- Description
- Integer overflow in ColorSync in Apple Safari before 4.0.5 on Windows, and iTunes before 9.1, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via an image with a crafted color profile that triggers a heap-based buffer overflow.
- Source
- product-security@apple.com
- NVD status
- Modified
CVSS 2.0
- Type
- Primary
- Base score
- 9.3
- Impact score
- 10
- Exploitability score
- 8.6
- Vector string
- AV:N/AC:M/Au:N/C:C/I:C/A:C
- nvd@nist.gov
- CWE-189
- Hype score
- Not currently trending
- Comment
- Per: http://lists.apple.com/archives/security-announce/2010/Mar/msg00000.html ColorSync CVE-ID: CVE-2010-0040 Available for: Windows 7, Vista, XP Impact: Viewing a maliciously crafted image with an embedded color profile may lead to an unexpected application termination or arbitrary code execution Description: An integer overflow, that could result in a heap buffer overflow, exists in the handling of images with an embedded color profile. Opening a maliciously crafted image with an embedded color profile may lead to an unexpected application termination or arbitrary code execution. The issue is addressed by performing additional validation of color profiles. This issue does not affect Mac OS X systems. Credit to Sebastien Renaud of VUPEN Vulnerability Research Team for reporting this issue.
- Impact
- -
- Solution
- -
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B1816CD6-0159-4684-A54D-94866D3FE570",
"versionEndIncluding": "4.0.4"
},
{
"criteria": "cpe:2.3:a:apple:safari:4.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9BDA6DB4-A0DA-43CA-AABD-10EEEEB28EAB"
},
{
"criteria": "cpe:2.3:a:apple:safari:4.0.0b:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "02EAC196-AE43-4787-9AF9-E79E2E1BBA46"
},
{
"criteria": "cpe:2.3:a:apple:safari:4.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B2FD40E4-D4C9-492E-8432-ABC9BD2C7E67"
},
{
"criteria": "cpe:2.3:a:apple:safari:4.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "36EA71E0-63F7-46FF-AF11-792741F27628"
},
{
"criteria": "cpe:2.3:a:apple:safari:4.0.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "80E36485-565D-4FAA-A6AD-57DF42D47462"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "2CF61F35-5905-4BA9-AD7E-7DB261D2F256"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
]