A large number of security issues were discovered in the WebKit browser and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary code execution.

Please consult the bug listed at the top of this advisory to get the exact list of CVE numbers fixed for each release.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple cross-site scripting, denial of service and arbitrary code execution security flaws were discovered in webkit.

Please consult the CVE web links for further information.

The updated packages have been upgraded to the latest version (1.2.7) to correct these issues.

The version of Google Chrome installed on the remote host is earlier than 4.1.249.1064.  Such versions are reportedly affected by multiple vulnerabilities :

  - A cross-origin bypass in Google URL (GURL). (Issue     #40445)

  - An HTML5 media handling issue could lead to memory     corruption. (Issue #40487)

  - A font handling issue could lead to memory corruption.
    (Issue #42294)

Gustavo Noronha reports :

Debian's Michael Gilbert has done a great job going through all CVEs released about WebKit, and including patches in the Debian package.
1.2.3 includes all of the commits from trunk to fix those, too.

The libwebkit browser engine version 1.2.3 fixes several security relevant bugs

(CVE-2010-1386, CVE-2010-1392, CVE-2010-1405, CVE-2010-1407, CVE-2010-1416, CVE-2010-1417, CVE-2010-1665, CVE-2010-1418, CVE-2010-1421, CVE-2010-1422, CVE-2010-1501, CVE-2010-1767, CVE-2010-1664, CVE-2010-1758, CVE-2010-1759, CVE-2010-1760, CVE-2010-1761, CVE-2010-1762, CVE-2010-1770, CVE-2010-1771, CVE-2010-1772, CVE-2010-1773, CVE-2010-1774)

The version of Google Chrome installed on the remote host is earlier than 4.1.249.1064.  Such versions are reportedly affected by multiple vulnerabilities : 

  - A cross-origin bypass in Google URL. (40445)

  - A memory corruption vulnerability in HTML5 media handling. (40487)

  - A memory corruption vulnerability in font handling. (42294)

ID	Name	Product	Family	Published	Updated	Severity
50046	Ubuntu 9.10 / 10.04 LTS / 10.10 : webkit vulnerabilities (USN-1006-1)	Nessus	Ubuntu Local Security Checks	10/20/2010	9/19/2019	critical
52523	Mandriva Linux Security Advisory : webkit (MDVSA-2011:039)	Nessus	Mandriva Local Security Checks	3/3/2011	1/6/2021	critical
46171	Google Chrome < 4.1.249.1064 Multiple Vulnerabilities	Nessus	Windows	4/28/2010	4/11/2022	high
47751	FreeBSD : webkit-gtk2 -- Multiple vulnerabilities (19419b3b-92bd-11df-b140-0015f2db7bde)	Nessus	FreeBSD Local Security Checks	7/19/2010	1/6/2021	critical
75627	openSUSE Security Update : libwebkit (openSUSE-SU-2010:0458-1)	Nessus	SuSE Local Security Checks	6/13/2014	1/14/2021	critical
800940	Google Chrome < 4.1.249.1064 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	4/28/2010		high

Detections

Analytics

Plugins Search

critical

critical

high

critical

critical

high