CVE-2010-0050

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 11.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2010-03-15 · updated 2026-06-16
Weakness: CWE-416

Description

Use-after-free vulnerability in WebKit in Apple Safari before 4.0.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via an HTML document with improperly nested tags.

Affected products

Apple Iphone Os: from 2.0 before 4.0 — fixed in 4.0
Apple Safari: before 4.0.5 — fixed in 4.0.5
Canonical Ubuntu Linux: 9.10, 10.04, 10.10
Fedoraproject Fedora: 11, 12, 13
Opensuse: 11.2, 11.3

How to fix

Upgrade to a fixed version: Apple Iphone Os 4.0; Apple Safari 4.0.5. Check the vendor advisory for mitigations.

References

http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html
http://lists.apple.com/archives/security-announce/2010/Mar/msg00000.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041383.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041432.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041436.html
http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
http://secunia.com/advisories/41856
http://secunia.com/advisories/43068
http://support.apple.com/kb/HT4070
http://support.apple.com/kb/HT4225
http://www.mandriva.com/security/advisories?name=MDVSA-2011:039
http://www.securityfocus.com/bid/38671

Get alerted when CVE-2010-0050 or the next vulnerability affects your stack