CVE-2010-0042

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2010-03-15 · updated 2026-06-16
Weakness: CWE-200

Description

ImageIO in Apple Safari before 4.0.5 and iTunes before 9.1 on Windows does not ensure that memory access is associated with initialized memory, which allows remote attackers to obtain potentially sensitive information from process memory via a crafted TIFF image.

Affected products

Apple Safari: through 4.0.4; 4.0, 4.0.0b, 4.0.1, 4.0.2, 4.0.3

References

http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
http://lists.apple.com/archives/security-announce/2010//Mar/msg00003.html
http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html
http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html
http://lists.apple.com/archives/security-announce/2010/Mar/msg00000.html
http://secunia.com/advisories/39135
http://secunia.com/advisories/42314
http://support.apple.com/kb/HT4070
http://support.apple.com/kb/HT4077
http://support.apple.com/kb/HT4105
http://support.apple.com/kb/HT4225
http://support.apple.com/kb/HT4456

Get alerted when CVE-2010-0042 or the next vulnerability affects your stack