Bug 608040 (CVE-2010-2441)

Summary: CVE-2010-2441 WebKit: Keystrokes sent to hidden frame rather than visible frame due to javascript flaw
Product: [Other] Security Response Reporter: Jan Lieskovsky <jlieskov>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: jgrulich, jreznik, than
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-10-19 09:12:47 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
Local copy of public PoC from Mozilla upstream bug [2] none

Description Jan Lieskovsky 2010-06-25 13:53:14 UTC 
Common Vulnerabilities and Exposures assigned an identifier CVE-2010-2441 to
the following vulnerability:

WebKit does not properly restrict focus changes, which allows remote
attackers to read keystrokes via "cross-domain IFRAME gadgets," a
different vulnerability than CVE-2010-1126, CVE-2010-1422, and
CVE-2010-2295.

References:
  [1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2441
  [2] https://bugzilla.mozilla.org/show_bug.cgi?id=552255
Comment 1 Jan Lieskovsky 2010-06-25 14:02:45 UTC 
Created attachment 426888 [details]
Local copy of public PoC from Mozilla upstream bug [2]