CVE-2010-3116 Use after free in n/a

Critical 10.0 Published 24 Aug 2010 Updated 7 Aug 2024

Remote attackers can execute arbitrary code or crash the browser via crafted MIME types in WebKit-based browsers like Safari and Chrome.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2010-3116?

CVE-2010-3116 is a critical use after free vulnerability in Apple Iphone Os, published on 24 Aug 2010. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Multiple use-after-free vulnerabilities in WebKit, as used in Apple Safari before 4.1.3 and 5.0.x before 5.0.3, Google Chrome before 5.0.375.127, and webkitgtk before 1.2.6, allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to improper handling of MIME types by plug-ins.

Weakness: CWE-416

Which versions are affected by CVE-2010-3116?

It affects 5 products.

Products include Apple Iphone Os, Apple Safari, Canonical Ubuntu Linux, Google Chrome, Webkitgtk Webkitgtk.

How do I fix CVE-2010-3116?

Upgrade to a fixed version.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2010-3116 being exploited?

There is no known exploitation of CVE-2010-3116 in the wild and no public exploit code.

All Apple Iphone Os vulnerabilities

Sources

Also known as GHSA-r86w-r23c-j68w.