CVEvulnerability

CVE-2010-4577

7.5 HIGH Published 2010-12-22 Modified 2026-06-16 Official page ↗

Status: Modified
Published: 2010-12-22
Last modified: 2026-06-16
Assigner: [email protected]
CVSS 3.1 ([email protected]): 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0): 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0 ([email protected]): 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:N/A:P
Weaknesses: CWE-125, CWE-843

Description

The CSSParser::parseFontFaceSrc function in WebCore/css/CSSParser.cpp in WebKit, as used in Google Chrome before 8.0.552.224, Chrome OS before 8.0.552.343, webkitgtk before 1.2.6, and other products does not properly parse Cascading Style Sheets (CSS) token sequences, which allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted local font, related to "Type Confusion."

Affected configurations

• google chrome (< 8.0.552.224) • webkitgtk webkitgtk (< 1.2.6) • google chrome os (< 8.0.552.343) • fedoraproject fedora 13 • debian debian linux 6.0 • debian debian linux 7.0

Weakness · CWE (2)

CWE-125 Out-of-bounds Read weakness
CWE-843 Access of Resource Using Incompatible Type weakness

Referenced by CWE · observed example (1)

CWE-843 Access of Resource Using Incompatible Type weakness

References

http://code.google.com/p/chromium/issues/detail?id=63866 Exploit, Issue Tracking, Mailing List
http://googlechromereleases.blogspot.com/2010/12/stable-beta-channel-updates_13.html Release Notes
http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052906.html Mailing List, Third Party Advisory
http://secunia.com/advisories/42648 Broken Link, Third Party Advisory
http://secunia.com/advisories/43086 Broken Link, Third Party Advisory
http://trac.webkit.org/changeset/72685 Mailing List, Patch
http://trac.webkit.org/changeset/72685/trunk/WebCore/css/CSSParser.cpp Mailing List, Patch
http://www.debian.org/security/2011/dsa-2188 Mailing List, Third Party Advisory
http://www.gentoo.org/security/en/glsa/glsa-201012-01.xml Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2011-0177.html Broken Link, Third Party Advisory
http://www.securityfocus.com/bid/45722 Broken Link, Third Party Advisory, VDB Entry
http://www.vupen.com/english/advisories/2011/0216 Broken Link, Third Party Advisory
https://bugs.webkit.org/show_bug.cgi?id=49883 Permissions Required
https://bugzilla.redhat.com/show_bug.cgi?id=667025 Issue Tracking, Third Party Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13953 Broken Link, Third Party Advisory
http://code.google.com/p/chromium/issues/detail?id=63866 Exploit, Issue Tracking, Mailing List
http://googlechromereleases.blogspot.com/2010/12/stable-beta-channel-updates_13.html Release Notes
http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052906.html Mailing List, Third Party Advisory
http://secunia.com/advisories/42648 Broken Link, Third Party Advisory
http://secunia.com/advisories/43086 Broken Link, Third Party Advisory
http://trac.webkit.org/changeset/72685 Mailing List, Patch
http://trac.webkit.org/changeset/72685/trunk/WebCore/css/CSSParser.cpp Mailing List, Patch
http://www.debian.org/security/2011/dsa-2188 Mailing List, Third Party Advisory
http://www.gentoo.org/security/en/glsa/glsa-201012-01.xml Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2011-0177.html Broken Link, Third Party Advisory
http://www.securityfocus.com/bid/45722 Broken Link, Third Party Advisory, VDB Entry
http://www.vupen.com/english/advisories/2011/0216 Broken Link, Third Party Advisory
https://bugs.webkit.org/show_bug.cgi?id=49883 Permissions Required
https://bugzilla.redhat.com/show_bug.cgi?id=667025 Issue Tracking, Third Party Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13953 Broken Link, Third Party Advisory