Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2010-3804 — Apple Safari vulnerability

5 documents4 sources
Severity
5.0MEDIUMNVD
OSV4.9
EPSS
17.2%
top 4.96%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
Apple Safari
Timeline
PublishedNov 22
Latest updateMay 17

Description

The JavaScript implementation in WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on Mac OS X 10.4, uses a weak algorithm for generating values of random numbers, which makes it easier for remote attackers to track a user by predicting a value, a related issue to CVE-2008-5913 and CVE-2010-3171.

CVSS vector

AV:N/AC:L/C:P/I:N/A:NExploitability: 10.0 | Impact: 2.9

Affected Packages1 packages

▶NVDapple/safari5.0.2+52

Patches

Patch: support.apple.com ↗Patch: support.apple.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-h84m-77j2-99hq: The JavaScript implementation in WebKit in Apple Safari before 5↗2022-05-17
▶
OSV
CVE-2010-3804: The JavaScript implementation in WebKit in Apple Safari before 5↗2010-11-22
▶

💥Exploits & PoCs

2
Exploit-DB
WebKit - Insufficient Entropy Random Number Generator (1)↗2010-11-18
▶
Exploit-DB
WebKit - Insufficient Entropy Random Number Generator (2)↗2010-11-18
▶