{"schemaVersion":3,"id":"CVE-2010-4577","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"The CSSParser::parseFontFaceSrc function in WebCore/css/CSSParser.cpp in WebKit, as used in Google Chrome before 8.0.552.224, Chrome OS before 8.0.552.343, webkitgtk before 1.2.6, and other products does not properly parse Cascading Style Sheets (CSS) token sequences, which allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted local font, related to \"Type Confusion.\"","dates":{"published":"2010-12-22T00:00:00.000Z","modified":"2025-01-21T17:37:30.182Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.5,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":5,"severity":"medium","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.02209,"percentile":0.82296,"severity":"low","asOf":"2026-10-18T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-18T00:00:00.000Z","baselineScore":0.02209},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.02209,"percentile":0.82296}],"last30":[{"date":"2026-09-18T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.02209,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.02209,"percentile":0.82296}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"REF_B271BBFE78720CB0","name":"Exploit Reference (code.google.com)","source":"reference","url":"http://code.google.com/p/chromium/issues/detail?id=63866","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-125","name":"Out-of-bounds Read","description":"The product reads data past the end, or before the beginning, of the intended buffer.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/125.html"},{"id":"CWE-843","name":"Access of Resource Using Incompatible Type ('Type Confusion')","description":"The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/843.html"}],"affected":[{"vendor":"debian","product":"debian_linux","name":"debian linux","label":"debian_linux","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"6.0","noFixRecorded":false,"fixedIn":null},{"text":"7.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"6.0 | 7.0","eol":{"isEol":true,"eolDate":"2016-02-29T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"6","label":"6 (Squeeze)","eolFrom":"2016-02-29T00:00:00.000Z","isLts":false,"isMaintained":false,"latestVersion":"6.0.10"},"product":{"name":"debian","label":"Debian","category":"os"}},"hubHref":"/vendor/debian/debian_linux"},{"vendor":"fedoraproject","product":"fedora","name":"fedora","label":"fedora","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"13","noFixRecorded":false,"fixedIn":null}],"versionsText":"13","eol":{"isEol":true,"eolDate":"2011-06-24T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"13","label":"13 (Goddard)","eolFrom":"2011-06-24T00:00:00.000Z","isLts":false,"isMaintained":false,"latestVersion":null},"product":{"name":"fedora","label":"Fedora Linux","category":"os"}},"hubHref":"/vendor/fedoraproject/fedora"},{"vendor":"google","product":"chrome","name":"chrome","label":"chrome","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 8.0.552.224","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.0.552.224","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"chrome","label":"Google Chrome","category":"app"}},"hubHref":"/vendor/google/chrome"},{"vendor":"google","product":"chrome_os","name":"chrome os","label":"chrome_os","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< 8.0.552.343","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.0.552.343","eol":null,"hubHref":"/vendor/google/chrome_os"},{"vendor":"webkitgtk","product":"webkitgtk","name":"webkitgtk","label":"webkitgtk","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 1.2.6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.2.6","eol":null,"hubHref":"/vendor/webkitgtk/webkitgtk"}],"affectedCount":5,"eol":{"hasEol":true,"count":2},"references":[{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052906.html","label":"lists.fedoraproject.org/pipermail/package-announce/2011-January/052906.html","hostname":"lists.fedoraproject.org","tags":["Vendor Advisory","X Refsource FEDORA","Mailing List","Third Party Advisory"]},{"url":"http://googlechromereleases.blogspot.com/2010/12/stable-beta-channel-updates_13.html","label":"googlechromereleases.blogspot.com/2010/12/stable-beta-channel-updates_13.html","hostname":"googlechromereleases.blogspot.com","tags":["X Refsource CONFIRM","Release Notes"]},{"url":"http://secunia.com/advisories/42648","label":"secunia.com/advisories/42648","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Broken Link"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=667025","label":"bugzilla.redhat.com/show_bug.cgi?id=667025","hostname":"bugzilla.redhat.com","tags":["X Refsource CONFIRM","Issue Tracking","Third Party Advisory"]},{"url":"http://www.vupen.com/english/advisories/2011/0216","label":"www.vupen.com/english/advisories/2011/0216","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN","Broken Link","Third Party Advisory"]},{"url":"https://bugs.webkit.org/show_bug.cgi?id=49883","label":"bugs.webkit.org/show_bug.cgi?id=49883","hostname":"bugs.webkit.org","tags":["X Refsource MISC","Permissions Required"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13953","label":"oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13953","hostname":"oval.cisecurity.org","tags":["VDB Entry","Signature","X Refsource OVAL","Broken Link","Third Party Advisory"]},{"url":"http://secunia.com/advisories/43086","label":"secunia.com/advisories/43086","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Broken Link"]},{"url":"http://code.google.com/p/chromium/issues/detail?id=63866","label":"code.google.com/p/chromium/issues/detail?id=63866","hostname":"code.google.com","tags":["X Refsource CONFIRM","Exploit","Issue Tracking","Mailing List"]},{"url":"http://www.redhat.com/support/errata/RHSA-2011-0177.html","label":"www.redhat.com/support/errata/RHSA-2011-0177.html","hostname":"www.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Broken Link","Third Party Advisory"]},{"url":"http://trac.webkit.org/changeset/72685/trunk/WebCore/css/CSSParser.cpp","label":"trac.webkit.org/changeset/72685/trunk/WebCore/css/CSSParser.cpp","hostname":"trac.webkit.org","tags":["X Refsource MISC","Mailing List","Patch"]},{"url":"http://trac.webkit.org/changeset/72685","label":"trac.webkit.org/changeset/72685","hostname":"trac.webkit.org","tags":["X Refsource MISC","Mailing List","Patch"]},{"url":"http://www.debian.org/security/2011/dsa-2188","label":"www.debian.org/security/2011/dsa-2188","hostname":"www.debian.org","tags":["Vendor Advisory","X Refsource DEBIAN","Mailing List","Third Party Advisory"]},{"url":"http://www.gentoo.org/security/en/glsa/glsa-201012-01.xml","label":"www.gentoo.org/security/en/glsa/glsa-201012-01.xml","hostname":"www.gentoo.org","tags":["Vendor Advisory","X Refsource GENTOO","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/45722","label":"www.securityfocus.com/bid/45722","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Broken Link","Third Party Advisory"]}],"lineage":{"upstream":[],"downstream":["DSA-2188-1","RHSA-2011:0177"],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2010-12-22T00:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2025-01-21T17:37:30.182Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":40,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T04:51:32.472Z","stale":false,"partial":false}}