Published: 11/06/2010 Updated: 19/09/2017

CVSS v2 Base Score: 9.3 | Impact Score: 10 | Exploitability Score: 8.6

VMScore: 935

Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C

Use-after-free vulnerability in WebKit in Apple Safari prior to 5.0 on Mac OS X 10.5 up to and including 10.6 and Windows, and prior to 4.1 on Mac OS X 10.4, allows remote malicious users to execute arbitrary code or cause a denial of service (application crash) via vectors related to the Node.normalize method.

Vulnerable Product	Search on Vulmon	Subscribe to Product
apple safari 4.0.1
apple safari 4.0.0b
apple safari 4.0
apple safari 4.0.3
apple safari 4.0.2
apple safari 4.0.4
apple webkit
apple safari

<!-- CVE-2010-1759 webkit normalize bug Tested on Moto Droidx2 running 22 Droidx2 running 23 is vulnerable but exploit fails due to non-executable heap Still working on a way around that :) 21 - 23 emulator The changes needed are documented in the code The emulator is less consistent than the real phone Author: MJ Keith mjkeith[at]ev ...

Proof of concept exploit that demonstrates the Webkit normalize bug for Android version 22 ...

CWE-399 http://www.vupen.com/english/advisories/2010/1373 http://secunia.com/advisories/40105 http://lists.apple.com/archives/security-announce/2010/Jun/msg00000.html http://www.securityfocus.com/bid/40620 http://support.apple.com/kb/HT4196 http://securitytracker.com/id?1024067 http://lists.apple.com/archives/security-announce/2010//Jun/msg00002.html http://support.apple.com/kb/HT4220 http://www.vupen.com/english/advisories/2010/1512 http://secunia.com/advisories/40196 http://support.apple.com/kb/HT4225 http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html http://www.vupen.com/english/advisories/2010/2722 http://secunia.com/advisories/41856 http://www.ubuntu.com/usn/USN-1006-1 http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html http://www.vupen.com/english/advisories/2011/0212 http://secunia.com/advisories/43068 http://www.mandriva.com/security/advisories?name=MDVSA-2011:039 http://www.vupen.com/english/advisories/2011/0552 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7005 https://nvd.nist.gov https://www.exploit-db.com/exploits/18446/

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2010-1759

Vulnerability Summary

Exploits

References

Vulmon Search

About

Products

Connect