CVE-2010-4577

Vulnerability Description

The CSSParser::parseFontFaceSrc function in WebCore/css/CSSParser.cpp in WebKit, as used in Google Chrome before 8.0.552.224, Chrome OS before 8.0.552.343, webkitgtk before 1.2.6, and other products does not properly parse Cascading Style Sheets (CSS) token sequences, which allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted local font, related to "Type Confusion."

CVSS Score

Affected Products

Related Weaknesses (CWE)

References

• http://code.google.com/p/chromium/issues/detail?id=63866ExploitIssue TrackingMailing List
• http://googlechromereleases.blogspot.com/2010/12/stable-beta-channel-updates_13.Release Notes
• http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052906.htMailing ListThird Party Advisory
• http://secunia.com/advisories/42648Broken LinkThird Party Advisory
• http://secunia.com/advisories/43086Broken LinkThird Party Advisory
• http://trac.webkit.org/changeset/72685Mailing ListPatch
• http://trac.webkit.org/changeset/72685/trunk/WebCore/css/CSSParser.cppMailing ListPatch
• http://www.debian.org/security/2011/dsa-2188Mailing ListThird Party Advisory
• http://www.gentoo.org/security/en/glsa/glsa-201012-01.xmlThird Party Advisory
• http://www.redhat.com/support/errata/RHSA-2011-0177.htmlBroken LinkThird Party Advisory
• http://www.securityfocus.com/bid/45722Broken LinkThird Party AdvisoryVDB Entry
• http://www.vupen.com/english/advisories/2011/0216Broken LinkThird Party Advisory
• https://bugs.webkit.org/show_bug.cgi?id=49883Permissions Required
• https://bugzilla.redhat.com/show_bug.cgi?id=667025Issue TrackingThird Party Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Broken LinkThird Party Advisory