CVE-2010-0063

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2010-03-30 · updated 2026-06-16

Description

Incomplete blacklist vulnerability in CoreTypes in Apple Mac OS X before 10.6.3 makes it easier for user-assisted remote attackers to execute arbitrary JavaScript via a web page that offers a download with a Content-Type value that is not on the list of possibly unsafe content types for Safari, as demonstrated by the values for the (1) .ibplugin and (2) .url extensions.

Affected products

macOS: through 10.6.2; 10.5, 10.5.0, 10.5.1, 10.5.2, 10.5.3, 10.5.4 (+6)
Apple Mac Os X Server: through 10.6.2; 10.5, 10.5.0, 10.5.1, 10.5.2, 10.5.3, 10.5.4 (+6)

References

http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
http://support.apple.com/kb/HT4077
http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
http://support.apple.com/kb/HT4077

Get alerted when CVE-2010-0063 or the next vulnerability affects your stack