WebKit. Multiple memory corruption issues were addressed through improved input validation.

xml/XMLHttpRequest.cpp in WebCore in WebKit before r38566 does not properly restrict access from web pages to the (1) Set-Cookie and (2) Set-Cookie2 HTTP response headers, which allows remote attackers to obtain sensitive information from cookies via XMLHttpRequest calls, related to the HTTPOnly protection mechanism.

The issue was addressed with improved memory handling.

Impact: maliciously crafted web content may cause unexpected process crash

Advisory: https://webkitgtk.org/security/WSA-2026-0004.html WebKit Bug: https://bugs.webkit.org/showbug.cgi?id=313528

An out-of-bounds access issue was addressed with improved bounds checking.

Impact: maliciously crafted web content may cause unexpected Safari crash

Advisory: https://webkitgtk.org/security/WSA-2026-0004.html WebKit Bug: https://bugs.webkit.org/showbug.cgi?id=317231

iCommon Vulnerabilities and Exposures assigned an identifier CVE-2010-3114 to the following vulnerability:

Name: CVE-2010-3114 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3114 Assigned: 20100824 Reference: CONFIRM: http://code.google.com/p/chromium/issues/detail?id=49628 Reference: CONFIRM: http://googlechromereleases.blogspot.com/2010/08/stable-channel-update19.html

The text-editing implementation in Google Chrome before 5.0.375.127 does not properly perform casts, which has unspecified impact and attack vectors.

This flaw also affects upstream WebKit:

https://bugs.webkit.org/showbug.cgi?id=42655 http://trac.webkit.org/changeset/63773