Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2010-1759 — Use After Free in Apple Safari

CWE-399CWE-416 — Use After Free9 documents5 sources
Severity
10.0CRITICALNVD
NVD9.3
EPSS
44.1%
top 2.45%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
Google ChromeApple Safari
Timeline
PublishedJun 11
Latest updateMay 17

Description

Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to the Node.normalize method.

CVSS vector

AV:N/AC:M/C:C/I:C/A:CExploitability: 8.6 | Impact: 10.0

Affected Packages2 packages

▶NVDapple/safari4.0.5+6
▶NVDgoogle/chrome< 5.0.375.70

Patches

Patch: lists.apple.com ↗Patch: www.securityfocus.com ↗Patch: www.vupen.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-rp2m-j2gw-9mp4: Use-after-free vulnerability in WebKit in Apple Safari before 5↗2022-05-17
▶
GHSA
GHSA-6g8m-cw34-9j5m: Use-after-free vulnerability in the Element::normalizeAttributes function in dom/Element↗2022-05-13
▶

💥Exploits & PoCs

1
Exploit-DB
Webkit Normalize Bug - Android 2.2↗2012-02-01
▶

📋Vendor Advisories

1
Red Hat
WebKit: use-after-free vulnerability in handling of the Node.normalize method↗2010-06-07
▶

💬Community

3
Bugzilla
Please update to webkitgtk-1.2.3↗2010-07-18
▶
Bugzilla
update webkitgtk to 1.2.3↗2010-07-16
▶
Bugzilla
CVE-2010-1759 WebKit: use-after-free vulnerability in handling of the Node.normalize method↗2010-05-26
▶