CVE-2010-3259

Published: Sep 7, 2010Modified: Apr 29, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

WebKit, as used in Apple Safari before 4.1.3 and 5.0.x before 5.0.3, Google Chrome before 6.0.472.53, and webkitgtk before 1.2.6, does not properly restrict read access to images derived from CANVAS elements, which allows remote attackers to bypass the Same Origin Policy and obtain potentially sensitive image data via a crafted web site.

Affected (8)

Products: Google: Chrome · Webkitgtk: Webkitgtk · Apple: Iphone Os, Safari · +1 more

Show all products

Google: Chrome · Webkitgtk: Webkitgtk · Apple: Iphone Os, Safari · Canonical: Ubuntu Linux

1 product

1 product

2 products

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Google Chrome	Before 6.0.472.53

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Webkitgtk Webkitgtk	Before 1.2.6

Configuration C

3 vulnerable

Vulnerable Software	Affected Versions
Apple Iphone Os	Before 4.2
Apple Safari	Before 4.1.3
Apple Safari	From 5.0 to 5.0.3

Configuration D

3 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 10.04
Canonical Ubuntu Linux	Version 10.10
Canonical Ubuntu Linux	Version 9.10

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (44)

http://code.google.com/p/chromium/issues/detail?id=53001

Source: cve@mitre.org

PatchVendor Advisory

http://googlechromereleases.blogspot.com/2010/09/stable-and-beta-channel-updates.html

Source: cve@mitre.org

Vendor Advisory

http://lists.apple.com/archives/security-announce/2010//Nov/msg00002.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://secunia.com/advisories/41856

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/42314

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/43068

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/43086

Source: cve@mitre.org

Third Party Advisory

http://support.apple.com/kb/HT4455

Source: cve@mitre.org

Third Party Advisory

http://support.apple.com/kb/HT4456

Source: cve@mitre.org

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2011:039

Source: cve@mitre.org

Third Party Advisory

http://www.redhat.com/support/errata/RHSA-2011-0177.html

Source: cve@mitre.org

Third Party Advisory

http://www.securityfocus.com/bid/44206

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/USN-1006-1

Source: cve@mitre.org

Third Party Advisory

http://www.vupen.com/english/advisories/2010/2722

Source: cve@mitre.org

Third Party Advisory

http://www.vupen.com/english/advisories/2010/3046

Source: cve@mitre.org

Third Party Advisory

http://www.vupen.com/english/advisories/2011/0212

Source: cve@mitre.org

Third Party Advisory

http://www.vupen.com/english/advisories/2011/0216

Source: cve@mitre.org

Third Party Advisory

http://www.vupen.com/english/advisories/2011/0552

Source: cve@mitre.org

Third Party Advisory

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11221

Source: cve@mitre.org

Third Party Advisory

https://technet.microsoft.com/library/security/msvr11-002

Source: cve@mitre.org

Broken Link

http://code.google.com/p/chromium/issues/detail?id=53001