MEDIUM
The JavaScript implementation in WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on Mac OS X 10.4, uses a weak algorithm for generating values of random numbers, which makes it easier for remote attackers to track a user by predicting a value, a related issue to CVE-2008-5913 and CVE-2010-3171
Published Nov 20, 2010
5.0
MEDIUMCVSS 2.0
EPSS 9.13%
Description
The JavaScript implementation in WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on Mac OS X 10.4, uses a weak algorithm for generating values of random numbers, which makes it easier for remote attackers to track a user by predicting a value, a related issue to CVE-2008-5913 and CVE-2010-3171.
Affected products
No data.
Configuration 1
AND
AND
Running on/with
OR
- 10.5
- 10.5.0
- 10.5.1
- 10.5.2
- 10.5.3
- 10.5.4
- 10.5.5
- 10.5.6
- 10.5.7
- 10.5.8
- 10.6.0
- 10.6.1
- 10.6.2
- 10.6.3
- 10.6.4
- 10.6.5
- 10.5
- 10.5.0
- 10.5.1
- 10.5.2
- 10.5.3
- 10.5.4
- 10.5.5
- 10.5.6
- 10.5.7
- 10.5.8
- 10.6.0
- 10.6.1
- 10.6.2
- 10.6.3
- 10.6.4
- 10.6.5
- n/a
- n/a
- n/a
Configuration 2
AND
OR
- ≤ 4.1.2
- 1.0
- 1.0
- 1.0
- 1.0.0
- 1.0.0b1
- 1.0.0b2
- 1.0.1
- 1.0.2
- 1.0.3
- 1.0.3
- 1.0.3
- 1.1
- 1.1.0
- 1.1.1
- 1.2
- 1.2.0
- 1.2.1
- 1.2.2
- 1.2.3
- 1.2.4
- 1.2.5
- 1.3
- 1.3.0
- 1.3.1
- 1.3.2
- 1.3.2
- 1.3.2
- 2
- 2.0
- 2.0.0
- 2.0.1
- 2.0.2
- 2.0.3
- 2.0.3
- 2.0.3
- 2.0.3
- 2.0.3
- 2.0.4
- 3
- 3.0
- 3.0.0
- 3.0.0b
- 3.0.1
- 3.0.1b
- 3.0.2
- 3.0.2b
- 3.0.3
- 3.0.3b
- 3.0.4
- 3.0.4b
- 3.1.0
- 3.1.0b
- 3.1.1
- 3.1.2
- 3.2.0
- 3.2.1
- 3.2.2
- 4.1
- 4.1.1
- n/a
Running on/with
OR
- 10.4
- 10.4.0
- 10.4.1
- 10.4.2
- 10.4.3
- 10.4.4
- 10.4.5
- 10.4.6
- 10.4.7
- 10.4.8
- 10.4.9
- 10.4.10
- 10.4.11
- 10.4
- 10.4.0
- 10.4.1
- 10.4.2
- 10.4.3
- 10.4.4
- 10.4.5
- 10.4.6
- 10.4.7
- 10.4.8
- 10.4.9
- 10.4.10
- 10.4.11
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (11)
- http://lists.apple.com/archives/security-announce/2010//Nov/msg00002.html vendor-advisoryx_refsource_APPLEVendor Advisory
- http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html vendor-advisoryx_refsource_APPLE
- http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html vendor-advisoryx_refsource_SUSE
- http://secunia.com/advisories/42314 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/43068 third-party-advisoryx_refsource_SECUNIA
- http://support.apple.com/kb/HT4455 x_refsource_CONFIRMPatchVendor Advisory
- http://support.apple.com/kb/HT4456 x_refsource_CONFIRM
- http://www.vupen.com/english/advisories/2010/3046 vdb-entryx_refsource_VUPEN
- http://www.vupen.com/english/advisories/2011/0212 vdb-entryx_refsource_VUPEN
- https://exchange.xforce.ibmcloud.com/vulnerabilities/63347 vdb-entryx_refsource_XF
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11495 vdb-entrysignaturex_refsource_OVAL
| Link | Providers | Tags |
|---|---|---|
| http://lists.apple.com/archives/security-announce/2010//Nov/msg00002.html | vendor-advisoryx_refsource_APPLEVendor Advisory | |
| http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html | vendor-advisoryx_refsource_APPLE | |
| http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html | vendor-advisoryx_refsource_SUSE | |
| http://secunia.com/advisories/42314 | third-party-advisoryx_refsource_SECUNIA | |
| http://secunia.com/advisories/43068 | third-party-advisoryx_refsource_SECUNIA | |
| http://support.apple.com/kb/HT4455 | x_refsource_CONFIRMPatchVendor Advisory | |
| http://support.apple.com/kb/HT4456 | x_refsource_CONFIRM | |
| http://www.vupen.com/english/advisories/2010/3046 | vdb-entryx_refsource_VUPEN | |
| http://www.vupen.com/english/advisories/2011/0212 | vdb-entryx_refsource_VUPEN | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/63347 | vdb-entryx_refsource_XF | |
| https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11495 | vdb-entrysignaturex_refsource_OVAL |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner apple
Published Nov 20, 2010
Updated Aug 7, 2024
Reserved Oct 7, 2010
Link CVE-2010-3804
CISA Vulnrichment
Updated n/a