CVE-2010-3821

WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on Mac OS X 10.4, does not properly handle the :first-letter…

published November 20, 2010

CVSS
—
EPSS
4%
Percentile
91.2
In the wild
Unconfirmed
What it is

⚠️ An innocent-looking CSS pseudo-element is hiding a vulnerability! This flaw in WebKit lets attackers manipulate the :first-letter styling to execute arbitrary code. 😱 Think of it like a restaurant menu that allows the chef to mix and match ingredients in unexpected ways—if the chef goes rogue, the entire meal could turn into a disaster! 🍽️ An attacker could craft a malicious website that, when visited, could cause Safari to crash or even execute harmful code on your computer. This means your device could be vulnerable to all sorts of chaotic behavior, putting your data at risk!

Put simply

Think of it like a restaurant menu that allows the chef to mix and match ingredients in unexpected ways—if the chef goes rogue, the entire meal could turn into a disaster! 🍽️ This vulnerability in WebKit allows remote attackers to exploit the :first-letter pseudo-element in a Cascading Style Sheets (CSS) token sequence, potentially leading to memory corruption and application crashes.

What to do

An attacker could craft a malicious website that, when visited, could cause Safari to crash or even execute harmful code on your computer. This means your device could be vulnerable to all sorts of chaotic behavior, putting your data at risk! To protect yourself, update Safari to version 5.0.3 or later for Mac OS X 10.5 through 10.6 and version 4.1.3 or later for Mac OS X 10.4. Regularly check for software updates to stay ahead of potential threats! 🛡️ You've got this! Keep your software updated and you'll be navigating the web safely in no time! 🚀

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.04358 · 91.2th percentile
Published
2010-11-20T21:00Z
EPSS history
Timeline
  • 20 NOV 21:00Z
    WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on Mac OS X 10.4, does not properly handle the :first-letter…
    cvelistv5