{"id":"CVE-2010-3259","aliases":["EUVD-2010-3258","GHSA-ch35-3h8w-gw7f","RHSA-2011:0177"],"status":"published","title":"WebKit, as used in Apple Safari before 4.1.3 and 5.0.x before 5.0.3, Google Chrome before 6.0.472...","description":"WebKit, as used in Apple Safari before 4.1.3 and 5.0.x before 5.0.3, Google Chrome before 6.0.472.53, and webkitgtk before 1.2.6, does not properly restrict read access to images derived from CANVAS elements, which allows remote attackers to bypass the Same Origin Policy and obtain potentially sensitive image data via a crafted web site.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.016,"percentile":0.75936,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200"],"published":"2010-09-07T17:00:00Z","modified":"2026-06-26T10:15:15Z","affected":[{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"webkitgtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.6-2.el6_0"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"webkitgtk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.6-2.el6_0"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"webkitgtk-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.6-2.el6_0"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"webkitgtk-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.6-2.el6_0"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"webkitgtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.6-2.el6_0"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"webkitgtk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.6-2.el6_0"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"webkitgtk-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.6-2.el6_0"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"webkitgtk-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.6-2.el6_0"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"webkitgtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.6-2.el6_0"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"webkitgtk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.6-2.el6_0"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"webkitgtk-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.6-2.el6_0"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"webkitgtk-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.6-2.el6_0"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"webkitgtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.6-2.el6_0"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"webkitgtk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.6-2.el6_0"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"webkitgtk-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.6-2.el6_0"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"webkitgtk-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.6-2.el6_0"}]}],"bundled":30}],"products":[{"vendor":"apple","product":"iphone_os"},{"vendor":"apple","product":"safari"},{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"google","product":"chrome"},{"vendor":"webkitgtk","product":"webkitgtk"}],"references":[{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2011:039","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","Third Party Advisory"]},{"url":"http://www.vupen.com/english/advisories/2010/2722","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Third Party Advisory"]},{"url":"http://secunia.com/advisories/43068","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Third Party Advisory"]},{"url":"http://www.ubuntu.com/usn/USN-1006-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory"]},{"url":"http://support.apple.com/kb/HT4455","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory"]},{"url":"http://secunia.com/advisories/41856","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Third Party Advisory"]},{"url":"http://www.vupen.com/english/advisories/2011/0212","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Third Party Advisory"]},{"url":"https://technet.microsoft.com/library/security/msvr11-002","tags":["x_refsource_MISC","x_transferred","Broken Link"]},{"url":"http://www.vupen.com/english/advisories/2010/3046","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Third Party Advisory"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11221","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred","Third Party Advisory"]},{"url":"http://www.vupen.com/english/advisories/2011/0216","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Third Party Advisory"]},{"url":"http://secunia.com/advisories/43086","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/44206","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory"]},{"url":"http://lists.apple.com/archives/security-announce/2010//Nov/msg00002.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","Mailing List","Third Party Advisory"]},{"url":"http://secunia.com/advisories/42314","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Third Party Advisory"]},{"url":"http://www.redhat.com/support/errata/RHSA-2011-0177.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory"]},{"url":"http://www.vupen.com/english/advisories/2011/0552","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Third Party Advisory"]},{"url":"http://code.google.com/p/chromium/issues/detail?id=53001","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory"]},{"url":"http://support.apple.com/kb/HT4456","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory"]},{"url":"http://googlechromereleases.blogspot.com/2010/09/stable-and-beta-channel-updates.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","Mailing List","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-3259","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-ch35-3h8w-gw7f"},{"url":"https://access.redhat.com/errata/RHSA-2011:0177","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=627366","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=627703","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=628032","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=628035","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=628071","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=628076","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=631939","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=631946","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=631948","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=640353","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=640357","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=640360","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=645914","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=656115","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=656118","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=656126","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=656129","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=667022","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=667024","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=667025","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_0177.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2010-1780","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-1780","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-1780","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2010-1782","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-1782","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-1782","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2010-1783","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-1783","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-1783","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2010-1784","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-1784","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-1784","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2010-1785","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-1785","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-1785","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2010-1786","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-1786","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-1786","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2010-1787","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-1787","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-1787","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2010-1788","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-1788","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-1788","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2010-1790","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-1790","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-1790","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2010-1792","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-1792","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-1792","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2010-1793","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-1793","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-1793","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2010-1807","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-1807","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-1807","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2010-1812","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-1812","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-1812","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2010-1814","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-1814","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-1814","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2010-1815","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-1815","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-1815","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2010-3113","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-3113","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-3113","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2010-3114","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-3114","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-3114","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2010-3115","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-3115","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-3115","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2010-3116","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-3116","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-3116","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2010-3119","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-3119","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-3119","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2010-3255","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-3255","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-3255","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2010-3257","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-3257","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-3257","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2010-3259","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-3259","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2010-3812","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-3812","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-3812","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2010-3813","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-3813","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-3813","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2010-4197","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-4197","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-4197","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2010-4198","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-4198","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-4198","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2010-4204","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-4204","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-4204","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2010-4206","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-4206","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-4206","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2010-4577","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-4577","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-4577","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2010-3259","description":"WebKit, as used in Apple Safari before 4.1.3 and 5.0.x before 5.0.3, Google Chrome before 6.0.472.53, and webkitgtk before 1.2.6, does not properly restrict read access to images derived from CANVAS elements, which allows remote attackers to bypass the Same Origin Policy and obtain potentially sensitive image data via a crafted web site.","status":"published","published":"2010-09-07T17:00:00Z","modified":"2024-08-07T03:03:18.863Z","updated_at":"2026-11-02T14:33:27.354104Z"}],"euvd":[{"id":"EUVD-2010-3258","description":"WebKit, as used in Apple Safari before 4.1.3 and 5.0.x before 5.0.3, Google Chrome before 6.0.472.53, and webkitgtk before 1.2.6, does not properly restrict read access to images derived from CANVAS elements, which allows remote attackers to bypass the Same Origin Policy and obtain potentially sensitive image data via a crafted web site.","status":"published","published":"2010-09-07T17:00:00Z","modified":"2024-08-07T03:03:18Z","updated_at":"2026-11-03T01:39:34.915976Z"}],"ghsa":[{"id":"GHSA-ch35-3h8w-gw7f","title":"WebKit, as used in Apple Safari before 4.1.3 and 5.0.x before 5.0.3, Google Chrome before 6.0.472...","description":"WebKit, as used in Apple Safari before 4.1.3 and 5.0.x before 5.0.3, Google Chrome before 6.0.472.53, and webkitgtk before 1.2.6, does not properly restrict read access to images derived from CANVAS elements, which allows remote attackers to bypass the Same Origin Policy and obtain potentially sensitive image data via a crafted web site.","status":"published","published":"2022-05-13T01:24:31Z","modified":"2023-02-01T05:07:18Z","cwes":["CWE-200"],"updated_at":"2026-11-02T14:50:31.141675Z"}],"nvd":[{"id":"CVE-2010-3259","description":"WebKit, as used in Apple Safari before 4.1.3 and 5.0.x before 5.0.3, Google Chrome before 6.0.472.53, and webkitgtk before 1.2.6, does not properly restrict read access to images derived from CANVAS elements, which allows remote attackers to bypass the Same Origin Policy and obtain potentially sensitive image data via a crafted web site.","status":"published","published":"2010-09-07T18:00:03.043Z","modified":"2026-06-16T23:22:27.913Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:01:52.227027Z"}],"osv":[{"id":"RHSA-2011:0177","title":"Red Hat Security Advisory: webkitgtk security update","status":"published","published":"2024-09-15T18:54:18Z","modified":"2026-06-26T10:15:15Z","updated_at":"2026-11-02T15:53:01.003286Z"}]}}