CVE-2010-1760

2010-08-1900:00:00

ubuntu.com

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS

0.01

Percentile

83.5%

JSON

loader/DocumentThreadableLoader.cpp in the XMLHttpRequest implementation in
WebCore in WebKit before r58409 does not properly handle credentials during
a cross-origin synchronous request, which has unspecified impact and remote
attack vectors, aka rdar problem 7905150.

Bugs

<https://bugs.webkit.org/show_bug.cgi?id=37781>

Notes

Author	Note
jdstrand	qt4-x11 unmaintained upstream (see README.webkit for details) webkit is a fork of khtml from kdelibs. kdelibs5 is farther from it, while qt4-x11 attempts to unify khtml and webkit.
mdeslaur	webkitkde is a wrapper around qt4-x11’s webkit.

OSVersionArchitecturePackageVersionFilename
ubuntu9.10noarchwebkit< 1.2.5-0ubuntu0.9.10.1UNKNOWN
ubuntu10.04noarchwebkit< 1.2.5-0ubuntu0.10.04.1UNKNOWN