security content of iTunes 10.2 (Apple)
  
• Apple Webkit Error Message Mutation Remote Code Execution Vulnerability (TippingPoint Zero Day Initiative)
  
• Google Chrome Homepage (Google)
  
• Google Chrome Updates (Google)
  
• iTunes Homepage (Apple)
  
• Webkit Homepage (Webkit)