Information disclosure in Apple Iphone OS
CVE-2010-3259
WebKit, as used in Apple Safari before 4.1.3 and 5.0.x before 5.0.3, Google Chrome before 6.0.472.53, and webkitgtk before 1.2.6, does not properly restrict read access to images derived from CANVAS elements, which allows remote attackers to bypass the Same Origin Policy and obtain potentially sensitive image data via a crafted web site.
Vulnerability class: Information Disclosure
EPSS: 0.016 (73.3th percentile) — read the EPSS interpretation.
Affected products
- Apple Iphone_os
- Apple Safari
- Google Chrome
- Webkitgtk
- Canonical Ubuntu_linux — versions 10.04, 9.10, 10.10
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (vendor-advisory, Third Party Advisory, x_refsource_MANDRIVA)
- cve@mitre.org (Third Party Advisory, vdb-entry, x_refsource_VUPEN)
- cve@mitre.org (x_refsource_SECUNIA, Third Party Advisory, third-party-advisory)
- cve@mitre.org (x_refsource_UBUNTU, vendor-advisory, Third Party Advisory)
- cve@mitre.org (x_refsource_CONFIRM, Third Party Advisory)
- cve@mitre.org (x_refsource_SECUNIA, Third Party Advisory, third-party-advisory)
- cve@mitre.org (Third Party Advisory, vdb-entry, x_refsource_VUPEN)
- cve@mitre.org (x_refsource_MISC, Broken Link)
- cve@mitre.org (Third Party Advisory, vdb-entry, x_refsource_VUPEN)
- cve@mitre.org (signature, x_refsource_OVAL, Third Party Advisory, vdb-entry)