CVE-2010-1807

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 61.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2010-09-10 · updated 2026-06-16
Weakness: CWE-20

Description

WebKit in Apple Safari 4.x before 4.1.2 and 5.x before 5.0.2; Android before 2.2; and webkitgtk before 1.2.6; does not properly validate floating-point data, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted HTML document, related to non-standard NaN representation.

Affected products

Apple Safari: 4.0, 4.0-beta, 4.0.0b, 4.0.1, 4.0.2, 4.0.3 (+6)
Android: through 2.1; 1.0, 1.1, 1.5, 1.6, 2.0
Webkit: through 1.2.5; 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.2.4

References

http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html
http://lists.apple.com/archives/security-announce/2010//Sep/msg00001.html
http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
http://secunia.com/advisories/41856
http://secunia.com/advisories/42314
http://secunia.com/advisories/43068
http://secunia.com/advisories/43086
http://support.apple.com/kb/HT4333
http://support.apple.com/kb/HT4456
http://trac.webkit.org/changeset/64706
http://www.computerworld.com/s/article/9195058/Researcher_to_release_Web_based_Android_attack
http://www.mandriva.com/security/advisories?name=MDVSA-2011:039

Get alerted when CVE-2010-1807 or the next vulnerability affects your stack