CVE-2010-1807: Input Validation
An input validation issue exists in WebKit's handling of floating point data types. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. This issue is addressed through improved validation of floating point values. Credit to Luke Wagner of Mozilla for reporting this issue.
References:
https://bugs.webkit.org/showbug.cgi?id=43461 http://trac.webkit.org/changeset/64706
Other sources
WebKit in Apple Safari 4.x before 4.1.2 and 5.x before 5.0.2; Android before 2.2; and webkitgtk before 1.2.6; does not properly validate floating-point data, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted HTML document, related to non-standard NaN representation.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-1807?
CVE-2010-1807 has been classified as a high severity vulnerability due to its potential to cause application termination or arbitrary code execution.
How do I fix CVE-2010-1807?
To address CVE-2010-1807, users should update to the latest version of affected software, which includes improved validation of floating point values.
Which software versions are affected by CVE-2010-1807?
CVE-2010-1807 affects multiple versions of Apple Safari, Google Android, and WebKitGTK+, including several 4.x versions of Safari.
What type of vulnerability is CVE-2010-1807?
CVE-2010-1807 is an input validation vulnerability specifically related to the handling of floating point data types in WebKit.
Can CVE-2010-1807 be exploited remotely?
Yes, CVE-2010-1807 can be exploited remotely by visiting a maliciously crafted website.