VulnerabilityModified
CVE-2010-1386
page/Geolocation.cpp in WebCore in WebKit before r56188 and before 1.2.5 does not properly restrict access to the lastPosition function, which has unspecified impact and remote attack vectors, aka rdar problem 7746357.
HIGH 10.0EPSS 2.13%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.13%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
page/Geolocation.cpp in WebCore in WebKit before r56188 and before 1.2.5 does not properly restrict access to the lastPosition function, which has unspecified impact and remote attack vectors, aka rdar problem 7746357.
- CVSS 2.0
- 10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C
- EPSS
- 2.13% probability · 81th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- apple/webkit
- Source
- product-security@apple.com
References
- http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
- http://secunia.com/advisories/41856Vendor Advisory
- http://secunia.com/advisories/43068Vendor Advisory
- http://security-tracker.debian.org/tracker/CVE-2010-1386
- http://trac.webkit.org/changeset/56188
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:039
- http://www.securityfocus.com/bid/42500
- http://www.ubuntu.com/usn/USN-1006-1
- http://www.vupen.com/english/advisories/2010/2722Vendor Advisory
- http://www.vupen.com/english/advisories/2011/0212Vendor Advisory
- http://www.vupen.com/english/advisories/2011/0552Vendor Advisory
- https://bugs.webkit.org/show_bug.cgi?id=36255
- http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
- http://secunia.com/advisories/41856Vendor Advisory
- http://secunia.com/advisories/43068Vendor Advisory
- http://security-tracker.debian.org/tracker/CVE-2010-1386
- http://trac.webkit.org/changeset/56188
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:039
- http://www.securityfocus.com/bid/42500
- http://www.ubuntu.com/usn/USN-1006-1
- http://www.vupen.com/english/advisories/2010/2722Vendor Advisory
- http://www.vupen.com/english/advisories/2011/0212Vendor Advisory
- http://www.vupen.com/english/advisories/2011/0552Vendor Advisory
- https://bugs.webkit.org/show_bug.cgi?id=36255
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.