CVE-2010-0045

Опубликовано: 15 мар. 2010

Источник: nvd

CVSS2: 9.3

EPSS Низкий

Описание

Apple Safari before 4.0.5 on Windows does not properly validate external URL schemes, which allows remote attackers to open local files and execute arbitrary code via a crafted HTML document.

Комментарий

Per: http://lists.apple.com/archives/security-announce/2010/Mar/msg00000.html

CVE-ID: CVE-2010-0045 Available for: Windows 7, Vista, XP Impact: Visiting a maliciously crafted website may lead to arbitrary code execution Description: An issue in Safari's handling of external URL schemes may cause a local file to be opened in response to a URL encountered on a web page. Visiting a maliciously crafted website may lead to arbitrary code execution. This update addresses the issue through improved validation of external URLs. This issue does not affect Mac OS X systems. Credit to Billy Rios and Microsoft Vulnerability Research (MSVR) for reporting this issue.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одновременно

Одно из

cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*

Версия до 4.0.4 (включая)

cpe:2.3:a:apple:safari:4.0:*:*:*:*:*:*:*

cpe:2.3:a:apple:safari:4.0:beta:*:*:*:*:*:*

cpe:2.3:a:apple:safari:4.0.1:*:*:*:*:*:*:*

cpe:2.3:a:apple:safari:4.0.2:*:*:*:*:*:*:*

cpe:2.3:a:apple:safari:4.0.3:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*

EPSS

Процентиль: 86%

0.02733

Низкий

9.3 Critical

CVSS2

Дефекты

CWE-20

Связанные уязвимости

GHSA-qp7p-gj3v-w2r8

github

почти 4 года назад