Launchpad.net

Launchpad Home
Code
Bugs
Blueprints
Translations
Answers

CVE 2010-1767

Cross-site request forgery (CSRF) vulnerability in loader/DocumentThreadableLoader.cpp in WebCore in WebKit before r57041, as used in Google Chrome before 4.1.249.1059, allows remote attackers to hijack the authentication of unspecified victims via a crafted synchronous preflight XMLHttpRequest operation.

Related bugs and status

CVE-2010-1767 (Candidate) is related to these bugs:

Bug #660075: webkit 1.2.5 security update tracking bug

		In	Importance	Status
660075	webkit 1.2.5 security update tracking bug	webkit (Ubuntu)	Undecided	Fix Released
660075	webkit 1.2.5 security update tracking bug	webkit (Ubuntu Karmic)	Medium	Fix Released
660075	webkit 1.2.5 security update tracking bug	webkit (Ubuntu Lucid)	Medium	Fix Released
660075	webkit 1.2.5 security update tracking bug	webkit (Ubuntu Maverick)	Medium	Fix Released

See the

CVE page on Mitre.org for more details.

References

CONFIRM: http://code.google.com...
CONFIRM: http://googlechromerel...
CONFIRM: http://security-tracke...
CONFIRM: http://trac.webkit.org...
CONFIRM: https://bugs.webkit.or...
BID: 39603
OSVDB: 64002
SECUNIA: 39544
UBUNTU: USN-1006-1
SECUNIA: 41856
VUPEN: ADV-2010-2722
SUSE: SUSE-SR:2011:002
SECUNIA: 43068
VUPEN: ADV-2011-0212
MANDRIVA: MDVSA-2011:039
VUPEN: ADV-2011-0552
OVAL: oval:org.mitre.oval:de...