CVE-2010-0659
The image decoder in WebKit before r52833, as used in Google Chrome before 4.0.249.78, does not...
The image decoder in WebKit before r52833, as used in Google Chrome before 4.0.249.78, does not properly handle a failure of memory allocation, which allows remote attackers to execute arbitrary code in the Chrome sandbox via a malformed GIF file that specifies a large size.
Exploit likelihood
What each source reports
NVD Score used
The image decoder in WebKit before r52833, as used in Google Chrome before 4.0.249.78, does not properly handle a failure of memory allocation, which allows remote attackers to execute arbitrary code in the Chrome sandbox via a malformed GIF file that specifies a large size.
- Record
CVE-2010-0659- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-399
- Updated
- 2026-11-02
CVE List No score
The image decoder in WebKit before r52833, as used in Google Chrome before 4.0.249.78, does not properly handle a failure of memory allocation, which allows remote attackers to execute arbitrary code in the Chrome sandbox via a malformed GIF file that specifies a large size.
- Record
CVE-2010-0659- Updated
- 2026-11-02
EUVDEUVD-2010-0690 No score
The image decoder in WebKit before r52833, as used in Google Chrome before 4.0.249.78, does not properly handle a failure of memory allocation, which allows remote attackers to execute arbitrary code in the Chrome sandbox via a malformed GIF file that specifies a large size.
- Record
EUVD-2010-0690- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wf8r-7846-mgqj No score
The image decoder in WebKit before r52833, as used in Google Chrome before 4.0.249.78, does not...
The image decoder in WebKit before r52833, as used in Google Chrome before 4.0.249.78, does not properly handle a failure of memory allocation, which allows remote attackers to execute arbitrary code in the Chrome sandbox via a malformed GIF file that specifies a large size.
- Record
GHSA-wf8r-7846-mgqj- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2010-0659 is a high vulnerability (CVSS 9.3) in Apple Webkit, published February 18, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.19%, the 88th percentile. No source names a fixed version.
References
googlechromereleases.blogspot.com/2010/01/stable-channel-update_25.html
secunia.com/advisories/43068
trac.webkit.org/changeset/52833
vupen.com/english/advisories/2011/0212
bugs.webkit.org/show_bug.cgi?id=33231
securitytracker.com/id?1023506
Show 6 moreShow less
sites.google.com/a/chromium.org/dev/Home/chromium-security/chromium-security-bugs
code.google.com/p/chromium/issues/detail?id=28566
lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14079
nvd.nist.gov/vuln/detail/CVE-2010-0659
github.com/advisories/GHSA-wf8r-7846-mgqj