QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2010-3813

Back to search

CVE-2010-3813

Published: Nov 20, 2010

Modified: Aug 7, 2024

PUBLISHED

Description

The WebCore::HTMLLinkElement::process function in WebCore/html/HTMLLinkElement.cpp in WebKit, as used in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on Mac OS X 10.4; webkitgtk before 1.2.6; and possibly other products does not verify whether DNS prefetching is enabled when processing an HTML LINK element, which allows remote attackers to bypass intended access restrictions, as demonstrated by an HTML e-mail message that uses a LINK element for X-Confirm-Reading-To functionality.

VendorProductVersions

n/a

n/a

affected
n/a

References

MDVSA-2011:039
vendor-advisory
x_refsource_MANDRIVA
FEDORA-2011-0121
vendor-advisory
x_refsource_FEDORA
43068
third-party-advisory
x_refsource_SECUNIA
ADV-2011-0212
vdb-entry
x_refsource_VUPEN
ADV-2010-3046
vdb-entry
x_refsource_VUPEN
ADV-2011-0216
vdb-entry
x_refsource_VUPEN
oval:org.mitre.oval:def:12293
vdb-entry
signature
x_refsource_OVAL
43086
third-party-advisory
x_refsource_SECUNIA
SUSE-SR:2011:002
vendor-advisory
x_refsource_SUSE
APPLE-SA-2010-11-18-1
vendor-advisory
x_refsource_APPLE
42314
third-party-advisory
x_refsource_SECUNIA
RHSA-2011:0177
vendor-advisory
x_refsource_REDHAT
ADV-2011-0552
vdb-entry
x_refsource_VUPEN
APPLE-SA-2010-11-22-1
vendor-advisory
x_refsource_APPLE

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now