CVE-2011-1290
Integer overflow in WebKit, as used on the Research In Motion (RIM) BlackBerry Torch 9800 with...
Integer overflow in WebKit, as used on the Research In Motion (RIM) BlackBerry Torch 9800 with firmware 6.0.0.246, in Google Chrome before 10.0.648.133, and in Apple Safari before 5.0.5, allows remote attackers to execute arbitrary code via unknown vectors related to CSS "style handling," nodesets, and a length value, as demonstrated by Vincenzo Iozzo, Willem Pinckaers, and Ralf-Philipp Weinmann during a Pwn2Own competition at CanSecWest 2011.
Exploit likelihood
What each source reports
NVD Score used
Integer overflow in WebKit, as used on the Research In Motion (RIM) BlackBerry Torch 9800 with firmware 6.0.0.246, in Google Chrome before 10.0.648.133, and in Apple Safari before 5.0.5, allows remote attackers to execute arbitrary code via unknown vectors related to CSS "style handling," nodesets, and a length value, as demonstrated by Vincenzo Iozzo, Willem Pinckaers, and Ralf-Philipp Weinmann during a Pwn2Own competition at CanSecWest 2011.
- Record
CVE-2011-1290- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-189
- Updated
- 2026-11-02
CVE List No score
Integer overflow in WebKit, as used on the Research In Motion (RIM) BlackBerry Torch 9800 with firmware 6.0.0.246, in Google Chrome before 10.0.648.133, and in Apple Safari before 5.0.5, allows remote attackers to execute arbitrary code via unknown vectors related to CSS "style handling," nodesets, and a length value, as demonstrated by Vincenzo Iozzo, Willem Pinckaers, and Ralf-Philipp Weinmann during a Pwn2Own competition at CanSecWest 2011.
- Record
CVE-2011-1290- Updated
- 2026-11-02
EUVDEUVD-2011-1298 No score
Integer overflow in WebKit, as used on the Research In Motion (RIM) BlackBerry Torch 9800 with firmware 6.0.0.246, in Google Chrome before 10.0.648.133, and in Apple Safari before 5.0.5, allows remote attackers to execute arbitrary code via unknown vectors related to CSS "style handling," nodesets, and a length value, as demonstrated by Vincenzo Iozzo, Willem Pinckaers, and Ralf-Philipp Weinmann during a Pwn2Own competition at CanSecWest 2011.
- Record
EUVD-2011-1298- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4gc5-387r-vqmc No score
Integer overflow in WebKit, as used on the Research In Motion (RIM) BlackBerry Torch 9800 with...
Integer overflow in WebKit, as used on the Research In Motion (RIM) BlackBerry Torch 9800 with firmware 6.0.0.246, in Google Chrome before 10.0.648.133, and in Apple Safari before 5.0.5, allows remote attackers to execute arbitrary code via unknown vectors related to CSS "style handling," nodesets, and a length value, as demonstrated by Vincenzo Iozzo, Willem Pinckaers, and Ralf-Philipp Weinmann during a Pwn2Own competition at CanSecWest 2011.
- Record
GHSA-4gc5-387r-vqmc- Updated
- 2026-11-02
OSVUBUNTU-CVE-2011-1290 No score
Integer overflow in WebKit, as used on the Research In Motion (RIM) BlackBerry Torch 9800 with firmware 6.0.0.246, in Google Chrome before 10.0.648.133, and in Apple Safari before 5.0.5, allows remote attackers to execute arbitrary code via unknown vectors related to CSS "style handling," nodesets, and a length value, as demonstrated by Vincenzo Iozzo, Willem Pinckaers, and Ralf-Philipp Weinmann during a Pwn2Own competition at CanSecWest 2011.
- Record
UBUNTU-CVE-2011-1290- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
chromium-browserDebian:6.0 From an advisory covering 2 CVEs |
before 6.0.472.63~r59945-5+squeeze4, plus listed versions 6.0.472.63~r59945-56.0.472.63~r59945-5+squeeze26.0.472.63~r59945-5+squeeze3 |
6.0.472.63~r59945-5+squeeze4 |
qtwebkit-sourceUbuntu:16.04:LTS |
All versions, plus listed versions 2.3.2-0ubuntu102.3.2-0ubuntu11 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2011-1290 is a high vulnerability (CVSS 10.0) in Apple Webkit, published March 11, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 9.75%, the 95th percentile. No source names a fixed version.
References
vupen.com/english/advisories/2011/0654
googlechromereleases.blogspot.com/2011/03/stable-and-beta-channel-updates.html
secunia.com/advisories/44151
securityfocus.com/bid/46849
securitytracker.com/id?1025212
support.apple.com/kb/HT4596
Show 23 moreShow less
osvdb.org/71182
debian.org/security/2011/dsa-2192
lists.apple.com/archives/security-announce/2011//Apr/msg00002.html
zerodayinitiative.com/advisories/ZDI-11-104
blackberry.com/btsc/KB26132
dvlabs.tippingpoint.com/blog/2011/02/02/pwn2own-2011
zdnet.com/blog/security/pwn2own-2011-blackberry-falls-to-webkit-browser-attack/8401
exchange.xforce.ibmcloud.com/vulnerabilities/66052
nvd.nist.gov/vuln/detail/CVE-2011-1290
github.com/advisories/GHSA-4gc5-387r-vqmc
ubuntu.com/security/CVE-2011-1290
cve.org/CVERecord?id=CVE-2011-1290