CVE-2010-0651

Published: Feb 18, 2010Modified: Apr 29, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

WebKit before r52784, as used in Google Chrome before 4.0.249.78 and Apple Safari before 4.0.5, permits cross-origin loading of CSS stylesheets even when the stylesheet download has an incorrect MIME type and the stylesheet document is malformed, which allows remote attackers to obtain sensitive information via a crafted document.

Affected (3)

Products: Apple: Webkit, Safari · Google: Chrome

2 products

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apple Webkit	Up to r53524

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Google Chrome	Up to 4.0.249.78

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Apple Safari	Up to 4.0.4

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (34)

http://code.google.com/p/chromium/issues/detail?id=9877

Source: cve@mitre.org

Third Party Advisory

http://googlechromereleases.blogspot.com/2010/01/stable-channel-update_25.html

Source: cve@mitre.org

PatchThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html

Source: cve@mitre.org

Third Party Advisory

http://scarybeastsecurity.blogspot.com/2009/12/generic-cross-browser-cross-domain.html

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/41856

Source: cve@mitre.org

Permissions Required

http://secunia.com/advisories/43068

Source: cve@mitre.org

Permissions Required

http://securitytracker.com/id?1023506

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://sites.google.com/a/chromium.org/dev/Home/chromium-security/chromium-security-bugs

Source: cve@mitre.org

Third Party Advisory

http://trac.webkit.org/changeset/52784

Source: cve@mitre.org

Vendor Advisory

http://websec.sv.cmu.edu/css/css.pdf

Source: cve@mitre.org

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2011:039

Source: cve@mitre.org

Third Party Advisory

http://www.ubuntu.com/usn/USN-1006-1

Source: cve@mitre.org

Third Party Advisory

http://www.vupen.com/english/advisories/2010/2722

Source: cve@mitre.org

Third Party Advisory

http://www.vupen.com/english/advisories/2011/0212

Source: cve@mitre.org

Third Party Advisory

http://www.vupen.com/english/advisories/2011/0552

Source: cve@mitre.org

Third Party Advisory

https://bugs.webkit.org/show_bug.cgi?id=29820

Source: cve@mitre.org

Vendor Advisory

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13653

Source: cve@mitre.org

http://code.google.com/p/chromium/issues/detail?id=9877

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://googlechromereleases.blogspot.com/2010/01/stable-channel-update_25.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://scarybeastsecurity.blogspot.com/2009/12/generic-cross-browser-cross-domain.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://secunia.com/advisories/41856

Source: af854a3a-2127-422b-91ae-364da2661108

Permissions Required

http://secunia.com/advisories/43068

Source: af854a3a-2127-422b-91ae-364da2661108

Permissions Required

http://securitytracker.com/id?1023506

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

http://sites.google.com/a/chromium.org/dev/Home/chromium-security/chromium-security-bugs

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://trac.webkit.org/changeset/52784

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://websec.sv.cmu.edu/css/css.pdf

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2011:039

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.ubuntu.com/usn/USN-1006-1

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.vupen.com/english/advisories/2010/2722

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.vupen.com/english/advisories/2011/0212

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.vupen.com/english/advisories/2011/0552

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://bugs.webkit.org/show_bug.cgi?id=29820

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13653

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.