{"schemaVersion":3,"id":"CVE-2010-3259","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"WebKit, as used in Apple Safari before 4.1.3 and 5.0.x before 5.0.3, Google Chrome before 6.0.472.53, and webkitgtk before 1.2.6, does not properly restrict read access to images derived from CANVAS elements, which allows remote attackers to bypass the Same Origin Policy and obtain potentially sensitive image data via a crafted web site.","dates":{"published":"2010-09-07T17:00:00.000Z","modified":"2024-08-07T03:03:18.863Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":4.3,"severity":"medium","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":4.3,"severity":"medium","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.016,"percentile":0.75418,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.016},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.016,"percentile":0.75418}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.016,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.016,"percentile":0.75418}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor","description":"The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/200.html"}],"affected":[{"vendor":"apple","product":"iphone_os","name":"iphone os","label":"iphone_os","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< 4.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.2","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"ios","label":"Apple iOS","category":"os"}},"hubHref":"/vendor/apple/iphone_os"},{"vendor":"apple","product":"safari","name":"safari","label":"safari","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 4.1.3","noFixRecorded":false,"fixedIn":null},{"text":"≥ 5.0, < 5.0.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.1.3 | ≥ 5.0, < 5.0.3","eol":null,"hubHref":"/vendor/apple/safari"},{"vendor":"canonical","product":"ubuntu_linux","name":"ubuntu linux","label":"ubuntu_linux","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"9.10","noFixRecorded":false,"fixedIn":null},{"text":"10.04","noFixRecorded":false,"fixedIn":null},{"text":"10.10","noFixRecorded":false,"fixedIn":null}],"versionsText":"9.10 | 10.04 | 10.10","eol":{"isEol":true,"eolDate":"2011-04-30T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"9.10","label":"9.10 'Karmic Koala'","eolFrom":"2011-04-30T00:00:00.000Z","isLts":false,"isMaintained":false,"latestVersion":"9.10"},"product":{"name":"ubuntu","label":"Ubuntu","category":"os"}},"hubHref":"/vendor/canonical/ubuntu_linux"},{"vendor":"google","product":"chrome","name":"chrome","label":"chrome","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 6.0.472.53","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 6.0.472.53","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"chrome","label":"Google Chrome","category":"app"}},"hubHref":"/vendor/google/chrome"},{"vendor":"webkitgtk","product":"webkitgtk","name":"webkitgtk","label":"webkitgtk","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 1.2.6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.2.6","eol":null,"hubHref":"/vendor/webkitgtk/webkitgtk"}],"affectedCount":5,"eol":{"hasEol":true,"count":1},"references":[{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2011:039","label":"www.mandriva.com/security/advisories?name=MDVSA-2011:039","hostname":"www.mandriva.com","tags":["Vendor Advisory","X Refsource MANDRIVA","Third Party Advisory"]},{"url":"http://www.vupen.com/english/advisories/2010/2722","label":"www.vupen.com/english/advisories/2010/2722","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN","Third Party Advisory"]},{"url":"http://secunia.com/advisories/43068","label":"secunia.com/advisories/43068","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.ubuntu.com/usn/USN-1006-1","label":"www.ubuntu.com/usn/USN-1006-1","hostname":"www.ubuntu.com","tags":["Vendor Advisory","X Refsource UBUNTU","Third Party Advisory"]},{"url":"http://support.apple.com/kb/HT4455","label":"support.apple.com/kb/HT4455","hostname":"support.apple.com","tags":["X Refsource CONFIRM","Third Party Advisory"]},{"url":"http://secunia.com/advisories/41856","label":"secunia.com/advisories/41856","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.vupen.com/english/advisories/2011/0212","label":"www.vupen.com/english/advisories/2011/0212","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN","Third Party Advisory"]},{"url":"https://technet.microsoft.com/library/security/msvr11-002","label":"technet.microsoft.com/library/security/msvr11-002","hostname":"technet.microsoft.com","tags":["X Refsource MISC","Broken Link"]},{"url":"http://www.vupen.com/english/advisories/2010/3046","label":"www.vupen.com/english/advisories/2010/3046","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN","Third Party Advisory"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11221","label":"oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11221","hostname":"oval.cisecurity.org","tags":["VDB Entry","Signature","X Refsource OVAL","Third Party Advisory"]},{"url":"http://www.vupen.com/english/advisories/2011/0216","label":"www.vupen.com/english/advisories/2011/0216","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN","Third Party Advisory"]},{"url":"http://secunia.com/advisories/43086","label":"secunia.com/advisories/43086","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.securityfocus.com/bid/44206","label":"www.securityfocus.com/bid/44206","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html","label":"lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html","hostname":"lists.opensuse.org","tags":["Vendor Advisory","X Refsource SUSE","Mailing List","Third Party Advisory"]},{"url":"http://lists.apple.com/archives/security-announce/2010//Nov/msg00002.html","label":"lists.apple.com/archives/security-announce/2010//Nov/msg00002.html","hostname":"lists.apple.com","tags":["Vendor Advisory","X Refsource APPLE","Mailing List","Third Party Advisory"]},{"url":"http://secunia.com/advisories/42314","label":"secunia.com/advisories/42314","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.redhat.com/support/errata/RHSA-2011-0177.html","label":"www.redhat.com/support/errata/RHSA-2011-0177.html","hostname":"www.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Third Party Advisory"]},{"url":"http://www.vupen.com/english/advisories/2011/0552","label":"www.vupen.com/english/advisories/2011/0552","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN","Third Party Advisory"]},{"url":"http://code.google.com/p/chromium/issues/detail?id=53001","label":"code.google.com/p/chromium/issues/detail?id=53001","hostname":"code.google.com","tags":["X Refsource CONFIRM","Patch","Vendor Advisory"]},{"url":"http://support.apple.com/kb/HT4456","label":"support.apple.com/kb/HT4456","hostname":"support.apple.com","tags":["X Refsource CONFIRM","Third Party Advisory"]},{"url":"http://googlechromereleases.blogspot.com/2010/09/stable-and-beta-channel-updates.html","label":"googlechromereleases.blogspot.com/2010/09/stable-and-beta-channel-updates.html","hostname":"googlechromereleases.blogspot.com","tags":["X Refsource CONFIRM","Vendor Advisory"]},{"url":"http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html","label":"lists.apple.com/archives/security-announce/2010//Nov/msg00003.html","hostname":"lists.apple.com","tags":["Vendor Advisory","X Refsource APPLE","Mailing List","Third Party Advisory"]}],"lineage":{"upstream":[],"downstream":["RHSA-2011:0177"],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2010-09-07T17:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-07T03:03:18.863Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":18,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T22:59:40.366Z","stale":false,"partial":false}}