Home > Vulnerability Database > CVE-2010-4577

Mend.io Vulnerability Database

CVE-2010-4577

Date: December 21, 2010

The CSSParser::parseFontFaceSrc function in WebCore/css/CSSParser.cpp in WebKit, as used in Google Chrome before 8.0.552.224, Chrome OS before 8.0.552.343, webkitgtk before 1.2.6, and other products does not properly parse Cascading Style Sheets (CSS) token sequences, which allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted local font, related to "Type Confusion."

Severity Score

7.5

Related Resources (19)

Url: http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052906.html

Url: http://googlechromereleases.blogspot.com/2010/12/stable-beta-channel-updates_13.html

Url: https://nvd.nist.gov/vuln/detail/CVE-2010-4577

Url: http://secunia.com/advisories/42648

Url: http://code.google.com/p/chromium/issues/detail?id=63866

Url: http://www.securityfocus.com/bid/45722

Url: http://trac.webkit.org/changeset/72685

Url: http://www.gentoo.org/security/en/glsa/glsa-201012-01.xml

Url: http://www.vupen.com/english/advisories/2011/0216

Url: https://bugs.webkit.org/show_bug.cgi?id=49883

Url: https://access.redhat.com/security/cve/CVE-2010-4577

Url: https://people.canonical.com/~ubuntu-security/cve/CVE-2010-4577

Url: http://secunia.com/advisories/43086

Url: http://www.redhat.com/support/errata/RHSA-2011-0177.html

Url: https://bugzilla.redhat.com/show_bug.cgi?id=667025

Url: http://trac.webkit.org/changeset/72685/trunk/WebCore/css/CSSParser.cpp

Url: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13953

Url: http://www.debian.org/security/2011/dsa-2188

Url: https://www.mend.io/vulnerability-database/CVE-2010-4577

Severity Score

7.5

Weakness Type (CWE)

Out-of-bounds Read

CWE-125

Access of Resource Using Incompatible Type ('Type Confusion')

CWE-843

CVSS v3.1

Base Score:	7.5
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	NONE
Integrity (I):	NONE
Availability (A):	HIGH

CVSS v2

Base Score:	5.0
Access Vector (AV):	NETWORK
Access Complexity (AC):	LOW
Authentication (AU):	NONE
Confidentiality (C):	NONE
Integrity (I):	NONE
Availability (A):	PARTIAL
Additional information:

Mend.io Vulnerability Database

We found results for “”

CVE-2010-4577

Date: December 21, 2010

Severity Score

Related Resources (19)

Severity Score

Weakness Type (CWE)

CVSS v3.1

CVSS v2

Do you need more information?