CVE-2010-3259

Description

WebKit, as used in Apple Safari before 4.1.3 and 5.0.x before 5.0.3, Google Chrome before 6.0.472.53, and webkitgtk before 1.2.6, does not properly restrict read access to images derived from CANVAS elements, which allows remote attackers to bypass the Same Origin Policy and obtain potentially sensitive image data via a crafted web site.

Weakness classification

• CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Primary references

• cve@mitre.org — Patch, Vendor Advisory
• cve@mitre.org — Vendor Advisory
• cve@mitre.org — Mailing List, Third Party Advisory
• cve@mitre.org — Mailing List, Third Party Advisory
• cve@mitre.org — Mailing List, Third Party Advisory
• cve@mitre.org — Third Party Advisory
• cve@mitre.org — Third Party Advisory
• cve@mitre.org — Third Party Advisory
• cve@mitre.org — Third Party Advisory
• cve@mitre.org — Third Party Advisory
• cve@mitre.org — Third Party Advisory
• cve@mitre.org — Third Party Advisory