CVE-2010-1404
Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6...
Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via an SVG document that contains recursive Use elements, which are not properly handled during page deconstruction.
Exploit likelihood
What each source reports
NVD Score used
Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via an SVG document that contains recursive Use elements, which are not properly handled during page deconstruction.
- Record
CVE-2010-1404- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-399
- Updated
- 2026-11-02
CVE List No score
Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via an SVG document that contains recursive Use elements, which are not properly handled during page deconstruction.
- Record
CVE-2010-1404- Updated
- 2026-11-02
EUVDEUVD-2010-1432 No score
Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via an SVG document that contains recursive Use elements, which are not properly handled during page deconstruction.
- Record
EUVD-2010-1432- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jc34-6m5q-52fv No score
Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6...
Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via an SVG document that contains recursive Use elements, which are not properly handled during page deconstruction.
- Record
GHSA-jc34-6m5q-52fv- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2010-1404 is a high vulnerability (CVSS 9.3) in Apple Safari, published June 11, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 8.73%, the 95th percentile. No source names a fixed version.
References
mandriva.com/security/advisories?name=MDVSA-2011:039
support.apple.com/kb/HT4220
vupen.com/english/advisories/2010/2722
secunia.com/advisories/43068
ubuntu.com/usn/USN-1006-1
Show 19 moreShow less
lists.apple.com/archives/security-announce/2010/Jun/msg00000.html
zerodayinitiative.com/advisories/ZDI-10-096
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7497
securityfocus.com/archive/1/511718/100/0/threaded
lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
securitytracker.com/id?1024067
nvd.nist.gov/vuln/detail/CVE-2010-1404
github.com/advisories/GHSA-jc34-6m5q-52fv