CVE-2010-1766: High severity webkit vulnerability
An off by one memory corruption issue exists in WebSocketHandshake::readServerHandshake(). This issue is addressed by improved bounds checking.
References:
Bugzilla: https://bugs.webkit.org/showbug.cgi?id=36339 Trac: http://trac.webkit.org/changeset/56380
Acknowledgements:
Red Hat would like to thank Drew Yao of Apple Product Security for responsibly reporting this issue. Upstream acknowledges Skylined of Google Chrome Security Team as the original reporter.
Other sources
Off-by-one error in the WebSocketHandshake::readServerHandshake function in websockets/WebSocketHandshake.cpp in WebCore in WebKit before r56380, as used in Qt and other products, allows remote websockets servers to cause a denial of service (memory corruption) or possibly have unspecified other impact via an upgrade header that is long and invalid.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-1766?
CVE-2010-1766 has a medium severity rating due to its potential for memory corruption.
How do I fix CVE-2010-1766?
To fix CVE-2010-1766, update your WebKit or Qt installation to the latest version that is not affected by this vulnerability.
Which software products are affected by CVE-2010-1766?
CVE-2010-1766 affects WebKit up to version r56379 and Qt up to version 4.6.2.
What type of vulnerability is CVE-2010-1766?
CVE-2010-1766 is classified as an off-by-one memory corruption vulnerability.
Is there a workaround for CVE-2010-1766?
No specific workaround exists for CVE-2010-1766; updating the software is the recommended solution.