Vulnerabilities > CVE-2010-1939 - Resource Management Errors vulnerability in Apple Safari 4.0.5

047910
CVSS 7.6 - HIGH
Attack vector
NETWORK
Attack complexity
HIGH
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
high complexity
apple
microsoft
CWE-399
exploit available
NVD
Published: 2010-05-13
Updated: 2017-09-19

Summary

Use-after-free vulnerability in Apple Safari 4.0.5 on Windows allows remote attackers to execute arbitrary code by using window.open to create a popup window for a crafted HTML document, and then calling the parent window's close method, which triggers improper handling of a deleted window object. CWE-416 'Use After Free' http://cwe.mitre.org/data/definitions/416.html

Vulnerable Configurations

Part Description Count
Application
Apple
1
OS
Microsoft
1

Common Weakness Enumeration (CWE)

Exploit-Db

  • descriptionSafari 4.0.5 parent.close() Memory Corruption exploit (w/ASLR and DEP bypass). CVE-2010-1939. Remote exploit for windows platform
    idEDB-ID:12614
    last seen2016-02-01
    modified2010-05-15
    published2010-05-15
    reporterAlexey Sintsov
    sourcehttps://www.exploit-db.com/download/12614/
    titleSafari 4.0.5 - parent.close Memory Corruption Exploit ASLR and DEP bypass
  • descriptionApple Safari 4.0.5 parent.close() (memory corruption) 0day Code Execution Exploit. CVE-2010-1939. Remote exploit for windows platform
    idEDB-ID:12573
    last seen2016-02-01
    modified2010-05-11
    published2010-05-11
    reporterKrystian Kloskowski
    sourcehttps://www.exploit-db.com/download/12573/
    titleApple Safari 4.0.5 - parent.close memory corruption Code Execution Exploit 0day

Oval

accepted2013-11-11T04:02:17.798-05:00
classvulnerability
contributors
  • namePreeti Subramanian
    organizationSecPod Technologies
  • nameShane Shaffer
    organizationG2, Inc.
  • nameMaria Kedovskaya
    organizationALTX-SOFT
definition_extensions
commentApple Safari is installed
ovaloval:org.mitre.oval:def:6325
descriptionUse-after-free vulnerability in Apple Safari 4.0.5 on Windows allows remote attackers to execute arbitrary code by using window.open to create a popup window for a crafted HTML document, and then calling the parent window's close method, which triggers improper handling of a deleted window object.
familywindows
idoval:org.mitre.oval:def:6748
statusaccepted
submitted2010-05-17T03:34:03
titleUse-after-free vulnerability in Apple Safari 4.0.5
version10

Saint

bid39990
descriptionApple Safari parent.close() Invalid Pointer Code Execution
idweb_client_safari
osvdb64482
titlesafari_parent_close_invalid_pointer
typeclient

References