CVE-2010-4577: debian debian_linux Out-of-bounds Read
Vulnerability summary
CVE-2010-4577 is a high (CVSS 7.5) Out-of-bounds Read vulnerability in debian debian_linux. EPSS estimates a 2.21% chance of exploitation in the next 30 days, higher than 82.2% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 2Timeline
- 22-12-2010PublishedVulnerability first disclosed.
- 21-01-2025Last modifiedVulnerability information updated.
Description
The CSSParser::parseFontFaceSrc function in WebCore/css/CSSParser.cpp in WebKit, as used in Google Chrome before 8.0.552.224, Chrome OS before 8.0.552.343, webkitgtk before 1.2.6, and other products does not properly parse Cascading Style Sheets (CSS) token sequences, which allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted local font, related to "Type Confusion."
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
2.21%
Chance of exploitation in the next 30 days
Percentile
82%
Versus all other CVEs
30-day change
0.00 pp
From 2.21% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (code.google.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.
- CWE-843Access of Resource Using Incompatible Type ('Type Confusion')The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
Affected systems
Debian1 product
- debian_linuxEOL6.0 | 7.0
Fedoraproject1 product
- fedoraEOL13
Webkitgtk1 product
- webkitgtk< 1.2.6
4 vendors · 5 products
References
15 links- lists.fedoraproject.org/pipermail/package-announce/2011-January/052906.htmlVendor AdvisoryX Refsource FEDORAMailing ListThird Party Advisory
- googlechromereleases.blogspot.com/2010/12/stable-beta-channel-updates_13.htmlX Refsource CONFIRMRelease Notes
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13953VDB EntrySignatureX Refsource OVALBroken LinkThird Party Advisory
- code.google.com/p/chromium/issues/detail?id=63866X Refsource CONFIRMExploitIssue TrackingMailing List
- www.redhat.com/support/errata/RHSA-2011-0177.htmlVendor AdvisoryX Refsource REDHATBroken LinkThird Party Advisory
Show all 15 references
www.debian.org/security/2011/dsa-2188Vendor AdvisoryX Refsource DEBIANMailing ListThird Party Advisory- www.gentoo.org/security/en/glsa/glsa-201012-01.xmlVendor AdvisoryX Refsource GENTOOThird Party Advisory